high 7.8

CVE-2017-1000366 json

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, po…

published 2017-06-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-1525

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits: 3; Exploit-DB

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Patch / fix

distros 6 links 1

debian ubuntu red hat suse opensuse arch linux

glibc Debian 14, Debian 13, Debian 12 2.24-12

debian advisories DEBIAN-CVE-2017-1000366

glibc Ubuntu 16.04 LTS 2.23-0ubuntu9
eglibc Ubuntu 14.04 LTS 2.19-0ubuntu6.13

ubuntu advisories UBUNTU-CVE-2017-1000366

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

glibc RHEL 6 2.12-1.209.el6_9.2
nscd RHEL 6 2.12-1.209.el6_9.2
glibc-utils RHEL 6 2.12-1.209.el6_9.2
glibc-common RHEL 6 2.12-1.209.el6_9.2
glibc-debuginfo-common RHEL 6 2.12-1.209.el6_9.2
glibc RHEL 7 2.17-157.el7_3.4
nscd RHEL 7 2.17-157.el7_3.4
glibc-utils RHEL 7 2.17-157.el7_3.4

red hat advisories RHSA-2017:1479 RHSA-2017:1480 RHSA-2017:1481

glibc SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 2.11.3-17.109.1
glibc SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +2 more 2.22-61.3
glibc SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 2.19-40.6.1
glibc SLES for SAP 12, SLES 12-LTSS 2.19-22.21.1

suse advisories SUSE-SU-2017:1621-1 SUSE-SU-2017:1619-1 SUSE-SU-2017:1614-1 SUSE-SU-2017:1611-1

glibc openSUSE Tumbleweed 2.34-1.2

opensuse advisories openSUSE-SU-2024:10792-1

glibc Arch Linux 2.25-4
lib32-glibc Arch Linux 2.25-4

arch linux advisories AVG-307 AVG-308

kc.mcafee.com/corporate/index?page=content&id=SB10205 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-1000366 updated 2026-11-04 cvss 7.4

glibc: heap/stack gap jumping via unbounded stack allocations

Red Hat Enterprise Linux 4 glibc
affected: no fix planned “Will not fix”
Red Hat Container Development Kit 3.0
fixed: vendor fix RHSA-2017:1567
Red Hat Enterprise Linux Client (v. 7) nscd 2.17-157.el7_3.4, glibc 2.17-157.el7_3.4, glibc-utils 2.17-157.el7_3.4, glibc-common 2.17-157.el7_3.4, glibc-debuginfo-common 2.17-157.el7_3.4 Red Hat Enterprise Linux Client Optional (v. 7) glibc-debuginfo-common 2.17-157.el7_3.4 Red Hat Enterprise Linux ComputeNode (v. 7) nscd 2.17-157.el7_3.4, glibc 2.17-157.el7_3.4, glibc-utils 2.17-157.el7_3.4, glibc-common 2.17-157.el7_3.4, glibc-debuginfo-common 2.17-157.el7_3.4
fixed: vendor fix RHSA-2017:1481
Red Hat Enterprise Linux ComputeNode EUS (v. 7.2) nscd 2.17-106.el7_2.9, glibc 2.17-106.el7_2.9, glibc-utils 2.17-106.el7_2.9, glibc-common 2.17-106.el7_2.9, glibc-debuginfo-common 2.17-106.el7_2.9
fixed: vendor fix RHSA-2017:1479
Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-debuginfo-common 2.17-157.el7_3.4
fixed: vendor fix RHSA-2017:1481
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2) glibc-debuginfo-common 2.17-106.el7_2.9
fixed: vendor fix RHSA-2017:1479
Red Hat Enterprise Linux Desktop (v. 6) nscd 2.12-1.209.el6_9.2, glibc 2.12-1.209.el6_9.2, glibc-utils 2.12-1.209.el6_9.2, glibc-common 2.12-1.209.el6_9.2, glibc-debuginfo-common 2.12-1.209.el6_9.2 Red Hat Enterprise Linux Desktop Optional (v. 6) glibc-debuginfo-common 2.12-1.209.el6_9.2 Red Hat Enterprise Linux HPC Node (v. 6) nscd 2.12-1.209.el6_9.2, glibc 2.12-1.209.el6_9.2, glibc-utils 2.12-1.209.el6_9.2, glibc-common 2.12-1.209.el6_9.2, glibc-debuginfo-common 2.12-1.209.el6_9.2
fixed: vendor fix RHSA-2017:1480
Red Hat Enterprise Linux HPC Node EUS (v. 6.7) nscd 2.12-1.166.el6_7.8, glibc 2.12-1.166.el6_7.8, glibc-utils 2.12-1.166.el6_7.8, glibc-common 2.12-1.166.el6_7.8, glibc-debuginfo-common 2.12-1.166.el6_7.8
fixed: vendor fix RHSA-2017:1479

