{"id":"CVE-2014-9984","aliases":["BELL-CVE-2014-9984","DEBIAN-CVE-2014-9984","EUVD-2014-9788","GHSA-qp88-3vr4-mjq3","SUSE-SU-2018:0076-1","UBUNTU-CVE-2014-9984","USN-6762-1"],"status":"published","title":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the...","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04476,"percentile":0.9152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-06-12T13:00:00Z","modified":"2026-10-23T16:00:24Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.19-14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.19-14"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.19-14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","fixed_in":["2.19-0ubuntu6.15+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-14"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-14"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-14"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-22.24.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.15+esm3"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.15+esm3"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-0ubuntu11.3+esm6"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11","2.23-0ubuntu11.2","2.23-0ubuntu11.3","2.23-0ubuntu11.3+esm1","2.23-0ubuntu11.3+esm2","2.23-0ubuntu11.3+esm3","2.23-0ubuntu11.3+esm5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-3ubuntu1.6+esm2"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1","2.27-3ubuntu1.2","2.27-3ubuntu1.3","2.27-3ubuntu1.4","2.27-3ubuntu1.5","2.27-3ubuntu1.6","2.27-3ubuntu1.6+esm1"],"bundled":5}],"products":[{"vendor":"gnu","product":"glibc"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=16695","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/99071","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=c44496df2f090a56d3bf75df930592dac6bba46f","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2019/Jun/18","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Jun/14","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2019/Sep/7","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Sep/7","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9984"},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=c44496df2f090a56d3bf75df930592dac6bba46f"},{"url":"https://github.com/advisories/GHSA-qp88-3vr4-mjq3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-9984","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9984","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180076-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1043984","tags":["report"]},{"url":"https://bugzilla.suse.com/1074293","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000001","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9984","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9984","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6762-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-20109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2961","tags":["report"]},{"url":"https://launchpad.net/bugs/2063328","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9984","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2017-06-12T13:00:00Z","modified":"2024-08-06T14:02:37.523Z","updated_at":"2026-11-02T14:33:42.882687Z"}],"euvd":[{"id":"EUVD-2014-9788","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2017-06-12T13:00:00Z","modified":"2024-08-06T14:02:37Z","updated_at":"2026-11-03T01:56:47.076958Z"}],"ghsa":[{"id":"GHSA-qp88-3vr4-mjq3","title":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the...","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2022-05-14T00:58:26Z","modified":"2025-04-20T03:39:51Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:47.903342Z"}],"nvd":[{"id":"CVE-2014-9984","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2017-06-12T13:29:00.183Z","modified":"2026-06-17T00:19:21.247Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:59.001778Z"}],"osv":[{"id":"BELL-CVE-2014-9984","title":"CVE-2014-9984 does not affect BellSoft software","status":"withdrawn","published":"2017-06-12T13:29:00Z","modified":"2026-01-26T09:49:46.479105Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-9984","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2017-06-12T13:29:00Z","modified":"2026-04-10T03:44:59.80001Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9984","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2017-06-12T13:29:00.183Z","modified":"2026-10-23T16:00:24.14396493Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9984","description":"nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.","status":"published","published":"2017-06-12T13:29:00Z","modified":"2026-04-22T09:29:39.59476Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"SUSE-SU-2018:0076-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- A privilege escalation bug in the realpath() function has been fixed.\n  [CVE-2018-1000001, bsc#1074293]\n\n- A buffer manipulation vulnerability in nscd has been fixed that could\n  possibly have lead to an nscd daemon crash or code execution as the user\n  running nscd. [CVE-2014-9984, bsc#1043984]\n","status":"published","published":"2018-01-12T08:44:04Z","modified":"2026-02-04T02:25:25.494349Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-6762-1","title":"eglibc, glibc vulnerabilities","description":"It was discovered that GNU C Library incorrectly handled netgroup requests.\nAn attacker could possibly use this issue to cause a crash or execute arbitrary code.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2014-9984)\n\nIt was discovered that GNU C Library might allow context-dependent\nattackers to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2015-20109)\n\nIt was discovered that GNU C Library when processing very long pathname arguments to\nthe realpath function, could encounter an integer overflow on 32-bit\narchitectures, leading to a stack-based buffer overflow and, potentially,\narbitrary code execution. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2018-11236)\n\nIt was discovered that the GNU C library getcwd function incorrectly\nhandled buffers. An attacker could use this issue to cause the GNU C\nLibrary to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-3999)\n\nCharles Fol discovered that the GNU C Library iconv feature incorrectly\nhandled certain input sequences. An attacker could use this issue to cause\nthe GNU C Library to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2024-2961)\n","status":"published","published":"2024-05-02T12:45:48Z","modified":"2026-06-29T13:51:10.431518189Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}