CVE-2015-0235 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related...
HighCVSS 10.0
EPSS 94.6%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glibc(Debian:12) | < 2.18-1 | 2.18-1 |
| debian/glibc(Debian:13) | < 2.18-1 | 2.18-1 |
| debian/glibc(Debian:14) | < 2.18-1 | 2.18-1 |
| GNU glibc | >= 2.0, < 2.18 | 2.18 |
| oracle communications application session controller | < 3.7.1 | 3.7.1 |
| oracle communications eagle application processor | = 16.0 | No fix listed |
| oracle communications eagle lnp application processor | = 10.0 | No fix listed |
| oracle communications lsms | = 13.1 | No fix listed |
| oracle communications policy management | = 9.7.3 | No fix listed |
| oracle communications policy management | = 9.9.1 | No fix listed |
| oracle communications policy management | = 10.4.1 | No fix listed |
| oracle communications policy management | = 11.5 | No fix listed |
| oracle communications policy management | = 12.1.1 | No fix listed |
| oracle communications session border controller | < 7.2.0 | 7.2.0 |
| oracle communications session border controller | = 7.2.0 | No fix listed |
| oracle communications session border controller | = 8.0.0 | No fix listed |
| oracle communications user data repository | >= 10.0.0, <= 10.0.1 | No fix listed |
| oracle communications webrtc session controller | = 7.0 | No fix listed |
| oracle communications webrtc session controller | = 7.1 | No fix listed |
| oracle communications webrtc session controller | = 7.2 | No fix listed |
| oracle exalogic infrastructure | = 1.0 | No fix listed |
| oracle exalogic infrastructure | = 2.0 | No fix listed |
| oracle vm virtualbox | < 5.1.24 | 5.1.24 |
| oracle linux | = 5 | No fix listed |
| oracle linux | = 7-0 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| redhat virtualization | = 6.0 | No fix listed |
| apple mac os x | < 10.11.1 | 10.11.1 |
| ibm pureapplication system | = 1.0.0.0 | No fix listed |
| ibm pureapplication system | = 1.1.0.0 | No fix listed |
| ibm pureapplication system | = 2.0.0.0 | No fix listed |
| ibm security access manager for enterprise single sign-on | = 8.2 | No fix listed |
| PHP | >= 5.4.0, < 5.4.38 | 5.4.38 |
| PHP | >= 5.5.0, < 5.5.22 | 5.5.22 |
| PHP | >= 5.6.0, < 5.6.6 | 5.6.6 |
References
- PHP 5.6.6 is available vendor-advisory
- Debian Security Tracker CVE-2015-0235 vendor-advisory
- blogs.sophos.com third-party-advisory
- linux.oracle.com third-party-advisory
- linux.oracle.com third-party-advisory
- APPLE-SA-2015-06-30-2 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2015-10-21-4 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2015-09-30-3 mailing-list third-party-advisory vendor-advisory
- HPSBGN03247 issue-tracking mailing-list third-party-advisory vendor-advisory
- HPSBHF03289 issue-tracking mailing-list third-party-advisory vendor-advisory
- HPSBGN03285 issue-tracking mailing-list third-party-advisory vendor-advisory
- HPSBGN03270 issue-tracking mailing-list third-party-advisory vendor-advisory
- HPSBMU03330 issue-tracking mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- RHSA-2015:0126 third-party-advisory vendor-advisory
- 20150128 Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow mailing-list third-party-advisory
- 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series exploit mailing-list third-party-advisory
- 20210901 SEC Consult SA-20210901-0 :: Multiple vulnerabilities in MOXA devices exploit mailing-list third-party-advisory
- 20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series exploit mailing-list third-party-advisory
- 20150127 GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) mailing-list third-party-advisory
- 20150127 Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow exploit mailing-list third-party-advisory
- 62517 not-applicable third-party-advisory
- 62640 not-applicable third-party-advisory
- 62667 not-applicable third-party-advisory
- 62680 not-applicable third-party-advisory
- 62681 not-applicable third-party-advisory
- 62688 not-applicable third-party-advisory
- 62690 not-applicable third-party-advisory
- 62691 not-applicable third-party-advisory
- 62692 not-applicable third-party-advisory
- 62698 not-applicable third-party-advisory
- 62715 not-applicable third-party-advisory
- 62758 not-applicable third-party-advisory
- 62812 not-applicable third-party-advisory
- 62813 not-applicable third-party-advisory
- 62816 not-applicable third-party-advisory
- 62865 not-applicable third-party-advisory
- 62870 not-applicable third-party-advisory
- 62871 not-applicable third-party-advisory
- 62879 not-applicable third-party-advisory
- 62883 not-applicable third-party-advisory
- support.apple.com third-party-advisory
- 20150128 GNU glibc gethostbyname Function Buffer Overflow Vulnerability third-party-advisory vendor-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- DSA-3142 third-party-advisory vendor-advisory
- www.idirect.net broken-link url-repurposed
- MDVSA-2015:039 third-party-advisory vendor-advisory
- [oss-security] 20210504 21Nails: Multiple vulnerabilities in Exim exploit mailing-list
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 20150311 OpenSSL v1.0.2 for Linux affected by CVE-2015-0235 exploit mailing-list third-party-advisory vdb-entry
- 72325 third-party-advisory vdb-entry
- 91787 third-party-advisory vdb-entry
- 1032909 third-party-advisory vdb-entry
- www.websense.com broken-link permissions-required
- bto.bluecoat.com third-party-advisory
- cert-portal.siemens.com third-party-advisory
- community.qualys.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- help.ecostruxureit.com third-party-advisory
- kb.juniper.net third-party-advisory
- kc.mcafee.com third-party-advisory
- 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series exploit mailing-list third-party-advisory
- GLSA-201503-04 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- www.arista.com third-party-advisory
- www.f-secure.com third-party-advisory
- www.qualys.com third-party-advisory
- www.sophos.com third-party-advisory