Summary
It was discovered that musl did not properly handle kernel syscalls. An
attacker could use this vulnerability to cause a denial of service (crash)
or possibly execute arbitrary code. (CVE-2018-1000001)
It was discovered that musl did not properly handle the parsing of DNS
response codes. A remote attacker could use this vulnerability to cause
resource consumption (infinite loop), denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 14.04 ESM.
(CVE-2014-3484)
It was discovered that musl did not properly handle the parsing of DNS
response codes. A remote attacker could use this vulnerability to cause
resource consumption (infinite loop), denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
(CVE-2017-15650)
It was discovered that musl did not properly handle the parsing of ipv6
addresses. An attacker could use this vulnerability to cause a denial of
service (crash) or possibly execute arbitrary code. This issue only affected
Ubuntu 14.04 ESM. (CVE-2015-1817)
It was discovered that TRE library, used by musl, did not properly handle
certain inputs. An attacker could use this vulnerability to cause a denial of
service (crash). (CVE-2016-8859)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | musl | 0.9.15-1ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | musl | 1.1.9-1ubuntu0.1~esm2 |
Vulnerabilities 5
-
Unscored —
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2…
-
Unscored —
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1…
-
Unscored —
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large numb…
-
Unscored —
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name…
-
Unscored —
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before t…