Vulnerability Details CVE-2023-4527
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 30.1%
CVSS Severity
CVSS v3 Score 6.5
References
- https://access.redhat.com/errata/RHSA-2023:5453
- https://access.redhat.com/errata/RHSA-2023:5455
- https://access.redhat.com/security/cve/CVE-2023-4527
- https://bugzilla.redhat.com/show_bug.cgi?id=2234712
- http://www.openwall.com/lists/oss-security/2023/09/25/1
- https://access.redhat.com/errata/RHSA-2023:5453
- https://access.redhat.com/errata/RHSA-2023:5455
- https://access.redhat.com/security/cve/CVE-2023-4527
- https://bugzilla.redhat.com/show_bug.cgi?id=2234712
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/
- https://security.gentoo.org/glsa/202310-03
- https://security.netapp.com/advisory/ntap-20231116-0012/
Products affected by CVE-2023-4527
-
cpe:2.3:a:gnu:glibc:2.36
-
cpe:2.3:a:gnu:glibc:2.37
-
cpe:2.3:a:gnu:glibc:2.38
-
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2
-
cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian:9.0_ppc64le
-
cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.2_ppc64le
-
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64
-
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x
-
cpe:2.3:h:netapp:h300s:-
-
cpe:2.3:h:netapp:h410c:-
-
cpe:2.3:h:netapp:h410s:-
-
cpe:2.3:h:netapp:h500s:-
-
cpe:2.3:h:netapp:h700s:-
-
cpe:2.3:o:fedoraproject:fedora:37
-
cpe:2.3:o:fedoraproject:fedora:38
-
cpe:2.3:o:fedoraproject:fedora:39
-
cpe:2.3:o:netapp:h300s_firmware:-
-
cpe:2.3:o:netapp:h410c_firmware:-
-
cpe:2.3:o:netapp:h410s_firmware:-
-
cpe:2.3:o:netapp:h500s_firmware:-
-
cpe:2.3:o:netapp:h700s_firmware:-
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux:9.0
-
cpe:2.3:o:redhat:enterprise_linux_eus:8.8
-
cpe:2.3:o:redhat:enterprise_linux_eus:9.2
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:9.2
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_s390x:9.2
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2
-
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 9.2_ppc64lecpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_tus:8.8