CVE-2016-3706

HIGH 7.5CVE-2016-3706 · Published 10/06/2016 · updated 17/06/2026

In short

CVE-2016-3706 is a HIGH (CVSS 7.5) vulnerability affecting glibc (gnu).
Chance of exploitation in the next 30 days (EPSS): 5.9%, higher than 93.3% of all vulnerabilities.
Fix: update to 2.23 or later.

Package	Affected versions	Patched versions
glibc gnu	`< 2.23`	`2.23`

Description

Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.

References

lists.opensuse.org/opensuse-updates/2016-06/msg00030.html · Mailing List
lists.opensuse.org/opensuse-updates/2016-07/msg00039.html · Mailing List
www-01.ibm.com/support/docview.wss · Third Party Advisory
securityfocus.com/bid/102073 · Third Party Advisory
securityfocus.com/bid/88440 · Third Party Advisory
source.android.com/security/bulletin/2017-12-01 · Third Party Advisory
sourceware.org/bugzilla/show_bug.cgi · Issue Tracking
sourceware.org/git/gitweb.cgi

More vulnerabilities in glibc

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

glibc

gnu

< 2.23

2.23

Description

More vulnerabilities in glibc

See all →