ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2023-4527

PoC —
CVSS 3.1
6.5 medium
EPSS
2%p76
Published
()
Modified
Description

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

Vendors
gnuredhatfedoraprojectnetapp
Products
glibc, codeready linux builder eus, codeready linux builder eus for power little endian, codeready linux builder eus for power little endian eus, codeready linux builder for arm64, codeready linux builder for arm64 eus, codeready linux builder for ibm z systems, codeready linux builder for ibm z systems eus, enterprise linux, enterprise linux eus, enterprise linux for arm 64, enterprise linux for arm 64 eus
Weakness
CWE-121, CWE-125
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news

No ingested article mentions this CVE yet.