{"id":"CVE-2014-8121","aliases":["DEBIAN-CVE-2014-8121","DLA-316-1","DSA-3480-1","EUVD-2014-7966","GHSA-hw66-pxhg-8fx8","MGASA-2015-0195","RHSA-2015:0327","SUSE-SU-2015:1424-1","SUSE-SU-2015:1844-1","SUSE-SU-2016:0470-1","UBUNTU-CVE-2014-8121","USN-2985-1","openSUSE-SU-2024:10154-1"],"status":"published","title":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc...","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05609,"percentile":0.92964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-17"],"published":"2015-03-27T00:00:00Z","modified":"2026-10-23T15:47:35Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","fixed_in":["2.19-0ubuntu6.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-4+deb6u7"}]}],"versions":["2.11.2-10","2.11.2-10+m68k.1","2.11.2-11","2.11.2-11+m68k.1","2.11.2-12","2.11.2-13","2.11.3-1","2.11.3-2","2.11.3-3","2.11.3-4"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-38+deb7u10"}]}],"versions":["2.13-38","2.13-38+deb7u1","2.13-38+deb7u2","2.13-38+deb7u3","2.13-38+deb7u4","2.13-38+deb7u5","2.13-38+deb7u6","2.13-38+deb7u7","2.13-38+deb7u8","2.13-38+deb7u9"],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-9.11.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-78.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-22.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-22.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-22.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-22.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.45.66.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.8"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.8"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-2.3"}]}],"bundled":31}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gnu","product":"glibc"},{"vendor":"suse","product":"suse_linux_enterprise_desktop"},{"vendor":"suse","product":"suse_linux_enterprise_server"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1165192","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","evidence","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","article"]},{"url":"http://www.ubuntu.com/usn/USN-2985-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201602-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://sourceware.org/ml/libc-alpha/2015-02/msg00617.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0327.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/73038","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3480","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2985-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8121","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0327","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8121","tags":["report"]},{"url":"https://github.com/advisories/GHSA-hw66-pxhg-8fx8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8121","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0195.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15800","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15545","tags":["report"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=16009","tags":["report"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=17269","tags":["report"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=18032","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-0327.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-0863.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1084089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1124453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1135841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138520","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0327.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6040","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8121","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151424-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/830257","tags":["report"]},{"url":"https://bugzilla.suse.com/851280","tags":["report"]},{"url":"https://bugzilla.suse.com/918187","tags":["report"]},{"url":"https://bugzilla.suse.com/920338","tags":["report"]},{"url":"https://bugzilla.suse.com/927080","tags":["report"]},{"url":"https://bugzilla.suse.com/928723","tags":["report"]},{"url":"https://bugzilla.suse.com/932059","tags":["report"]},{"url":"https://bugzilla.suse.com/933770","tags":["report"]},{"url":"https://bugzilla.suse.com/933903","tags":["report"]},{"url":"https://bugzilla.suse.com/935286","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1781","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151844-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/915955","tags":["report"]},{"url":"https://bugzilla.suse.com/931480","tags":["report"]},{"url":"https://bugzilla.suse.com/934084","tags":["report"]},{"url":"https://bugzilla.suse.com/937853","tags":["report"]},{"url":"https://bugzilla.suse.com/939211","tags":["report"]},{"url":"https://bugzilla.suse.com/940195","tags":["report"]},{"url":"https://bugzilla.suse.com/940332","tags":["report"]},{"url":"https://bugzilla.suse.com/944494","tags":["report"]},{"url":"https://bugzilla.suse.com/945779","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/847227","tags":["report"]},{"url":"https://bugzilla.suse.com/863499","tags":["report"]},{"url":"https://bugzilla.suse.com/892065","tags":["report"]},{"url":"https://bugzilla.suse.com/950944","tags":["report"]},{"url":"https://bugzilla.suse.com/961721","tags":["report"]},{"url":"https://bugzilla.suse.com/962736","tags":["report"]},{"url":"https://bugzilla.suse.com/962737","tags":["report"]},{"url":"https://bugzilla.suse.com/962738","tags":["report"]},{"url":"https://bugzilla.suse.com/962739","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8779","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-8121","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2985-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-2207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3075","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