Your submission was sent successfully! Close

CVE-2016-3075

Published: 31 March 2016

Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.

From the Ubuntu security team

Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly handle long names passed as arguments. An attacker could use to cause a denial of service (stack exhaustion leading to an application crash).

Priority

Low

CVSS 3 base score: 7.5

Status

Package Release Status
eglibc
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.19-0ubuntu6.8)
glibc
Launchpad, Ubuntu, Debian
Upstream
Released (2.22-6)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(2.23-0ubuntu3)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=317b199b4aff8cfa27f2302ab404d2bb5032b9a4