CVEvulnerability
CVE-2023-4527
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-09-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- Weaknesses
- CWE-121, CWE-125
Description
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
Affected configurations
• gnu glibc (>= 2.36 < 2.36.113)
• gnu glibc (>= 2.37 < 2.37.38)
• gnu glibc (>= 2.38 < 2.38.19)
• redhat codeready linux builder eus 9.2
• redhat codeready linux builder eus for power little endian 9.0 ppc64le
• redhat codeready linux builder eus for power little endian eus 9.2 ppc64le
• redhat codeready linux builder for arm64 9.0 aarch64
• redhat codeready linux builder for arm64 eus 9.2 aarch64
• redhat codeready linux builder for ibm z systems 9.0 s390x
• redhat codeready linux builder for ibm z systems eus 9.2 s390x
• redhat enterprise linux 8.0
• redhat enterprise linux 9.0
• redhat enterprise linux eus 8.8
• redhat enterprise linux eus 9.2
• redhat enterprise linux for arm 64 9.0 aarch64
• redhat enterprise linux for arm 64 eus 9.2 aarch64
• redhat enterprise linux for ibm z systems 8.0 s390x
• redhat enterprise linux for ibm z systems eus 8.8 s390x
• redhat enterprise linux for ibm z systems eus s390x 9.2
• redhat enterprise linux for ibm z systems s390x 9.2
• redhat enterprise linux for power little endian 8.0 ppc64le
• redhat enterprise linux for power little endian 9.2 ppc64le
• redhat enterprise linux for power little endian eus 8.8 ppc64le
• redhat enterprise linux for power little endian eus 9.2 ppc64le
• redhat enterprise linux server aus 9.2
• redhat enterprise linux server for power little endian update services for sap solutions 9.2 ppc64le
• redhat enterprise linux tus 8.8
• fedoraproject fedora 37
• fedoraproject fedora 38
• fedoraproject fedora 39
• netapp h300s firmware
• netapp h500s firmware
• netapp h700s firmware
• netapp h410s firmware
• netapp h410c firmware
Related
References
- https://access.redhat.com/errata/RHSA-2023:5453 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4527 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2234712 Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/25/1 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5453 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4527 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2234712 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202310-03 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231116-0012/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html cert-portal.siemens.com