Skip to content
Fencer Intel
critical 10.0

CVE-2015-0235 in the critical feed json

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-depe…

published 11y ago modified 4mo ago also EUVD-2015-0257

cvss
10.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
94.6%
EPSS 94.6% chance of exploitation in 30 days, percentile 99.8%
public exploits
4
Metasploit and Exploit-DB

Summary

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Patch / fix

  • gnu glibc 2.18
  • oracle communications_application_session_controller 3.7.1
  • oracle communications_session_border_controller 7.2.0
  • oracle vm_virtualbox 5.1.24
  • php php 5.4.38, 5.5.22, 5.6.6
  • apple mac_os_x 10.11.1
  • glibc Debian 14, Debian 13, Debian 12 2.18-1

debian advisories DEBIAN-CVE-2015-0235

  • glibc RHEL 5 2.5-123.el5_11.1
  • nscd RHEL 5 2.5-123.el5_11.1
  • glibc-utils RHEL 5 2.5-123.el5_11.1
  • glibc-common RHEL 5 2.5-123.el5_11.1
  • glibc-debuginfo-common RHEL 5 2.5-123.el5_11.1
  • rhev-hypervisor6 RHEL 6 6.6-20150123.1.el6ev
  • glibc RHEL 6 2.12-1.149.el6_6.5
  • glibc RHEL 7 2.17-55.el7_0.5

red hat advisories RHSA-2015:0101RHSA-2015:0099RHSA-2015:0090RHSA-2015:0126RHSA-2015:0092

  • php7 openSUSE Tumbleweed 7.0.14-1.4
  • php5 openSUSE Tumbleweed 5.6.28-1.1
  • php8 openSUSE Tumbleweed 8.0.11-1.1

opensuse advisories openSUSE-SU-2024:10290-1openSUSE-SU-2024:10344-1openSUSE-SU-2024:11169-1

Is CVE-2015-0235 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-0235 updated cvss 6.8

