The buffer-resizing code in addgetnetgrentX assumes that all string pointers point into the supplied buffer.

Reference: https://sourceware.org/bugzilla/showbug.cgi?id=31680

The netgroup cache uses xmalloc/xrealloc and may terminate the process due to a memory allocation failure.

Reference: https://sourceware.org/bugzilla/showbug.cgi?id=31679

Last updated 25 August 2025

It was reported that if a process that called glibc's svcrun() exceeded the limit of opened files for a longer period of time, that accept() in rendezvousrequest()/svcudprecv() would fail with the EMFILE error, which would lead to looping between poll(), accept(), and 'for' loops which would consume a lot of CPU time. This could lead to an unresponsive system that requires human intervention (service restart or system restart) to resolve.

GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LDDEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.

The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.

The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.

glibc2 does not properly clear the LDDEBUGOUTPUT and LDDEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack.