CVE-2023-4527
CVE-2023-4527 · Glibc: stack read overflow in getaddrinfo in no-aaaa mode
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
CVSS 6.5 · Medium · EPSS 1.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 8
- Versions
- ≥ 0:2.28-225.el8_8.6: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:2.34-60.el9_2.7: Not affected (rpm)
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
glibc Debian:12
- Versions
- 2.36-9
- 2.36-9+deb12u1
- 2.36-9+deb12u2
- Affected ranges
- ECOSYSTEM: < 2.36-9+deb12u3
Update to 2.36-9+deb12u3
glibc Debian:13
- Affected ranges
- ECOSYSTEM: < 2.37-9
Update to 2.37-9
glibc Debian:14
- Affected ranges
- ECOSYSTEM: < 2.37-9
Update to 2.37-9
Original sources
- https://access.redhat.com/errata/RHSA-2023:5453
- https://access.redhat.com/errata/RHSA-2023:5455
- https://access.redhat.com/security/cve/CVE-2023-4527
- https://bugzilla.redhat.com/show_bug.cgi?id=2234712
- http://www.openwall.com/lists/oss-security/2023/09/25/1
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/
- https://security.gentoo.org/glsa/202310-03
- https://security.netapp.com/advisory/ntap-20231116-0012/
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-4527