{"id":"CVE-2015-1473","aliases":["AZL-40934","BELL-CVE-2015-1473","DEBIAN-CVE-2015-1473","DLA-165-1","DSA-3169-1","EUVD-2015-1608","GHSA-jx9c-49v7-hj5h","MGASA-2015-0072","RHSA-2015:2199","RHSA-2015:2589","UBUNTU-CVE-2015-1473","USN-2519-1","openSUSE-SU-2024:10154-1"],"status":"published","title":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21...","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02129,"percentile":0.82068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-02-05T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"dietlibc","fixed_in":["0.34-7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.19-15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.19-15"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.19-15"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","fixed_in":["2.19-0ubuntu6.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dietlibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-15"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-15"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-15"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-4+deb6u5"}]}],"versions":["2.11.2-10","2.11.2-10+m68k.1","2.11.2-11","2.11.2-11+m68k.1","2.11.2-12","2.11.2-13","2.11.3-1","2.11.3-2","2.11.3-3","2.11.3-4"],"bundled":18},{"source":"osv","ecosystem":"Debian:7","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-38+deb7u8"}]}],"versions":["2.13-38","2.13-38+deb7u1","2.13-38+deb7u2","2.13-38+deb7u3","2.13-38+deb7u4","2.13-38+deb7u5","2.13-38+deb7u6","2.13-38+deb7u7"],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-9.9.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-105.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.el7_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.1::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-79.ael7b_1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.6"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.6"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-2.3"}]}],"bundled":31}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gnu","product":"glibc"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2519-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/72499","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2015/02/04/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1473","tags":["web","advisory"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06"},{"url":"https://github.com/advisories/GHSA-jx9c-49v7-hj5h"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-1473","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1473","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0072.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15259","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/04/1","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2199","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/articles/2050743","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1187109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1195762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1197730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1199525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225490","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2199.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-7423","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7423","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1472","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1472","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1473","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1781","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1781","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2589","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1262914","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2589.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5277","tags":["advisory"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=17079","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2015-1473","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2519-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-7423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1472","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5417","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1473","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-04-08T10:00:00Z","modified":"2024-08-06T04:47:16.189Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1608","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-04-08T10:00:00Z","modified":"2024-08-06T04:47:16Z","updated_at":"2026-11-03T02:22:15.605684Z"}],"ghsa":[{"id":"GHSA-jx9c-49v7-hj5h","title":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21...","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2022-05-17T03:44:58Z","modified":"2025-04-12T12:47:53Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:21.867045Z"}],"nvd":[{"id":"CVE-2015-1473","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-04-08T10:59:03.627Z","modified":"2026-06-17T00:22:29.193Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"BELL-CVE-2015-1473","title":"CVE-2015-1473 does not affect BellSoft software","status":"withdrawn","published":"2015-04-08T10:59:00Z","modified":"2026-01-28T07:21:40.356012Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"AZL-40934","title":"CVE-2015-1473 affecting package dietlibc for versions less than 0.34-7","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-04-08T10:59:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"CVE-2015-1473","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-04-08T10:59:03Z","modified":"2026-04-16T06:19:19.986349228Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1473","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-04-08T10:59:03.627Z","modified":"2026-09-09T06:47:26.96379568Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-165-1","title":"eglibc - security update","status":"published","published":"2015-03-06T00:00:00Z","modified":"2026-03-09T01:18:41.690279Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3169-1","title":"eglibc - security update","status":"published","published":"2015-02-23T00:00:00Z","modified":"2026-03-09T01:19:03.925254Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0072","title":"Updated glibc packages fix security vulnerabilities","description":"Under certain conditions wscanf can allocate too little memory for the\nto-be-scanned arguments and overflow the allocated buffer (CVE-2015-1472).\n\nThe incorrect use of \"__libc_use_alloca (newsize)\" caused a different\n(and weaker) policy to be enforced which could allow a denial of service\nattack (CVE-2015-1473).\n","status":"published","published":"2015-02-17T18:38:13Z","modified":"2026-04-16T06:24:22.033390518Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10154-1","title":"glibc-2.24-2.3 on GA media","description":"These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:26.960082Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:2199","title":"Red Hat Security Advisory: glibc security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:32:55Z","modified":"2026-06-28T10:15:12Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2589","title":"Red Hat Security Advisory: glibc security update","status":"published","published":"2024-09-15T22:53:44Z","modified":"2026-06-28T10:15:25Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2015-1473","description":"The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.","status":"published","published":"2015-02-05T00:00:00Z","modified":"2026-04-22T10:02:47.403411Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2519-1","title":"eglibc, glibc vulnerabilities","description":"Arnaud Le Blanc discovered that the GNU C Library incorrectly handled file\ndescriptors when resolving DNS queries under high load. This may cause a\ndenial of service in other applications, or an information leak. This issue\nonly affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.\n(CVE-2013-7423)\n\nIt was discovered that the GNU C Library incorrectly handled receiving a\npositive answer while processing the network name when performing DNS\nresolution. A remote attacker could use this issue to cause the GNU C\nLibrary to hang, resulting in a denial of service. (CVE-2014-9402)\n\nJoseph Myers discovered that the GNU C Library wscanf function incorrectly\nhandled memory. A remote attacker could possibly use this issue to cause\nthe GNU C Library to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu\n14.04 LTS and Ubuntu 14.10. (CVE-2015-1472, CVE-2015-1473)\n","status":"published","published":"2015-02-26T15:57:33Z","modified":"2026-04-22T09:09:41.227257Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}