CVE-2015-0235
Critical
Description
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
SeverityCritical
CVSS10.0
Exploit probability100. percentile94.6%
Product
Gnu Glibc
PublishedJan 28, 2015
First seenJan 28, 2015
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- gnu glibc2.18 or later
- oracle communications_application_session_controller3.7.1 or later
- oracle communications_session_border_controller7.2.0 or later
- oracle vm_virtualbox5.1.24 or later
- apple mac_os_x10.11.1 or later
- php php5.4.38, 5.5.22, 5.6.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu glibc | 2.0 ≤ v < 2.18 | 2.18 |
| oracle communications_application_session_controller | v < 3.7.1 | 3.7.1 |
| oracle communications_eagle_application_processor | 16.0 | — |
| oracle communications_eagle_lnp_application_processor | 10.0 | — |
| oracle communications_lsms | 13.1 | — |
| oracle communications_policy_management | 9.7.3, 9.9.1, 10.4.1, 11.5, 12.1.1 | — |
| oracle communications_session_border_controller | v < 7.2.0, 7.2.0, 8.0.0 | 7.2.0 |
| oracle communications_user_data_repository | 10.0.0 ≤ v ≤ 10.0.1 | — |
| oracle communications_webrtc_session_controller | 7.0, 7.1, 7.2 | — |
| oracle exalogic_infrastructure | 1.0, 2.0 | — |
| oracle vm_virtualbox | v < 5.1.24 | 5.1.24 |
| oracle linux | 5, 7 | — |
| debian debian_linux | 7.0, 8.0 | — |
| redhat virtualization | 6.0 | — |
| apple mac_os_x | v < 10.11.1 | 10.11.1 |
| ibm pureapplication_system | 1.0.0.0, 1.1.0.0, 2.0.0.0 | — |
| ibm security_access_manager_for_enterprise_single_sign-on | 8.2 | — |
| php php | 5.4.0 ≤ v < 5.4.38, 5.5.0 ≤ v < 5.5.22, 5.6.0 ≤ v < 5.6.6 | 5.4.38, 5.5.22, 5.6.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.