CVE-2013-7424: Medium severity GNU glibc vulnerability
An Invalid-free() flaw was found in the getaddrinfo() syscall of glibc. The bug only materializes if the getaddrinfo functions is called with the AIIDN flag, and if glibc has been compiled with libidn support.
This flaw was fixed in glibc-2.15 via the following commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=2e96f1c7
Other sources
The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AIIDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7424?
CVE-2013-7424 has been classified with a severity rating of medium.
How do I fix CVE-2013-7424?
To fix CVE-2013-7424, upgrade glibc to version 2.15 or later.
What systems are affected by CVE-2013-7424?
CVE-2013-7424 affects systems using glibc versions up to and including 2.14.1 with libidn support.
What is the nature of the vulnerability in CVE-2013-7424?
CVE-2013-7424 is an Invalid-free() flaw in the getaddrinfo() syscall.
Is there a workaround for CVE-2013-7424?
There are no specific workarounds for CVE-2013-7424 other than upgrading glibc.