CVE-2015-7547 (CNNVD-201602-348)

HIGH 有利用代码
中文标题:
GNU C Library 缓冲区错误漏洞
英文标题:
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv ...
CVSS分数: 8.1
发布时间: 2016-02-18 21:00:00
漏洞类型: 缓冲区错误
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v5
漏洞描述
中文描述:

GNU C Library（glibc，libc6）是一种按照LGPL许可协议发布的开源免费的C语言编译程序。 GNU C Library 2.23之前版本存在缓冲区错误漏洞。攻击者利用该漏洞导致系统拒绝服务（崩溃）或通过特制的DNS响应触发任意代码。

英文描述:

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

CWE类型:
CWE-119
标签:
dos linux Google Security Research remote SpeeDr00t
受影响产品
厂商 产品 版本 版本范围 平台 CPE
debian debian_linux 8.0 - - cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
canonical ubuntu_linux 12.04 - - cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 14.04 - - cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 15.10 - - cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
hp helion_openstack 1.1.1 - - cpe:2.3:a:hp:helion_openstack:1.1.1:*:*:*:*:*:*:*
hp helion_openstack 2.0.0 - - cpe:2.3:a:hp:helion_openstack:2.0.0:*:*:*:*:*:*:*
hp helion_openstack 2.1.0 - - cpe:2.3:a:hp:helion_openstack:2.1.0:*:*:*:*:*:*:*
hp server_migration_pack 7.5 - - cpe:2.3:a:hp:server_migration_pack:7.5:*:*:*:*:*:*:*
sophos unified_threat_management_software 9.319 - - cpe:2.3:a:sophos:unified_threat_management_software:9.319:*:*:*:*:*:*:*
sophos unified_threat_management_software 9.355 - - cpe:2.3:a:sophos:unified_threat_management_software:9.355:*:*:*:*:*:*:*
suse linux_enterprise_debuginfo 11.0 - - cpe:2.3:a:suse:linux_enterprise_debuginfo:11.0:sp2:*:*:*:*:*:*
opensuse opensuse 13.2 - - cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
suse linux_enterprise_desktop 11.0 - - cpe:2.3:o:suse:linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*
suse linux_enterprise_desktop 12 - - cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*
suse linux_enterprise_server 11.0 - - cpe:2.3:o:suse:linux_enterprise_server:11.0:sp2:*:*:lts:*:*:*
suse linux_enterprise_server 12 - - cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*
suse linux_enterprise_software_development_kit 11.0 - - cpe:2.3:o:suse:linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*
suse linux_enterprise_software_development_kit 12 - - cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*
suse suse_linux_enterprise_server 12 - - cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*
oracle exalogic_infrastructure 1.0 - - cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*
oracle exalogic_infrastructure 2.0 - - cpe:2.3:a:oracle:exalogic_infrastructure:2.0:*:*:*:*:*:*:*
f5 big-ip_access_policy_manager 12.0.0 - - cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*
f5 big-ip_advanced_firewall_manager 12.0.0 - - cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*
f5 big-ip_analytics 12.0.0 - - cpe:2.3:a:f5:big-ip_analytics:12.0.0:*:*:*:*:*:*:*
f5 big-ip_application_acceleration_manager 12.0.0 - - cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*
f5 big-ip_application_security_manager 12.0.0 - - cpe:2.3:a:f5:big-ip_application_security_manager:12.0.0:*:*:*:*:*:*:*
f5 big-ip_domain_name_system 12.0.0 - - cpe:2.3:a:f5:big-ip_domain_name_system:12.0.0:*:*:*:*:*:*:*
f5 big-ip_link_controller 12.0.0 - - cpe:2.3:a:f5:big-ip_link_controller:12.0.0:*:*:*:*:*:*:*
f5 big-ip_local_traffic_manager 12.0.0 - - cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*
f5 big-ip_policy_enforcement_manager 12.0.0 - - cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:*:*:*:*:*:*:*
oracle fujitsu_m10_firmware * - - cpe:2.3:o:oracle:fujitsu_m10_firmware:*:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node 7.0 - - cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node_eus 7.2 - - cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0 - - cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.2 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 7.2 - - cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 7.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
gnu glibc 2.9 - - cpe:2.3:a:gnu:glibc:2.9:*:*:*:*:*:*:*
gnu glibc 2.10 - - cpe:2.3:a:gnu:glibc:2.10:*:*:*:*:*:*:*
gnu glibc 2.10.1 - - cpe:2.3:a:gnu:glibc:2.10.1:*:*:*:*:*:*:*
gnu glibc 2.11 - - cpe:2.3:a:gnu:glibc:2.11:*:*:*:*:*:*:*
gnu glibc 2.11.1 - - cpe:2.3:a:gnu:glibc:2.11.1:*:*:*:*:*:*:*
gnu glibc 2.11.2 - - cpe:2.3:a:gnu:glibc:2.11.2:*:*:*:*:*:*:*
gnu glibc 2.11.3 - - cpe:2.3:a:gnu:glibc:2.11.3:*:*:*:*:*:*:*
gnu glibc 2.12 - - cpe:2.3:a:gnu:glibc:2.12:*:*:*:*:*:*:*
gnu glibc 2.12.1 - - cpe:2.3:a:gnu:glibc:2.12.1:*:*:*:*:*:*:*
gnu glibc 2.12.2 - - cpe:2.3:a:gnu:glibc:2.12.2:*:*:*:*:*:*:*
gnu glibc 2.13 - - cpe:2.3:a:gnu:glibc:2.13:*:*:*:*:*:*:*
