Search for vulnerabilities
Vulnerability details: VCID-jauw-zxrf-aaae
Vulnerability ID VCID-jauw-zxrf-aaae
Aliases CVE-2017-15671
Summary The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-772 Missing Release of Resource after Effective Lifetime
CWE-400 Uncontrolled Resource Consumption
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15671.html
cvssv3 3.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15671.json
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00367 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00367 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00367 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.00405 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
epss 0.01378 https://api.first.org/data/v1/epss?cve=CVE-2017-15671
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=1504806
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15671
cvssv2 2.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2017-15671
cvssv3 5.9 https://nvd.nist.gov/vuln/detail/CVE-2017-15671
archlinux High https://security.archlinux.org/AVG-460
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15671.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15671.json
https://api.first.org/data/v1/epss?cve=CVE-2017-15671
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15671
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://sourceware.org/bugzilla/show_bug.cgi?id=22325
http://www.securityfocus.com/bid/101517
1504806 https://bugzilla.redhat.com/show_bug.cgi?id=1504806
879500 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=879500
ASA-201801-8 https://security.archlinux.org/ASA-201801-8
ASA-201801-9 https://security.archlinux.org/ASA-201801-9
AVG-460 https://security.archlinux.org/AVG-460
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
CVE-2017-15671 https://nvd.nist.gov/vuln/detail/CVE-2017-15671
GLSA-201804-02 https://security.gentoo.org/glsa/201804-02
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15671.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15671
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15671
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.41882
EPSS Score 0.00098
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.