Glibc vulnerabilitiesAnd the versions its exploited flaws hit.
Glibc is made by Gnu. We track 149 published vulnerabilities in it, across 183 versions. 1 of them is on the list of flaws known to be exploited, the newest added on 21 November 2023. If you run Glibc, check your version against the exploited flaws below and patch those first.
The most recent Glibc flaw added to the known-exploited list is CVE-2023-4911, on 21 November 2023. We keep watching the known-exploited list.
Which versions of Glibc do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "2.34 to before 2.39" means from 2.34 up to, but not including, 2.39. Find your version, then patch.
- CVE-2023-4911Exploited list, 21 Nov 2023
GNU C Library Buffer Overflow Vulnerability
2.34 to before 2.39
Which Glibc vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.8GNU C Library Buffer Overflow Vulnerability
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
Which Glibc flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 95%CVE-2015-0235Critical
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1)...
- 91%CVE-2015-7547High
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service...
- 64%
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable.
- 51%CVE-2010-4052Medium
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service...
- 40%CVE-2010-4051Medium
The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular...
- 18%CVE-2012-4412High
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long...
- 17%CVE-2014-5119High
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors...
- 15%CVE-2003-0028High
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote...
- 14%CVE-2011-1071Medium
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string...
- 13%CVE-2018-1000001High
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Running Glibc? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
- Matched to
- Glibc on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 149 published vulnerabilities listed under the name Glibc, across 183 versions. The most recent Glibc flaw added to the known-exploited list is CVE-2023-4911, on 21 November 2023.
1 is on the list of flaws known to be exploited. The most recently added is CVE-2023-4911.
Each flaw names its own versions, usually as ranges. The newest, CVE-2023-4911, affects 2.34 to before 2.39. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Glibc. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.