CVE-2014-9984 nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash...
CriticalCVSS 9.8
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glibc(Debian:12) | < 2.19-14 | 2.19-14 |
| debian/glibc(Debian:13) | < 2.19-14 | 2.19-14 |
| debian/glibc(Debian:14) | < 2.19-14 | 2.19-14 |
| GNU glibc | <= 2.19 | No fix listed |
References
- Debian Security Tracker CVE-2014-9984 vendor-advisory
- packetstormsecurity.com
- packetstormsecurity.com
- 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-list
- 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-list
- 99071 vdb-entry
- 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-list
- 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-list
- sourceware.org issue-tracking patch third-party-advisory
- sourceware.org