What is the CVSS score of CVE-2015-7547?

CVE-2015-7547 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 94.0%.

Is there a public PoC exploit available for CVE-2015-7547?

Yes, a public proof-of-concept exploit is available for CVE-2015-7547. Prioritise patching immediately. EPSS: 94.0%.

Is there a patch available for CVE-2015-7547?

Yes, a patch is available for CVE-2015-7547. Update the affected software to the latest version immediately.

Debian Linux CVE-2015-7547

HIGH

Buffer Overflow (CWE-119)

2016-02-18 secalert@redhat.com

Denial Of Service RCE Buffer Overflow Debian Linux Ubuntu Linux Helion Openstack Server Migration Pack Unified Threat Management Software Linux Enterprise Debuginfo Opensuse Linux Enterprise Desktop Linux Enterprise Server Linux Enterprise Software Development Kit Suse Linux Enterprise Server Exalogic Infrastructure Big Ip Access Policy Manager Big Ip Advanced Firewall Manager Big Ip Analytics Big Ip Application Acceleration Manager Big Ip Application Security Manager Big Ip Domain Name System Big Ip Link Controller Big Ip Local Traffic Manager Big Ip Policy Enforcement Manager Fujitsu M10 Firmware Enterprise Linux Desktop Enterprise Linux Hpc Node Enterprise Linux Hpc Node Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Eus Enterprise Linux Workstation Glibc

8.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Feb 18, 2016 - 21:59 cve.org

HIGH 8.1

DescriptionCVE.org

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

AnalysisAI

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 94.0%.

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. Affected products include: Debian Debian Linux, Canonical Ubuntu Linux, Hp Helion Openstack, Hp Server Migration Pack, Sophos Unified Threat Management Software. Version information: before 2.23.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.