CVE-2015-7547

Priority
High
Description
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc
functions in the libresolv library in the GNU C Library (aka glibc or
libc6) before 2.23 allow remote attackers to cause a denial of service
(crash) or possibly execute arbitrary code via a crafted DNS response that
triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6
address family, related to performing "dual A/AAAA DNS queries" and the
libnss_dns.so.2 NSS module.
References
Bugs
Notes
 jdstrand> stable-phone-overlay will be updated in OTA 9.1
 jdstrand> tyhicks alerted the Snappy team for an emergency update
Assigned-to
mdeslaur
Package
Upstream:needs-triage
Ubuntu 14.04 LTS (Trusty Tahr):released (2.19-0ubuntu6.7)
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Source: glibc (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu Core 15.04:released (2.21-0ubuntu4.0.1)
Ubuntu 16.04 LTS (Xenial Xerus):released (2.21-0ubuntu6)
More Information

Updated: 2017-08-11 23:53:50 UTC (commit 13081)