CVE-2015-5277: Buffer Overflow
It was discovered that the nssfiles backend for the Name Service Switch in glibc would return incorrect data to applications or corrupt the heap (depending on adjacent heap contents), potentially resulting in arbitrary code execution.
Other sources
The getcontents function in nssfiles/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5277?
CVE-2015-5277 has a critical severity level due to its potential to cause arbitrary code execution.
How do I fix CVE-2015-5277?
To fix CVE-2015-5277, you should update the affected glibc packages to the latest version available for your operating system.
Which systems are affected by CVE-2015-5277?
CVE-2015-5277 affects Red Hat Enterprise Linux 7.0, Ubuntu Linux versions 12.04, 14.04, and 15.10, and GNU C Library up to 2.19.
What type of vulnerability is CVE-2015-5277?
CVE-2015-5277 is a memory corruption vulnerability in the nss_files backend of glibc that can lead to arbitrary code execution.
Is there a workaround for CVE-2015-5277?
While there is no official workaround for CVE-2015-5277, applying security patches and limiting access to vulnerable applications can reduce risk.