CVE-2017-15670: Buffer Overflow
A buffer overflow vulnerability caused by an off-by-one error was found in glibc. It is possible that an attacker might use this to escalate his privileges or execute code.
Upstream patch:
http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=2d1bd71ec70a31b01d01b734faa66bb1ed28961f
Upstream issue:
https://sourceware.org/bugzilla/showbug.cgi?id=22320
Other sources
The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15670?
CVE-2017-15670 is a vulnerability in the GNU C Library (glibc) before version 2.27 that leads to a heap-based buffer overflow.
What is the severity of CVE-2017-15670?
CVE-2017-15670 has a severity rating of 9.8, which is considered critical.
How does CVE-2017-15670 impact the GNU C Library?
CVE-2017-15670 affects the glob function in glob.c, which leads to a heap-based buffer overflow in glibc.
Which versions of glibc are affected by CVE-2017-15670?
Versions before 2.27 of the GNU C Library (glibc) are affected by CVE-2017-15670.
Is there a fix available for CVE-2017-15670?
Yes, the vulnerability can be remediated by updating glibc to version 2.27 or later.