CVSS 3.0
8.1 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2015-7547
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Severity
- EPSS
- 92% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- f5:big-ip_access_policy_manager
- f5:big-ip_advanced_firewall_manager
- f5:big-ip_analytics
- f5:big-ip_application_acceleration_manager
- f5:big-ip_application_security_manager
- f5:big-ip_domain_name_system
- f5:big-ip_link_controller
- f5:big-ip_local_traffic_manager
- f5:big-ip_policy_enforcement_manager
- gnu:glibc
- hp:helion_openstack
- hp:server_migration_pack
- opensuse:opensuse
- oracle:exalogic_infrastructure
- oracle:fujitsu_m10_firmware
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_hpc_node
- redhat:enterprise_linux_hpc_node_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_eus
- redhat:enterprise_linux_workstation
- sophos:unified_threat_management_software
- suse:linux_enterprise_debuginfo
- suse:linux_enterprise_desktop
- suse:linux_enterprise_server
- suse:linux_enterprise_software_development_kit
- suse:suse_linux_enterprise_server
References
- http://fortiguard.com/advisory/glibc-getaddrinfo-stack-overflow
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177412.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html