CVE-2015-7547

Priority
Description
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc
functions in the libresolv library in the GNU C Library (aka glibc or
libc6) before 2.23 allow remote attackers to cause a denial of service
(crash) or possibly execute arbitrary code via a crafted DNS response that
triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6
address family, related to performing "dual A/AAAA DNS queries" and the
libnss_dns.so.2 NSS module.
Assigned-to
mdeslaur
Notes
jdstrandstable-phone-overlay will be updated in OTA 9.1
tyhicks alerted the Snappy team for an emergency update
Package
Upstream:needs-triage
Ubuntu 14.04 ESM (Trusty Tahr):released (2.19-0ubuntu6.7)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Source: glibc (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (2.21-0ubuntu6)
More Information

Updated: 2019-12-05 18:42:56 UTC (commit dd38ff22974aae499eb50644b9d5a2817483cbdb)