CVE-2023-4813Medium· 5.9▾ TwilightPoC availableA flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the h…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.9%
1 GitHub repo (last check)
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.
glibc < 2.36enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux_eus = 8.8enterprise_linux_eus = 9.2enterprise_linux_for_ibm_z_systems_eus_s390x = 9.2enterprise_linux_for_ibm_z_systems_s390x = 9.2enterprise_linux_for_power_little_endian = 9.2_ppc64leenterprise_linux_for_power_little_endian_eus = 9.2_ppc64leenterprise_linux_server_aus = 9.2enterprise_linux_server_tus = 8.8fedora = 38active_iq_unified_managerh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareh410c_firmwareUpgrade past the affected range:
glibc 2.36Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4806Medium· 5.9A flaw has been identified in glibc
CVE-2023-4911High· 7.8A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable
CVE-2023-4527Medium· 6.5Glibc: stack read overflow in getaddrinfo in no-aaaa mode
CVE-2023-5156High· 7.5A flaw was found in the GNU C Library
CVE-2021-33574Critical· 9.8The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free
CVE-2020-1752High· 7.0A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out