CVE-2015-7547observed exploitation

CVE-2015-7547

Published · Updated

Follow this CVE+ Monitor glibc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actepss 92%
from disclosure to weaponsame day
Published on NVDFeb 18
1st PoCFeb 10
VulnCheck+2007d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7
none_available: Affected
Fixed
32 products (476 components)
Red Hat Enterprise Linux Server EUS (v. 7.1) · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server EUS (v. 6.6) · Red Hat Enterprise Linux Server Optional (v. 7) · and others 27
fix ↗
Not affected
2 products — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 4 · Red Hat Enterprise Linux 5
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Affected products
n/a · n/a
public PoCs found — 29✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/39454exploitdbwww.exploit-db.com/exploits/40339unverifiedgithubgithub.com/fjserna/CVE-2015-7547★ 543githubgithub.com/eSentire/cve-2015-7547-public★ 10githubgithub.com/jgajek/cve-2015-7547★ 8githubgithub.com/cakuzo/CVE-2015-7547★ 5githubgithub.com/t0r0t0r0/CVE-2015-7547★ 1githubgithub.com/rexifiles/rex-sec-glibc★ 0githubgithub.com/bluebluelan/CVE-2015-7547-proj-master★ 0githubgithub.com/miracle03/CVE-2015-7547-master★ 0githubgithub.com/Stick-U235/CVE-2015-7547-Research★ 0githubgithub.com/Amilaperera12/Glibc-Vulnerability-Exploit-CVE-2015-7547★ 0githubgithub.com/babykillerblack/CVE-2015-7547★ 0vulncheckvulncheck.com/xdb/1dc3a463272eunverifiedvulncheckvulncheck.com/xdb/356972add841unverifiedvulncheckvulncheck.com/xdb/bb7c175544abunverifiedvulncheckvulncheck.com/xdb/5802082611f4unverifiedcve_referencepacketstormsecurity.com/files/135802/glibc-getaddrinfo-Stack-Based-Buffer-Overflow.htmlunverifiedcve_referencepacketstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.htmlunverifiedcve_referencepacketstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.htmlunverifiedcve_referencewww.exploit-db.com/exploits/39454/unverifiedcve_referencewww.exploit-db.com/exploits/40339/unverifiedcve_referencepacketstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlunverifiedvulncheckvulncheck.com/xdb/048e7854f0caunverifiedvulncheckvulncheck.com/xdb/9aca57789b8bunverifiedvulncheckvulncheck.com/xdb/b99728f6c6e2unverifiedvulncheckvulncheck.com/xdb/e789fb086b1funverifiedvulncheckvulncheck.com/xdb/a972b421d0c1unverifiedvulncheckvulncheck.com/xdb/6ca51ee2343eunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.