show 12 more

Red Hat Enterprise Linux HPC Node Optional (v. 6) glibc-debuginfo-common 2.12-1.209.el6_9.2
fixed: vendor fix RHSA-2017:1480
Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) glibc-debuginfo-common 2.12-1.166.el6_7.8 Red Hat Enterprise Linux Long Life (v. 5.9 server) nscd 2.5-107.el5_9.9, glibc 2.5-107.el5_9.9, glibc-utils 2.5-107.el5_9.9, glibc-common 2.5-107.el5_9.9, glibc-debuginfo-common 2.5-107.el5_9.9 Red Hat Enterprise Linux Server (v. 5 ELS) nscd 2.5-123.el5_11.4, glibc 2.5-123.el5_11.4, glibc-utils 2.5-123.el5_11.4, glibc-common 2.5-123.el5_11.4, glibc-debuginfo-common 2.5-123.el5_11.4
fixed: vendor fix RHSA-2017:1479
Red Hat Enterprise Linux Server (v. 6) nscd 2.12-1.209.el6_9.2, glibc 2.12-1.209.el6_9.2, glibc-utils 2.12-1.209.el6_9.2, glibc-common 2.12-1.209.el6_9.2, glibc-debuginfo-common 2.12-1.209.el6_9.2
fixed: vendor fix RHSA-2017:1480
Red Hat Enterprise Linux Server (v. 7) nscd 2.17-157.el7_3.4, glibc 2.17-157.el7_3.4, glibc-utils 2.17-157.el7_3.4, glibc-common 2.17-157.el7_3.4, glibc-debuginfo-common 2.17-157.el7_3.4
fixed: vendor fix RHSA-2017:1481
Red Hat Enterprise Linux Server AUS (v. 6.2) nscd 2.12-1.47.el6_2.18, glibc 2.12-1.47.el6_2.18, glibc-utils 2.12-1.47.el6_2.18, glibc-common 2.12-1.47.el6_2.18, glibc-debuginfo-common 2.12-1.47.el6_2.18 Red Hat Enterprise Linux Server AUS (v. 6.4) nscd 2.12-1.107.el6_4.10, glibc 2.12-1.107.el6_4.10, glibc-utils 2.12-1.107.el6_4.10, glibc-common 2.12-1.107.el6_4.10, glibc-debuginfo-common 2.12-1.107.el6_4.10 Red Hat Enterprise Linux Server AUS (v. 6.5) nscd 2.12-1.132.el6_5.9, glibc 2.12-1.132.el6_5.9, glibc-utils 2.12-1.132.el6_5.9, glibc-common 2.12-1.132.el6_5.9, glibc-debuginfo-common 2.12-1.132.el6_5.9 Red Hat Enterprise Linux Server AUS (v. 6.6) nscd 2.12-1.149.el6_6.12, glibc 2.12-1.149.el6_6.12, glibc-utils 2.12-1.149.el6_6.12, glibc-common 2.12-1.149.el6_6.12, glibc-debuginfo-common 2.12-1.149.el6_6.12 Red Hat Enterprise Linux Server EUS (v. 6.7) nscd 2.12-1.166.el6_7.8, glibc 2.12-1.166.el6_7.8, glibc-utils 2.12-1.166.el6_7.8, glibc-common 2.12-1.166.el6_7.8, glibc-debuginfo-common 2.12-1.166.el6_7.8 Red Hat Enterprise Linux Server EUS (v. 7.2) nscd 2.17-106.el7_2.9, glibc 2.17-106.el7_2.9, glibc-utils 2.17-106.el7_2.9, glibc-common 2.17-106.el7_2.9, glibc-debuginfo-common 2.17-106.el7_2.9
fixed: vendor fix RHSA-2017:1479
Red Hat Enterprise Linux Server Optional (v. 6) glibc-debuginfo-common 2.12-1.209.el6_9.2
fixed: vendor fix RHSA-2017:1480
Red Hat Enterprise Linux Server Optional (v. 7) glibc-debuginfo-common 2.17-157.el7_3.4
fixed: vendor fix RHSA-2017:1481
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) glibc 2.12-1.47.el6_2.18, glibc-debuginfo-common 2.12-1.47.el6_2.18 Red Hat Enterprise Linux Server Optional AUS (v. 6.4) glibc 2.12-1.107.el6_4.10, glibc-debuginfo-common 2.12-1.107.el6_4.10 Red Hat Enterprise Linux Server Optional AUS (v. 6.5) glibc 2.12-1.132.el6_5.9, glibc-debuginfo-common 2.12-1.132.el6_5.9 Red Hat Enterprise Linux Server Optional AUS (v. 6.6) glibc-debuginfo-common 2.12-1.149.el6_6.12 Red Hat Enterprise Linux Server Optional EUS (v. 6.7) glibc-debuginfo-common 2.12-1.166.el6_7.8 Red Hat Enterprise Linux Server Optional EUS (v. 7.2) glibc-debuginfo-common 2.17-106.el7_2.9

