CVE-2023-4911High· 7.8▾ Abyssal⚠ Exploited in the wildPoC availableA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variable…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 12.8 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Dec 12, 2023
Last analysed / modified upstream
64%
Exploit-DB · 21 GitHub repos · Metasploit ×1 (last check)
Added to the CISA catalog on Nov 21, 2023. Federal remediation due Dec 12, 2023. View catalog ↗
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
bootstrap_ossimatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware >= 3.1.5siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5simatic_s7-1500_tm_mfp_firmware < 1.1glibc >= 2.34, < 2.39fedora = 37fedora = 38fedora = 39codeready_linux_builder = 9.0codeready_linux_builder_eus = 8.6codeready_linux_builder_eus = 9.2codeready_linux_builder_eus = 9.4codeready_linux_builder_eus = 9.6codeready_linux_builder_for_arm64 = 9.0_aarch64codeready_linux_builder_for_arm64_eus = 8.6codeready_linux_builder_for_arm64_eus = 9.2_aarch64codeready_linux_builder_for_arm64_eus = 9.4_aarch64codeready_linux_builder_for_arm64_eus = 9.6_aarch64codeready_linux_builder_for_ibm_z_systems = 9.0_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 8.6codeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 9.4_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 9.6_s390xcodeready_linux_builder_for_power_little_endian = 9.0_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 8.6codeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 9.4_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 9.6_ppc64levirtualization = 4.0virtualization_host = 4.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux_eus = 8.6enterprise_linux_eus = 9.2enterprise_linux_eus = 9.4enterprise_linux_eus = 9.6enterprise_linux_for_arm_64 = 9.0_aarch64enterprise_linux_for_arm_64_eus = 8.6_aarch64enterprise_linux_for_arm_64_eus = 9.2_aarch64enterprise_linux_for_arm_64_eus = 9.4_aarch64enterprise_linux_for_arm_64_eus = 9.6_aarch64enterprise_linux_for_ibm_z_systems = 9.0_s390xenterprise_linux_for_ibm_z_systems_eus = 9.2_s390xenterprise_linux_for_ibm_z_systems_eus = 9.4_s390xenterprise_linux_for_ibm_z_systems_eus = 9.6_s390xenterprise_linux_for_ibm_z_systems_eus_s390x = 8.6enterprise_linux_for_power_big_endian_eus = 8.6_ppc64leenterprise_linux_for_power_little_endian = 9.0_ppc64leenterprise_linux_for_power_little_endian_eus = 9.2_ppc64leenterprise_linux_for_power_little_endian_eus = 9.4_ppc64leenterprise_linux_for_power_little_endian_eus = 9.6_ppc64leenterprise_linux_server_aus = 8.6enterprise_linux_server_aus = 9.2enterprise_linux_server_aus = 9.4enterprise_linux_server_aus = 9.6enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64leenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64leenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64leenterprise_linux_server_tus = 8.6enterprise_linux_update_services_for_sap_solutions = 9.2enterprise_linux_update_services_for_sap_solutions = 9.4enterprise_linux_update_services_for_sap_solutions = 9.6ubuntu_linux = 22.04ubuntu_linux = 23.04debian_linux = 11.0debian_linux = 12.0h410c_firmwareh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareontap_select_deploy_administration_utilityUpgrade past the affected range:
simatic_s7-1500_tm_mfp_firmware 1.1glibc 2.39Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4813Medium· 5.9A flaw has been identified in glibc
CVE-2023-4806Medium· 5.9A flaw has been identified in glibc
CVE-2024-0684Medium· 5.5A flaw was found in the GNU coreutils "split" program
CVE-2023-25139Critical· 9.8sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size
CVE-2020-10029Medium· 5.5The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 …
CVE-2026-19499High· 7.7Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path tha…