CVE-2023-4806

Katalog CVE

CVSS 5.9 · Medium EPSS 1,6%

Kerentanan Use After Free pada gnu glibc, redhat codeready linux builder eus +20 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Rincian

Terbit di NVD

18 September 2023

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:5453 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2023:5455 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2023-4806 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2237782 issue tracking · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2023:7409
• http://www.openwall.com/lists/oss-security/2023/10/03/4
• http://www.openwall.com/lists/oss-security/2023/10/03/5
• http://www.openwall.com/lists/oss-security/2023/10/03/6
• http://www.openwall.com/lists/oss-security/2023/10/03/8
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3N...
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ2...
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K...
• https://security.gentoo.org/glsa/202310-03
• https://security.netapp.com/advisory/ntap-20240125-0008/
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-831302.html