gnu glibc 2.14 - - cpe:2.3:a:gnu:glibc:2.14:*:*:*:*:*:*:*
gnu glibc 2.14.1 - - cpe:2.3:a:gnu:glibc:2.14.1:*:*:*:*:*:*:*
gnu glibc 2.15 - - cpe:2.3:a:gnu:glibc:2.15:*:*:*:*:*:*:*
gnu glibc 2.16 - - cpe:2.3:a:gnu:glibc:2.16:*:*:*:*:*:*:*
gnu glibc 2.17 - - cpe:2.3:a:gnu:glibc:2.17:*:*:*:*:*:*:*
gnu glibc 2.18 - - cpe:2.3:a:gnu:glibc:2.18:*:*:*:*:*:*:*
gnu glibc 2.19 - - cpe:2.3:a:gnu:glibc:2.19:*:*:*:*:*:*:*
gnu glibc 2.20 - - cpe:2.3:a:gnu:glibc:2.20:*:*:*:*:*:*:*
gnu glibc 2.21 - - cpe:2.3:a:gnu:glibc:2.21:*:*:*:*:*:*:*
gnu glibc 2.22 - - cpe:2.3:a:gnu:glibc:2.22:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
1035020 vdb-entry
cve.org
访问
HPSBGN03582 vendor-advisory
cve.org
访问
SUSE-SU-2016:0471 vendor-advisory
cve.org
访问
RHSA-2016:0175 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
HPSBGN03551 vendor-advisory
cve.org
访问
RHSA-2016:0225 vendor-advisory
cve.org
访问
FEDORA-2016-0f9e9a34ce vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
DSA-3481 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
openSUSE-SU-2016:0510 vendor-advisory
cve.org
访问
USN-2900-1 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
RHSA-2016:0277 vendor-advisory
cve.org
访问
openSUSE-SU-2016:0511 vendor-advisory
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
SUSE-SU-2016:0470 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
HPSBGN03549 vendor-advisory
cve.org
访问
83265 vdb-entry
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
GLSA-201602-02 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
HPSBGN03547 vendor-advisory
cve.org
访问
SUSE-SU-2016:0472 vendor-advisory
cve.org
访问
40339 exploit
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
[libc-alpha] 20160216 [PATCH] CVE-2015-7547 --- glibc getaddrinfo() stack-based buffer overflow mailing-list
cve.org
访问
SUSE-SU-2016:0473 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
RHSA-2016:0176 vendor-advisory
cve.org
访问
FEDORA-2016-0480defc94 vendor-advisory
cve.org
访问
openSUSE-SU-2016:0512 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
DSA-3480 vendor-advisory
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
39454 exploit
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
VU#457759 third-party-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
HPSBGN03442 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-list
cve.org
访问
20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
20210901 SEC Consult SA-20210901-0 :: Multiple vulnerabilities in MOXA devices mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
ExploitDB EDB-39454 EXPLOIT
exploitdb
访问
Download Exploit EDB-39454 EXPLOIT
exploitdb
访问
CVE Reference: CVE-2015-7547 ADVISORY
cve.org
访问
ExploitDB EDB-40339 EXPLOIT
exploitdb
访问
Download Exploit EDB-40339 EXPLOIT
exploitdb
访问
CVSS评分详情
8.1
HIGH
CVSS向量: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS版本: 3.0
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2016-02-18 21:00:00
修改时间:
2024-08-06 07:51:28
创建时间:
2025-11-11 15:34:08
更新时间:
2025-11-11 16:40:18
利用信息
此漏洞有可利用代码！
利用代码数量: 2
利用来源:
未知 未知
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2015-7547 2025-11-11 15:19:00 2025-11-11 07:34:08
NVD nvd_CVE-2015-7547 2025-11-11 14:54:53 2025-11-11 07:42:49
CNNVD cnnvd_CNNVD-201602-348 2025-11-11 15:09:38 2025-11-11 07:52:24
EXPLOITDB exploitdb_EDB-39454 2025-11-11 15:05:24 2025-11-11 08:38:27
EXPLOITDB exploitdb_EDB-40339 2025-11-11 15:05:26 2025-11-11 08:40:18
版本与语言
当前版本: v5
主要语言: EN
支持语言:
EN ZH
其他标识符:
:
:
:
:
安全公告
暂无安全公告信息
变更历史
v5 EXPLOITDB
2025-11-11 16:40:18
references_count: 78 → 80; tags_count: 3 → 5
查看详细变更
  • references_count: 78 -> 80
  • tags_count: 3 -> 5
v4 EXPLOITDB
2025-11-11 16:38:27
references_count: 75 → 78; tags_count: 0 → 3; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
  • references_count: 75 -> 78
  • tags_count: 0 -> 3
  • data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
v3 CNNVD
2025-11-11 15:52:24
vulnerability_type: 未提取 → 缓冲区错误; cnnvd_id: 未提取 → CNNVD-201602-348; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 缓冲区错误
  • cnnvd_id: 未提取 -> CNNVD-201602-348
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:42:49
severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 8.1; cvss_vector: NOT_EXTRACTED → CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; cvss_version: NOT_EXTRACTED → 3.0; affected_products_count: 0 → 59; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
  • cvss_score: 未提取 -> 8.1
  • cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • cvss_version: NOT_EXTRACTED -> 3.0
  • affected_products_count: 0 -> 59
  • data_sources: ['cve'] -> ['cve', 'nvd']