CVE-2015-8778: Buffer Overflow
An integer overflow vulnerability was found in hcreate and hcreater which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution.
Upstream bug:
https://sourceware.org/bugzilla/showbug.cgi?id=18240
CVE assignment:
http://seclists.org/oss-sec/2016/q1/153
Other sources
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the hcreater function, which triggers out-of-bounds heap-memory access.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8778?
CVE-2015-8778 has a moderate severity level due to the potential for denial of service or arbitrary code execution.
How do I fix CVE-2015-8778?
To fix CVE-2015-8778, upgrade the GNU C Library to version 2.23 or later.
What systems are affected by CVE-2015-8778?
CVE-2015-8778 affects various systems using GNU C Library versions below 2.23, including certain versions of Red Hat, Fedora, Debian, and Ubuntu.
Can CVE-2015-8778 lead to data compromise?
While CVE-2015-8778 primarily causes application crashes, it may also allow attackers to execute arbitrary code, leading to potential data compromise.
Is CVE-2015-8778 still relevant for current systems?
CVE-2015-8778 is less of a concern for current systems as most have been updated to versions beyond the vulnerable 2.22.