p PatchFirst

CVE-2025-4802

CVE-2025-4802

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

CVSS 7.8 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • glibc

    Versions
    • ≥ 2.27, < 2.39: Affected (custom)

    Update to 2.39

  • glibc Debian:12

    Versions
    • 2.36-9
    • 2.36-9+deb12u1
    • 2.36-9+deb12u10
    • 2.36-9+deb12u2
    • 2.36-9+deb12u3
    • 2.36-9+deb12u4
    • 2.36-9+deb12u5
    • 2.36-9+deb12u6
    • 2.36-9+deb12u7
    • 2.36-9+deb12u8
    • 2.36-9+deb12u9
    Affected ranges
    • ECOSYSTEM: < 2.36-9+deb12u11

    Update to 2.36-9+deb12u11

  • glibc Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.39-4

    Update to 2.39-4

  • glibc Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.39-4

    Update to 2.39-4

  • glibc Ubuntu:Pro:18.04:LTS

    Versions
    • 2.26-0ubuntu2
    • 2.26-0ubuntu2.1
    • 2.27-0ubuntu2
    • 2.27-0ubuntu3
    • 2.27-3ubuntu1
    • 2.27-3ubuntu1.2
    • 2.27-3ubuntu1.3
    • 2.27-3ubuntu1.4
    • 2.27-3ubuntu1.5
    • 2.27-3ubuntu1.6
    • 2.27-3ubuntu1.6+esm1
    • 2.27-3ubuntu1.6+esm2
    • 2.27-3ubuntu1.6+esm3
    • 2.27-3ubuntu1.6+esm4
    Affected ranges
    • ECOSYSTEM: < 2.27-3ubuntu1.6+esm5

    Update to 2.27-3ubuntu1.6+esm5

  • glibc Ubuntu:20.04:LTS

    Versions
    • 2.30-0ubuntu2
    • 2.30-0ubuntu3
    • 2.31-0ubuntu5
    • 2.31-0ubuntu6
    • 2.31-0ubuntu7
    • 2.31-0ubuntu9
    • 2.31-0ubuntu9.1
    • 2.31-0ubuntu9.2
    • 2.31-0ubuntu9.3
    • 2.31-0ubuntu9.7
    • 2.31-0ubuntu9.9
    • 2.31-0ubuntu9.12
    • 2.31-0ubuntu9.14
    • 2.31-0ubuntu9.15
    • 2.31-0ubuntu9.16
    • 2.31-0ubuntu9.17
    Affected ranges
    • ECOSYSTEM: < 2.31-0ubuntu9.18

    Update to 2.31-0ubuntu9.18

  • glibc Ubuntu:22.04:LTS

    Versions
    • 2.34-0ubuntu3
    • 2.35-0ubuntu1
    • 2.35-0ubuntu3
    • 2.35-0ubuntu3.1
    • 2.35-0ubuntu3.3
    • 2.35-0ubuntu3.4
    • 2.35-0ubuntu3.5
    • 2.35-0ubuntu3.6
    • 2.35-0ubuntu3.7
    • 2.35-0ubuntu3.8
    • 2.35-0ubuntu3.9
    Affected ranges
    • ECOSYSTEM: < 2.35-0ubuntu3.10

    Update to 2.35-0ubuntu3.10

Original sources

Check your server →