5417","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8121","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2015-03-27T14:00:00Z","modified":"2024-08-06T13:10:50.918Z","updated_at":"2026-11-02T14:33:42.882687Z"}],"euvd":[{"id":"EUVD-2014-7966","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2015-03-27T14:00:00Z","modified":"2024-08-06T13:10:50Z","updated_at":"2026-11-03T01:56:52.951821Z"}],"ghsa":[{"id":"GHSA-hw66-pxhg-8fx8","title":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc...","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2022-05-14T02:20:43Z","modified":"2023-02-10T05:06:15Z","updated_at":"2026-11-02T14:54:01.286462Z"}],"nvd":[{"id":"CVE-2014-8121","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2015-03-27T14:59:03.353Z","modified":"2026-06-17T00:16:19.183Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-17"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-8121","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2015-03-27T14:59:03Z","modified":"2026-04-16T06:15:17.624876944Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-8121","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2015-03-27T14:59:03.353Z","modified":"2026-10-23T15:47:35.866277187Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-316-1","title":"eglibc - security update","status":"published","published":"2015-09-27T00:00:00Z","modified":"2026-03-09T01:17:57.355698Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-3480-1","title":"eglibc - security update","status":"published","published":"2016-02-16T00:00:00Z","modified":"2026-03-09T01:18:03.633453Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0195","title":"Updated glibc packages fix security vulnerabilities","description":"Updated glibc package fixes security vulnerabilities:\n\nIt was discovered that, under certain circumstances, glibc's getaddrinfo()\nfunction would send DNS queries to random file descriptors. An attacker\ncould potentially use this flaw to send DNS queries to unintended\nrecipients, resulting in information disclosure or data loss due to the\napplication encountering corrupted data. (CVE-2013-7423)\n\nIt was found that the files back end of Name Service Switch (NSS) did not\nisolate iteration over an entire database from key-based look-up API calls.\nAn application performing look-ups on a database while iterating over it\ncould enter an infinite loop, leading to a denial of service.\n(CVE-2014-8121)\n\nA buffer overflow flaw was found in the way glibc's gethostbyname_r() and\nother related functions computed the size of a buffer when passed a\nmisaligned buffer as input. An attacker able to make an application call\nany of these functions with a misaligned buffer could use this flaw to\ncrash the application or, potentially, execute arbitrary code with the\npermissions of the user running the application. (CVE-2015-1781)\n\nJoseph Myers discovered strxfrm is vulnerable to integer overflows\nwhen computing memory allocation sizes (similar to CVE-2012-4412)\n[BZ #16009] (CVE pending)\n\nShaun Colley discovered strxfrm falls back to an unbounded alloca if\nmalloc fails making it vulnerable to stack-based buffer overflows\n(similar to CVE-2012-4424) [BZ #16009] (CVE pending)\n\nA buffer overflow flaw was found in libio/wstrops.c:_IO_wstr_overflow \nwich allows for overflow in calculating the new size in wide characters,\nbut not for overflow in the multiplication to compute the size in bytes,\nwhich could thus overflow and result in a buffer overrun copying data\ninto the new buffer. [BZ #17269] (CVE pending)\n\nWhen processing certain malformed patterns, fnmatch can skip over the\nNUL byte terminating the pattern.  This can potentially result in an\napplication crash if fnmatch hits an unmapped page before encountering a\nNUL byte. [BZ #18032] (CVE pending)\n\nOther fixes in this update:\nnscd package was missing the /var/db/nscd directory wich prevented\nit to work properly (mga#15545).\n","status":"published","published":"2015-05-06T15:16:01Z","modified":"2026-04-16T06:25:55.892772452Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10154-1","title":"glibc-2.24-2.3 on GA media","description":"These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:26.960082Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:0327","title":"Red Hat Security Advisory: glibc security and bug fix update","status":"published","published":"2024-09-15T21:54:24Z","modified":"2026-06-26T12:20:57.142376726Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:1424-1","title":"Security update for glibc","description":"This update for glibc provides fixes for security and non-security issues.\n\nThese security issues have been fixed:\n\n- CVE-2015-1781: Buffer length after padding in resolv/nss_dns/dns-host.c. (bsc#927080)\n- CVE-2013-2207: pt_chown did not properly check permissions for tty files, which allowed\n  local users to change the permission on the files and obtain access to arbitrary\n  pseudo-terminals by leveraging a FUSE file system. (bsc#830257)\n- CVE-2014-8121: DB_LOOKUP in the Name Service Switch (NSS) did not properly check if a\n  file is open, which allowed remote attackers to cause a denial of service (infinite loop)\n  by performing a look-up while the database is iterated over the database, which triggers\n  the file pointer to be reset. (bsc#918187)\n- Fix read past end of pattern in fnmatch. (bsc#920338)\n\nThese non-security issues have been fixed:\n\n- Fix locking in _IO_flush_all_lockp() to prevent deadlocks in applications. (bsc#851280)\n- Record TTL also for DNS PTR queries. (bsc#928723)\n- Fix invalid free in ld.so. (bsc#932059)\n- Make PowerPC64 default to non-executable stack. (bsc#933770)\n- Fix floating point exceptions in some circumstances with exp() and friends. (bsc#933903)\n- Fix bad TEXTREL in glibc.i686. (bsc#935286)\n  ","status":"published","published":"2015-07-31T18:02:04Z","modified":"2026-02-04T02:57:26.061002Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1844-1","title":"Security update for glibc","description":"\nglibc was updated to fix bugs and security issues.