CVE-2015-7547

Priority
High
Description
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc
functions in the libresolv library in the GNU C Library (aka glibc or
libc6) before 2.23 allow remote attackers to cause a denial of service
(crash) or possibly execute arbitrary code via a crafted DNS response that
triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6
address family, related to performing "dual A/AAAA DNS queries" and the
libnss_dns.so.2 NSS module.
References
Bugs
Notes
 jdstrand> stable-phone-overlay will be updated in OTA 9.1
 jdstrand> tyhicks alerted the Snappy team for an emergency update
Assigned-to
mdeslaur
Package
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):released (2.15-0ubuntu10.13)
Ubuntu 14.04 LTS (Trusty Tahr):released (2.19-0ubuntu6.7)
Ubuntu Touch 15.04:DNE
Ubuntu Core 15.04:DNE
Ubuntu 15.10 (Wily Werewolf):DNE
Ubuntu 16.04 (Xenial Xerus):DNE
Package
Source: glibc (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu Touch 15.04:released (2.21-0ubuntu4.0.1)
Ubuntu Core 15.04:released (2.21-0ubuntu4.0.1)
Ubuntu 15.10 (Wily Werewolf):released (2.21-0ubuntu4.1)
Ubuntu 16.04 (Xenial Xerus):released (2.21-0ubuntu6)
More Information

Updated: 2016-03-23 03:42:23 UTC (commit 10817)