CVE-2015-7547

Summary:

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing “dual A/AAAA DNS queries” and the libnss_dns.so.2 NSS module.

Reference Links(if available):

http://ubuntu.com/usn/usn-2900-1

https://support.f5.com/kb/en-us/solutions/public/k/47/sol47098834.html

https://sourceware.org/bugzilla/show_bug.cgi?id=18665

https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html

https://bugzilla.redhat.com/show_bug.cgi?id=1293532

CVSS Score (if available)

v2: / MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

v3: / HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Links to Exploits(if available)

https://github.com/offensive-security/exploitdb/blob/master/exploits/linux/dos/39454.txt

https://github.com/offensive-security/exploitdb/blob/master/exploits/linux/remote/40339.py