\n\nSecurity issues fixed:\n\n* A buffer overflow in nss_dns was fixed that could lead to crashes. (CVE-2015-1781, bsc#927080, BZ #18287)\n* A denial of service attack (out of memory) in the NSS files backend was fixed (CVE-2014-8121, bsc#918187, GLIBC BZ #18007)\n\nNon security bugs fixed:\n\n* Fix regression in threaded application malloc performance (bsc#915955, GLIBC#17195)\n* Fix read past end of pattern in fnmatch (bsc#920338, GLIBC#17062, GLIBC#18032, GLIBC#18036)\n* Record TTL also for DNS PTR queries (bsc#928723, GLIBC#18513)\n* Increase MINSIGSTKSZ and SIGSTKSZ for aarch64 (bsc#931480, GLIBC#16850)\n* Fix handling of IPv6 nameservers (bsc#939211, GLIBC#13028, GLIBC#17053)\n* Avoid use of asm/ptrace.h (bsc#934084)\n* Do not corrupt the top of a threaded heap if top chunk is MINSIZE (GLIBC#18502)\n* Terminate unwinding after makecontext_ret on s390 (bsc#940332. bsc#944494, GLIBC#18508)\n* Restore signal mask in set/swapcontext on s390 (bsc#940195, bsc#944494, GLIBC#18080)\n* fix dlopen in static binaries (bsc#937853, GLIBC#17250)\n* Properly reread entry after failure in nss_files getent function (bsc#945779, BZ #18991)\n\nFeatures added:\n\n* AVX512 support (fate#318844)\n* Add compatibility symlinks for LSB 3.0 (fate#318933)\n","status":"published","published":"2015-09-24T14:17:00Z","modified":"2026-02-04T03:14:33.43907Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0470-1","title":"Security update for glibc","description":"\nThis update for glibc fixes the following issues:\n\n- CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721)\n- CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944)\n- CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736)\n- CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737)\n- CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738)\n- CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739)\n- CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal (bsc#830257)\n- CVE-2013-4458: Stack (frame) overflow in getaddrinfo() when called with AF_INET6 (bsc#847227)\n- CVE-2014-8121: denial of service issue in the NSS backends (bsc#918187)\n- bsc#920338: Read past end of pattern in fnmatch\n- CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)\n\nThe following non-security bugs were fixed:\n\n- bnc#892065: SIGSEV tst-setlocale3 in glibc-2.11.3-17.68.1\n- bnc#863499: Memory leak in getaddrinfo when many RRs are returned \n- bsc#892065: Avoid unbound alloca in setenv\n- bsc#945779: Properly reread entry after failure in nss_files getent function\n","status":"published","published":"2016-02-16T15:37:56Z","modified":"2026-02-04T03:05:55.904983Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2014-8121","description":"DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.","status":"published","published":"2015-03-27T00:00:00Z","modified":"2026-04-22T09:51:37.243399Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2985-1","title":"eglibc, glibc vulnerabilities","description":"Martin Carpenter discovered that pt_chown in the GNU C Library did not\nproperly check permissions for tty files. A local attacker could use this\nto gain administrative privileges or expose sensitive information.\n(CVE-2013-2207, CVE-2016-2856)\n\nRobin Hack discovered that the Name Service Switch (NSS) implementation in\nthe GNU C Library did not properly manage its file descriptors. An attacker\ncould use this to cause a denial of service (infinite loop).\n(CVE-2014-8121)\n\nJoseph Myers discovered that the GNU C Library did not properly handle long\narguments to functions returning a representation of Not a Number (NaN). An\nattacker could use this to cause a denial of service (stack exhaustion\nleading to an application crash) or possibly execute arbitrary code.\n(CVE-2014-9761)\n\nArjun Shankar discovered that in certain situations the nss_dns code in the\nGNU C Library did not properly account buffer sizes when passed an\nunaligned buffer. An attacker could use this to cause a denial of service\nor possibly execute arbitrary code. (CVE-2015-1781)\n\nSumit Bose and Lukas Slebodnik discovered that the Name Service\nSwitch (NSS) implementation in the GNU C Library did not handle long\nlines in the files databases correctly. A local attacker could use\nthis to cause a denial of service (application crash) or possibly\nexecute arbitrary code. (CVE-2015-5277)\n\nAdam Nielsen discovered that the strftime function in the GNU C Library did\nnot properly handle out-of-range argument data. An attacker could use this\nto cause a denial of service (application crash) or possibly expose\nsensitive information. (CVE-2015-8776)\n\nHector Marco and Ismael Ripoll discovered that the GNU C Library allowed\nthe pointer-guarding protection mechanism to be disabled by honoring the\nLD_POINTER_GUARD environment variable across privilege boundaries. A local\nattacker could use this to exploit an existing vulnerability more easily.\n(CVE-2015-8777)\n\nSzabolcs Nagy discovered that the hcreate functions in the GNU C Library\ndid not properly check its size argument, leading to an integer overflow.\nAn attacker could use to cause a denial of service (application crash) or\npossibly execute arbitrary code. (CVE-2015-8778)\n\nMaksymilian Arciemowicz discovered a stack-based buffer overflow in the\ncatopen function in the GNU C Library when handling long catalog names. An\nattacker could use this to cause a denial of service (application crash) or\npossibly execute arbitrary code. (CVE-2015-8779)\n\nFlorian Weimer discovered that the getnetbyname implementation in the GNU C\nLibrary did not properly handle long names passed as arguments. An attacker\ncould use to cause a denial of service (stack exhaustion leading to an\napplication crash). (CVE-2016-3075)\n","status":"published","published":"2016-05-25T20:22:47Z","modified":"2026-04-27T15:17:30.767227083Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}