Description
The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.15-1 | — |
| Debian 13 | glibc | 2.15-1 | — |
| Debian 12 | glibc | 2.15-1 | — |
| Debian 7 | eglibc | 2.13-38+deb7u8 | DSA-3169-1 |
| Debian 6.0 | eglibc | 2.11.3-4+deb6u5 | DLA-165-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | nscd +7 | 2.12-1.149.el6 | RHSA-2014:1391 |
| RHEL 5 | nscd +6 | 2.5-123.el5_11.3 | RHSA-2015:1627 |
Advisories 4
- RHSA-2015:1627 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:1391 Red Hat Security Advisory: glibc security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-3169-1 eglibc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-165-1 eglibc - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1186614
- [oss-security] 20150129 Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) mailing-list
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=2e96f1c7
- RHSA-2015:1627 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=981942
- https://sourceware.org/bugzilla/show_bug.cgi?id=18011
- 72710 vdb-entry