CVE-2015-8985

Published: 20 March 2017

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Priority

Negligible

CVSS 3 base score: 5.9

Status

Package Release Status
eglibc
Launchpad, Ubuntu, Debian
Upstream Needed

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Needs triage

glibc
Launchpad, Ubuntu, Debian
Upstream
Released (2.28)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(2.28-0ubuntu1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.28-0ubuntu1)
Ubuntu 18.04 LTS (Bionic Beaver) Needed

Ubuntu 16.04 ESM (Xenial Xerus) Needed

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672

Notes

AuthorNote
sbeattie
PoC testcase in upstream bug report
fix commit possibly introduced regression addressed by
bc680b336971305cb39896b30d72dc7101b62242

References

Bugs