NVD - CVE-2015-7547

CVE-2015-7547 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Description

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 8.1 HIGH

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 6.8 MEDIUM

Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://fortiguard.com/advisory/glibc-getaddrinfo-stack-overflow
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177412.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00043.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00044.html	Third Party Advisory
http://marc.info/?l=bugtraq&m=145596041017029&w=2
http://marc.info/?l=bugtraq&m=145672440608228&w=2
http://marc.info/?l=bugtraq&m=145690841819314&w=2
http://marc.info/?l=bugtraq&m=145857691004892&w=2
http://marc.info/?l=bugtraq&m=146161017210491&w=2
http://packetstormsecurity.com/files/135802/glibc-getaddrinfo-Stack-Based-Buffer-Overflow.html
http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html
http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html
http://rhn.redhat.com/errata/RHSA-2016-0175.html
http://rhn.redhat.com/errata/RHSA-2016-0176.html	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0225.html
http://rhn.redhat.com/errata/RHSA-2016-0277.html
http://seclists.org/fulldisclosure/2019/Sep/7
http://seclists.org/fulldisclosure/2021/Sep/0
http://seclists.org/fulldisclosure/2022/Jun/36
http://support.citrix.com/article/CTX206991
http://ubuntu.com/usn/usn-2900-1	Third Party Advisory
http://www.debian.org/security/2016/dsa-3480
http://www.debian.org/security/2016/dsa-3481	Third Party Advisory
http://www.fortiguard.com/advisory/glibc-getaddrinfo-stack-overflow
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160304-01-glibc-en
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html	Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/83265
http://www.securitytracker.com/id/1035020
http://www.vmware.com/security/advisories/VMSA-2016-0002.html
https://access.redhat.com/articles/2161461	Third Party Advisory
https://blogs.sophos.com/2016/02/24/utm-up2date-9-355-released/	Third Party Advisory
https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/	Third Party Advisory
https://bto.bluecoat.com/security-advisory/sa114	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1293532	Issue Tracking Third Party Advisory
https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05028479	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04989404	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05008367
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05053211
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073516
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05098877	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05125672	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128937	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05140858	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176716
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05212266
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
https://ics-cert.us-cert.gov/advisories/ICSA-16-103-01
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40161	Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10150	Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/7
https://security.gentoo.org/glsa/201602-02	Third Party Advisory
https://security.netapp.com/advisory/ntap-20160217-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=18665	Issue Tracking
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html	Mailing List Vendor Advisory
https://support.f5.com/kb/en-us/solutions/public/k/47/sol47098834.html	Third Party Advisory
https://support.lenovo.com/us/en/product_security/len_5450
https://www.arista.com/en/support/advisories-notices/security-advisories/1255-security-advisory-17
https://www.exploit-db.com/exploits/39454/
https://www.exploit-db.com/exploits/40339/
https://www.kb.cert.org/vuls/id/457759
https://www.tenable.com/security/research/tra-2017-08

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

47 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2015-7547
NVD Published Date:
02/18/2016
NVD Last Modified:
02/12/2023
Source:
Red Hat, Inc.

CVE-2015-7547 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by Red Hat, Inc. 5/13/2024 11:42:01 PM

CVE Modified by Red Hat, Inc. 2/12/2023 6:15:36 PM

CVE Modified by Red Hat, Inc. 2/02/2023 4:16:00 PM

CVE Modified by Red Hat, Inc. 6/20/2022 3:15:08 PM

CVE Modified by Red Hat, Inc. 6/17/2022 3:15:08 PM

CVE Modified by Red Hat, Inc. 1/25/2022 9:15:08 AM

CVE Modified by Red Hat, Inc. 9/01/2021 2:15:08 PM

CVE Modified by Red Hat, Inc. 9/01/2021 9:15:08 AM

CVE Modified by Red Hat, Inc. 9/04/2019 10:15:11 PM

CVE Modified by Red Hat, Inc. 9/04/2019 8:15:11 PM

CVE Modified by Red Hat, Inc. 9/04/2019 7:15:11 PM

CVE Modified by Red Hat, Inc. 11/30/2018 4:31:24 PM

CPE Deprecation Remap by NIST 10/30/2018 12:27:37 PM

CPE Deprecation Remap by NIST 10/30/2018 12:27:36 PM

CVE Modified by Red Hat, Inc. 1/18/2018 1:18:02 PM

CVE Modified by Red Hat, Inc. 11/09/2017 9:29:02 PM

CVE Modified by Red Hat, Inc. 11/02/2017 9:29:01 PM

CVE Modified by Red Hat, Inc. 9/02/2017 9:29:01 PM

CVE Modified by Red Hat, Inc. 2/16/2017 9:59:04 PM

CVE Modified by Red Hat, Inc. 1/19/2017 9:59:03 PM

CVE Modified by Red Hat, Inc. 12/05/2016 10:03:16 PM

CVE Modified by Red Hat, Inc. 12/02/2016 10:13:00 PM

CVE Modified by Red Hat, Inc. 11/30/2016 10:01:15 PM

CVE Modified by Red Hat, Inc. 11/29/2016 10:02:16 PM

CVE Modified by Red Hat, Inc. 11/28/2016 2:43:31 PM

CVE Modified by Red Hat, Inc. 10/11/2016 10:01:25 PM

CVE Modified by Red Hat, Inc. 8/23/2016 9:59:10 PM

CVE Modified by Red Hat, Inc. 8/22/2016 10:10:06 PM

CVE Modified by Red Hat, Inc. 8/19/2016 10:01:00 PM

CVE Modified by Red Hat, Inc. 8/16/2016 9:59:47 PM

Modified Analysis by NIST 8/05/2016 11:05:28 AM

CVE Modified by Red Hat, Inc. 7/27/2016 9:59:16 PM

CVE Modified by Red Hat, Inc. 7/22/2016 9:59:01 PM

Modified Analysis by NIST 6/23/2016 1:46:10 PM

CVE Modified by Red Hat, Inc. 6/20/2016 9:59:08 PM

CVE Modified by Red Hat, Inc. 6/14/2016 10:00:04 PM

CVE Modified by Red Hat, Inc. 6/10/2016 10:00:43 PM

CVE Modified by Red Hat, Inc. 6/02/2016 10:00:00 PM

Modified Analysis by NIST 4/26/2016 10:29:36 AM

Modified Analysis by NIST 4/25/2016 10:13:14 AM

CVE Modified by Red Hat, Inc. 4/21/2016 9:59:32 PM

CVE Modified by Red Hat, Inc. 4/20/2016 9:59:14 PM

CVE Modified by Red Hat, Inc. 4/11/2016 9:59:22 PM

Modified Analysis by NIST 4/01/2016 2:45:21 PM

CVE Modified by Red Hat, Inc. 2/24/2016 9:59:01 PM

Modified Analysis by NIST 2/19/2016 11:08:12 AM

Initial CVE Analysis 2/19/2016 10:51:12 AM

Quick Info