glibc: __nss_hostname_digits_dots() heap-based buffer overflow

  • Red Hat Enterprise Linux (v. 5 server) nscd 2.5-123.el5_11.1, glibc 2.5-123.el5_11.1, glibc-utils 2.5-123.el5_11.1, glibc-common 2.5-123.el5_11.1, glibc-debuginfo-common 2.5-123.el5_11.1
    fixed: vendor fix RHSA-2015:0090
  • Red Hat Enterprise Linux AS (v. 4 ELS) nscd 2.3.4-2.57.el4.2, glibc 2.3.4-2.57.el4.2, glibc-utils 2.3.4-2.57.el4.2, glibc-common 2.3.4-2.57.el4.2, glibc-profile 2.3.4-2.57.el4.2, glibc-debuginfo-common 2.3.4-2.57.el4.2
    fixed: vendor fix RHSA-2015:0101
  • Red Hat Enterprise Linux Client (v. 7) nscd 2.17-55.el7_0.5, glibc 2.17-55.el7_0.5, glibc-utils 2.17-55.el7_0.5, glibc-common 2.17-55.el7_0.5, glibc-debuginfo-common 2.17-55.el7_0.5 Red Hat Enterprise Linux Client Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) glibc 2.12-1.107.el6_4.7, glibc-debuginfo-common 2.12-1.107.el6_4.7 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5) glibc 2.12-1.132.el6_5.5, glibc-debuginfo-common 2.12-1.132.el6_5.5
    fixed: vendor fix RHSA-2015:0099
  • Red Hat Enterprise Linux ComputeNode (v. 7) nscd 2.17-55.el7_0.5, glibc 2.17-55.el7_0.5, glibc-utils 2.17-55.el7_0.5, glibc-common 2.17-55.el7_0.5, glibc-debuginfo-common 2.17-55.el7_0.5 Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux Desktop (v. 5 client) nscd 2.5-123.el5_11.1, glibc 2.5-123.el5_11.1, glibc-utils 2.5-123.el5_11.1, glibc-common 2.5-123.el5_11.1, glibc-debuginfo-common 2.5-123.el5_11.1
    fixed: vendor fix RHSA-2015:0090
  • Red Hat Enterprise Linux Desktop (v. 6) nscd 2.12-1.149.el6_6.5, glibc 2.12-1.149.el6_6.5, glibc-utils 2.12-1.149.el6_6.5, glibc-common 2.12-1.149.el6_6.5, glibc-debuginfo-common 2.12-1.149.el6_6.5 Red Hat Enterprise Linux Desktop Optional (v. 6) glibc-debuginfo-common 2.12-1.149.el6_6.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux ES (v. 4 ELS) nscd 2.3.4-2.57.el4.2, glibc 2.3.4-2.57.el4.2, glibc-utils 2.3.4-2.57.el4.2, glibc-common 2.3.4-2.57.el4.2, glibc-profile 2.3.4-2.57.el4.2, glibc-debuginfo-common 2.3.4-2.57.el4.2
    fixed: vendor fix RHSA-2015:0101
show 11 more
  • Red Hat Enterprise Linux EUS (v. 5.9 server) nscd 2.5-107.el5_9.8, glibc 2.5-107.el5_9.8, glibc-utils 2.5-107.el5_9.8, glibc-common 2.5-107.el5_9.8, glibc-debuginfo-common 2.5-107.el5_9.8
    fixed: vendor fix RHSA-2015:0099
  • Red Hat Enterprise Linux HPC Node (v. 6) nscd 2.12-1.149.el6_6.5, glibc 2.12-1.149.el6_6.5, glibc-utils 2.12-1.149.el6_6.5, glibc-common 2.12-1.149.el6_6.5, glibc-debuginfo-common 2.12-1.149.el6_6.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux HPC Node EUS (v. 6.4) nscd 2.12-1.107.el6_4.7, glibc 2.12-1.107.el6_4.7, glibc-utils 2.12-1.107.el6_4.7, glibc-common 2.12-1.107.el6_4.7, glibc-debuginfo-common 2.12-1.107.el6_4.7 Red Hat Enterprise Linux HPC Node EUS (v. 6.5) nscd 2.12-1.132.el6_5.5, glibc 2.12-1.132.el6_5.5, glibc-utils 2.12-1.132.el6_5.5, glibc-common 2.12-1.132.el6_5.5, glibc-debuginfo-common 2.12-1.132.el6_5.5
    fixed: vendor fix RHSA-2015:0099
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) glibc-debuginfo-common 2.12-1.149.el6_6.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux Long Life (v. 5.6 server) nscd 2.5-58.el5_6.6, glibc 2.5-58.el5_6.6, glibc-utils 2.5-58.el5_6.6, glibc-common 2.5-58.el5_6.6, glibc-debuginfo-common 2.5-58.el5_6.6
    fixed: vendor fix RHSA-2015:0099
  • Red Hat Enterprise Linux Server (v. 6) nscd 2.12-1.149.el6_6.5, glibc 2.12-1.149.el6_6.5, glibc-utils 2.12-1.149.el6_6.5, glibc-common 2.12-1.149.el6_6.5, glibc-debuginfo-common 2.12-1.149.el6_6.5 Red Hat Enterprise Linux Server (v. 7) nscd 2.17-55.el7_0.5, glibc 2.17-55.el7_0.5, glibc-utils 2.17-55.el7_0.5, glibc-common 2.17-55.el7_0.5, glibc-debuginfo-common 2.17-55.el7_0.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux Server AUS (v. 6.2) nscd 2.12-1.47.el6_2.15, glibc 2.12-1.47.el6_2.15, glibc-utils 2.12-1.47.el6_2.15, glibc-common 2.12-1.47.el6_2.15, glibc-debuginfo-common 2.12-1.47.el6_2.15 Red Hat Enterprise Linux Server EUS (v. 6.4) nscd 2.12-1.107.el6_4.7, glibc 2.12-1.107.el6_4.7, glibc-utils 2.12-1.107.el6_4.7, glibc-common 2.12-1.107.el6_4.7, glibc-debuginfo-common 2.12-1.107.el6_4.7 Red Hat Enterprise Linux Server EUS (v. 6.5) nscd 2.12-1.132.el6_5.5, glibc 2.12-1.132.el6_5.5, glibc-utils 2.12-1.132.el6_5.5, glibc-common 2.12-1.132.el6_5.5, glibc-debuginfo-common 2.12-1.132.el6_5.5
    fixed: vendor fix RHSA-2015:0099
  • Red Hat Enterprise Linux Server Optional (v. 6) glibc-debuginfo-common 2.12-1.149.el6_6.5 Red Hat Enterprise Linux Server Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.2) glibc 2.12-1.47.el6_2.15, glibc-debuginfo-common 2.12-1.47.el6_2.15 Red Hat Enterprise Linux Server Optional EUS (v. 6.4) glibc 2.12-1.107.el6_4.7, glibc-debuginfo-common 2.12-1.107.el6_4.7 Red Hat Enterprise Linux Server Optional EUS (v. 6.5) glibc 2.12-1.132.el6_5.5, glibc-debuginfo-common 2.12-1.132.el6_5.5
    fixed: vendor fix RHSA-2015:0099
  • Red Hat Enterprise Linux Workstation (v. 6) nscd 2.12-1.149.el6_6.5, glibc 2.12-1.149.el6_6.5, glibc-utils 2.12-1.149.el6_6.5, glibc-common 2.12-1.149.el6_6.5, glibc-debuginfo-common 2.12-1.149.el6_6.5 Red Hat Enterprise Linux Workstation (v. 7) nscd 2.17-55.el7_0.5, glibc 2.17-55.el7_0.5, glibc-utils 2.17-55.el7_0.5, glibc-common 2.17-55.el7_0.5, glibc-debuginfo-common 2.17-55.el7_0.5 Red Hat Enterprise Linux Workstation Optional (v. 6) glibc-debuginfo-common 2.12-1.149.el6_6.5 Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.5
    fixed: vendor fix RHSA-2015:0092
  • Red Hat RHEV Hypervisor for RHEL-6 rhev-hypervisor6 6.6-20150123.1.el6ev
    fixed: vendor fix RHSA-2015:0126

