GNU C Library Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 21/11/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| glibc | ≥ 2.34, < 2.39 | 2.39 |
| codeready linux builder | = 9.0 | |
| codeready linux builder eus | = 8.6= 9.2= 9.4= 9.6 | |
| codeready linux builder for arm64 | = 9.0_aarch64 | |
| codeready linux builder for arm64 eus | = 8.6= 9.2_aarch64= 9.4_aarch64= 9.6_aarch64 | |
| codeready linux builder for ibm z systems | = 9.0_s390x | |
| codeready linux builder for ibm z systems eus | = 8.6= 9.2_s390x= 9.4_s390x= 9.6_s390x | |
| codeready linux builder for power little endian | = 9.0_ppc64le | |
| codeready linux builder for power little endian eus | = 8.6= 9.2_ppc64le= 9.4_ppc64le= 9.6_ppc64le | |
| virtualization | = 4.0 | |
| virtualization host | = 4.0 |
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free