About details of CVE-2014-8121.

Issue

• We received some questions regarding CVE-2014-8121 from our customer. Could you please answer the following questions?

  1. We think that whether this vulnerability affects or not depends on how APP which uses NSS-related function included in libnss_file library uses the function. Is it correct?

  2. httpd and named load libnss_file library. Does this vulnerability affect httpd and named shipped in RHEL5?

  3. If httpd and named are affected then we want to know the condition to be affected. Which is affected, access from remote or local? Or all accesses may be affected without any condition?