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-15-064-01A updated cvss 4.6

Siemens SIMATIC HMI Basic, SINUMERIK, and Ruggedcom APE GHOST Vulnerability (Update A)

  • Siemens SIMATIC HMI Basic Panels 2nd Generation Siemens SINUMERIK 808D <=4.7 Siemens SINUMERIK 828D <=4.7 Siemens SINUMERIK 840D sl <=4.7
    affected: mitigation “Siemens has released security advisory SSA-994726 at the following location: http://www.siemens.com/cert/advisories”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-15-064-01 updated cvss 4.6

Siemens SIMATIC HMI Basic, SINUMERIK, and Ruggedcom APE GHOST Vulnerability

  • Siemens SIMATIC HMI Basic Panels 2nd Generation Siemens SINUMERIK 808D <=4.7 Siemens SINUMERIK 828D <=4.7 Siemens SINUMERIK 840D sl <=4.7
    affected: mitigation “Siemens has released security advisory SSA-994726 at the following location: http://www.siemens.com/cert/advisories”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/smtp/exim_gethostbyname_bof)
  2. Published

Exploit prediction

94.56% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/linux/smtp/exim_gethostbyname_bof Exim GHOST (glibc gethostbyname) Buffer Overflow metasploit exploit, great rank, 2015-01-27
  • Metasploit auxiliary/scanner/http/wordpress_ghost_scanner WordPress XMLRPC GHOST Vulnerability Scanner metasploit auxiliary, normal rank
  • EDB-36421 Exim - 'GHOST' glibc gethostbyname Buffer Overflow (Metasploit) remote, 2015-03-18
  • EDB-35951 Exim ESMTP 4.80 - glibc gethostbyname Denial of Service dos, 2015-01-29
  • packetstormsecurity.com http://packetstormsecurity.com/files/130974/Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/130171/Exim-ESMTP-GHOST-Denial-Of-Service.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2019/Jun/18 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2021/Sep/0 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2022/Jun/36 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/oss-sec/2015/q1/274 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2021/05/04/7 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/archive/1/534845/100/0/threaded referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org https://seclists.org/bugtraq/2019/Jun/14 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.