REDHAT-BUG-1186614: Medium severity GNU glibc vulnerability

Published Jan 28, 2015

Updated

An Invalid-free() flaw was found in the getaddrinfo() syscall of glibc. The bug only materializes if the getaddrinfo functions is called with the AIIDN flag, and if glibc has been compiled with libidn support.

This flaw was fixed in glibc-2.15 via the following commit:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=2e96f1c7

Affected Software

1 affected component

GNU glibc>2.15

Event History

Jan 28, 2015

Data Sourced

06:50 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1186614?

The severity of REDHAT-BUG-1186614 is rated as high due to the potential for denial of service.

How do I fix REDHAT-BUG-1186614?

To fix REDHAT-BUG-1186614, update glibc to version 2.15 or later where the flaw is resolved.

What versions of glibc are affected by REDHAT-BUG-1186614?

Glibc versions prior to 2.15 are affected by REDHAT-BUG-1186614.

What is the exploitability of REDHAT-BUG-1186614?

REDHAT-BUG-1186614 can be exploited when the getaddrinfo() function is called with the AI_IDN flag.

Is REDHAT-BUG-1186614 related to any specific libraries?

Yes, REDHAT-BUG-1186614 is specifically related to the GNU C Library (glibc) when compiled with libidn support.