CVE-2022-23219: Buffer Overflow
Last updated 24 July 2024
Other sources
The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-23219?
CVE-2022-23219 is a vulnerability in the GNU C Library (glibc) that allows for a buffer overflow, potentially leading to a denial of service or arbitrary code execution.
What software versions are affected by CVE-2022-23219?
GNU glibc versions up to and including 2.34, Oracle Communications Cloud Native Core Binding Support Function 22.1.3, Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0, Oracle Communications Cloud Native Core Network Repository Function 22.1.2 and 22.2.0, VMware Spring Cloud Gateway 22.1.1, Oracle Communications Cloud Native Core Unified Data Repository 22.2.0, Oracle Enterprise Operations Monitor 4.3, 4.4, and 5.0, and Debian Debian Linux 10.0 are affected by CVE-2022-23219.
How severe is CVE-2022-23219?
CVE-2022-23219 has a severity rating of 9.8 (out of 10), indicating a critical vulnerability.
How can I fix CVE-2022-23219?
To fix CVE-2022-23219, users should update to a patched version of the GNU C Library (glibc) or apply any available security patches provided by the software vendor.
Are there any references for CVE-2022-23219?
Yes, you can find more information about CVE-2022-23219 at the following references: [1] https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html [2] https://security.gentoo.org/glsa/202208-24 [3] https://sourceware.org/bugzilla/show_bug.cgi?id=22542