CVE-2015-7547

Impact:
Critical
Public Date:
2016-02-16
IAVA:
2016-A-0053, 2016-B-0036, 2016-B-0037
CWE:
CWE-121
Bugzilla:
1293532: CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow
A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module.

Find out more about CVE-2015-7547 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

After updating the glibc package on affected systems, it is strongly recommended to reboot the system or restart all the affected services. For more information please refer to: https://access.redhat.com/articles/2161461

CVSS v2 metrics

Base Score 6.8
Base Metrics AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux Extended Update Support 6.6 (glibc) RHSA-2016:0225 2016-02-16
Red Hat Enterprise Linux 7 (glibc) RHSA-2016:0176 2016-02-16
Red Hat Enterprise Linux Advanced Update Support 6.5 (glibc) RHSA-2016:0225 2016-02-16
Red Hat Enterprise Linux Advanced Update Support 6.4 (glibc) RHSA-2016:0225 2016-02-16
Red Hat Enterprise Linux 6 (glibc) RHSA-2016:0175 2016-02-16
Red Hat Enterprise Linux Extended Update Support 7.1 (glibc) RHSA-2016:0225 2016-02-16
Red Hat Enterprise Linux Advanced Update Support 6.2 (glibc) RHSA-2016:0225 2016-02-16
RHEV Hypervisor for RHEL-6 RHSA-2016:0277 2016-02-19
Managment Agent for RHEL 7 Hosts (rhev-hypervisor7) RHSA-2016:0277 2016-02-19

Affected Packages State

Platform Package State
Red Hat Enterprise Linux Extended Update Support 7.2 rhel-guest-image Affected
Red Hat Enterprise Linux 5 glibc Not affected
Red Hat Enterprise Linux 4 glibc Not affected
Red Hat Enterprise Linux 3 glibc Not affected

Acknowledgements

This issue was discovered by the Google Security Team and Red Hat.

Mitigation

External References

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.