Description
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.18-1 | — |
| Debian 13 | glibc | 2.18-1 | — |
| Debian 12 | glibc | 2.18-1 | — |
| Debian 7 | eglibc | 2.13-38+deb7u7 | DSA-3142-1 |
| Debian 6.0 | eglibc | 2.11.3-4+deb6u4 | DLA-139-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | nscd +7 | 2.17-55.el7_0.5 | RHSA-2015:0092 |
| RHEL 6 | nscd +7 | 2.12-1.149.el6_6.5 | RHSA-2015:0092 |
| RHEL 6 | rhev-hypervisor6 | 6.6-20150123.1.el6ev | RHSA-2015:0126 |
| RHEL 5 | nscd +6 | 2.5-123.el5_11.1 | RHSA-2015:0090 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | nscd +7 | 2.12-1.47.el6_2.15 | RHSA-2015:0099 |
| Red Hat Rhel Mission Critical 5 | nscd +6 | 2.5-58.el5_6.6 | RHSA-2015:0099 |
| RHEL 6.5 EUS | nscd +7 | 2.12-1.132.el6_5.5 | RHSA-2015:0099 |
| RHEL 6.4 EUS | nscd +7 | 2.12-1.107.el6_4.7 | RHSA-2015:0099 |
| RHEL 5.9 EUS | nscd +6 | 2.5-107.el5_9.8 | RHSA-2015:0099 |
| RHEL 4 ELS | nscd +8 | 2.3.4-2.57.el4.2 | RHSA-2015:0101 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | nscd +6 | 2.17-55.0.4.el7_0.5 | ELSA-2015-0092 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Exim GHOST (glibc gethostbyname) Buffer Overflow
exploit/linux/smtp/exim_gethostbyname_bof
-
WordPress XMLRPC GHOST Vulnerability Scanner
auxiliary/scanner/http/wordpress_ghost_scanner
Exploit-DB 2
- Exim - 'GHOST' glibc gethostbyname Buffer Overflow (Metasploit) EDB-36421 · remote · Mar 18, 2015 · verified
- Exim ESMTP 4.80 - glibc gethostbyname Denial of Service EDB-35951 · dos · Jan 29, 2015
GitHub 16 repositories · most starred shown
-
aaronfay/CVE-2015-0235-test ★ 15 · Jan 27, 2015
Ansible playbook to check vulnerability for CVE-2015-0235
-
makelinux/CVE-2015-0235-workaround ★ 6 · Feb 2, 2015
A shared library wrapper with additional checks for vulnerable functions gethostbyname2_r gethostbyname_r (GHOST vulnerability)
-
fser/ghost-checker ★ 6 · Jan 27, 2015
Test wether you're exposed to ghost (CVE-2015-0235). All kudos go to Qualys Security
-
arm13/ghost_exploit ★ 4 · Mar 28, 2015
CVE-2015-0235 EXIM ESTMP GHOST Glibc Gethostbyname() DoS Exploit/PoC
-
mikesplain/CVE-2015-0235-cookbook ★ 3 · Jan 27, 2015
A chef cookbook to test the GHOST vulnerability
-
nickanderson/cfengine-CVE_2015_0235 ★ 1 · Jan 29, 2015
gethostbyname*() buffer overflow exploit in glibc - CVE-2015-0235 https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability
-
furyutei/CVE-2015-0235_GHOST ★ 1 · Jan 28, 2015
-
adherzog/ansible-CVE-2015-0235-GHOST ★ 1 · Jan 28, 2015
Ansible playbook, to check for CVE-2015-0235 (GHOST) vulnerability
-
koudaiii-archives/cookbook-update-glibc ★ 0 · Jan 29, 2015
cookbook for update glibc. CVE-2015-0235(GHOST)
-
favoretti/lenny-libc6 ★ 0 · Jan 28, 2015
CVE-2015-0235 patches lenny libc6 packages for amd64
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 15
- RHSA-2015:0126 Red Hat Security Advisory: rhev-hypervisor6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:0101 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:0092 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:0099 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:0090 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- DSA-3142-1 eglibc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-139-1 eglibc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-15-064-01A Siemens SIMATIC HMI Basic, SINUMERIK, and Ruggedcom APE GHOST Vulnerability (Update A) CISA ICS & IT advisories · Jun 6, 2025
- ICSA-15-064-01 Siemens SIMATIC HMI Basic, SINUMERIK, and Ruggedcom APE GHOST Vulnerability CISA ICS & IT advisories · Jun 6, 2025
- WID-SEC-2023-0975 GNU libc: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Apr 16, 2023
- VDE-2019-013 WAGO: Multiple Vulnerabilities in industrial managed switches CERT@VDE · Jun 12, 2019
- ELSA-2015-0092 Critical: glibc security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 27, 2015
References
- 72325 vdb-entry
- HPSBGN03247 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21696131
- 62883 third-party-advisory
- 62691 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- APPLE-SA-2015-10-21-4 vendor-advisory
- http://packetstormsecurity.com/files/130974/Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.html
- https://support.apple.com/HT205375
- HPSBGN03285 vendor-advisory
- 20150127 GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) mailing-list
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- 62698 third-party-advisory
- 62640 third-party-advisory
- 1032909 vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- https://bto.bluecoat.com/security-advisory/sa90
- http://www-01.ibm.com/support/docview.wss?uid=swg21696618
- http://www-01.ibm.com/support/docview.wss?uid=swg21696600
- http://www.idirect.net/Partners/~/media/Files/CVE/iDirect-Posted-Common-Vulnerabilities-and-Exposures.pdf
- APPLE-SA-2015-09-30-3 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- https://www.sophos.com/en-us/support/knowledgebase/121879.aspx
- 62688 third-party-advisory
- 62865 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21696243
- HPSBHF03289 vendor-advisory
- APPLE-SA-2015-06-30-2 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10100
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- 62812 third-party-advisory
- 62879 third-party-advisory
- HPSBGN03270 vendor-advisory
- http://linux.oracle.com/errata/ELSA-2015-0090.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- 62871 third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- 62690 third-party-advisory
- 62692 third-party-advisory
- https://support.apple.com/HT205267
- https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
- 62681 third-party-advisory
- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10671
- http://www-01.ibm.com/support/docview.wss?uid=swg21696526
- 62667 third-party-advisory
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04874668
- MDVSA-2015:039 vendor-advisory
- https://www.f-secure.com/en/web/labs_global/fsc-2015-1
- http://www-01.ibm.com/support/docview.wss?uid=swg21696602
- 62517 third-party-advisory
- http://support.apple.com/kb/HT204942
- http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/
- http://www-01.ibm.com/support/docview.wss?uid=swg21695695
- 62680 third-party-advisory
- 62813 third-party-advisory
- http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html
- GLSA-201503-04 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- 20150128 GNU glibc gethostbyname Function Buffer Overflow Vulnerability vendor-advisory