Fluid Attacks Database

Description

The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	glibc	>=0 <2.25-3	2.25-3
debian 11	glibc	>=0 <2.25-3	2.25-3
debian 12	glibc	>=0 <2.25-3	2.25-3
debian 14	glibc	>=0 <2.25-3	2.25-3
rpm rhel7	glibc	<0:2.17-222.el7	0:2.17-222.el7
rpm rhel7	compat-glibc	-	-
rpm rhel6	glibc	<0:2.12-1.212.el6	0:2.12-1.212.el6

Aliases

1. CVE-2017-158042. NVD-2017-158043. OSV-DEBIAN-2017-158044. OSV-2017-158045. SECURITY-TRACKER-CVE-2017-15804

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.