CVE-2015-8776

Sažetak

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.

Reference

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html
http://rhn.redhat.com/errata/RHSA-2017-0680.html
http://www.debian.org/security/2016/dsa-3480
http://www.debian.org/security/2016/dsa-3481
http://www.openwall.com/lists/oss-security/2016/01/19/11
http://www.openwall.com/lists/oss-security/2016/01/20/1
http://www.securityfocus.com/bid/83277
http://www.ubuntu.com/usn/USN-2985-1
http://www.ubuntu.com/usn/USN-2985-2
https://access.redhat.com/errata/RHSA-2017:1916
https://security.gentoo.org/glsa/201602-02
https://security.gentoo.org/glsa/201702-11
https://sourceware.org/bugzilla/show_bug.cgi?id=18985
https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html

CVSS

Base:	6.4
Impact:	4.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:P

Zadnje važnije ažuriranje

30-10-2018 - 16:27

Objavljeno

19-04-2016 - 21:59