Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-0235


Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."


Published

2015-01-28T19:59:00.063

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-787

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gnu glibc < 2.18 Yes
Application oracle communications_application_session_controller < 3.7.1 Yes
Application oracle communications_eagle_application_processor 16.0 Yes
Application oracle communications_eagle_lnp_application_processor 10.0 Yes
Application oracle communications_lsms 13.1 Yes
Application oracle communications_policy_management 9.7.3 Yes
Application oracle communications_policy_management 9.9.1 Yes
Application oracle communications_policy_management 10.4.1 Yes
Application oracle communications_policy_management 11.5 Yes
Application oracle communications_policy_management 12.1.1 Yes
Application oracle communications_session_border_controller < 7.2.0 Yes
Application oracle communications_session_border_controller 7.2.0 Yes
Application oracle communications_session_border_controller 8.0.0 Yes
Application oracle communications_user_data_repository ≤ 10.0.1 Yes
Application oracle communications_webrtc_session_controller 7.0 Yes
Application oracle communications_webrtc_session_controller 7.1 Yes
Application oracle communications_webrtc_session_controller 7.2 Yes
Application oracle exalogic_infrastructure 1.0 Yes
Application oracle exalogic_infrastructure 2.0 Yes
Application oracle vm_virtualbox < 5.1.24 Yes
Operating System oracle linux 5 Yes
Operating System oracle linux 7 Yes
Operating System debian debian_linux 7.0 Yes
Operating System debian debian_linux 8.0 Yes
Application redhat virtualization 6.0 Yes
Operating System apple mac_os_x < 10.11.1 Yes
Application ibm pureapplication_system 1.0.0.0 Yes
Application ibm pureapplication_system 1.1.0.0 Yes
Application ibm pureapplication_system 2.0.0.0 Yes
Application ibm security_access_manager_for_enterprise_single_sign-on 8.2 Yes
Application php php < 5.4.38 Yes
Application php php < 5.5.22 Yes
Application php php < 5.6.6 Yes

References