+4 more productsfewer

Red Hat Enterprise Linux Server Optional TUS (v. 6.5) glibc 2.12-1.132.el6_5.9, glibc-debuginfo-common 2.12-1.132.el6_5.9 Red Hat Enterprise Linux Server Optional TUS (v. 6.6) glibc-debuginfo-common 2.12-1.149.el6_6.12 Red Hat Enterprise Linux Server TUS (v. 6.5) nscd 2.12-1.132.el6_5.9, glibc 2.12-1.132.el6_5.9, glibc-utils 2.12-1.132.el6_5.9, glibc-common 2.12-1.132.el6_5.9, glibc-debuginfo-common 2.12-1.132.el6_5.9 Red Hat Enterprise Linux Server TUS (v. 6.6) nscd 2.12-1.149.el6_6.12, glibc 2.12-1.149.el6_6.12, glibc-utils 2.12-1.149.el6_6.12, glibc-common 2.12-1.149.el6_6.12, glibc-debuginfo-common 2.12-1.149.el6_6.12

fixed: vendor fix RHSA-2017:1479
Red Hat Enterprise Linux Workstation (v. 6) nscd 2.12-1.209.el6_9.2, glibc 2.12-1.209.el6_9.2, glibc-utils 2.12-1.209.el6_9.2, glibc-common 2.12-1.209.el6_9.2, glibc-debuginfo-common 2.12-1.209.el6_9.2
fixed: vendor fix RHSA-2017:1480
Red Hat Enterprise Linux Workstation (v. 7) nscd 2.17-157.el7_3.4, glibc 2.17-157.el7_3.4, glibc-utils 2.17-157.el7_3.4, glibc-common 2.17-157.el7_3.4, glibc-debuginfo-common 2.17-157.el7_3.4
fixed: vendor fix RHSA-2017:1481
Red Hat Enterprise Linux Workstation Optional (v. 6) glibc-debuginfo-common 2.12-1.209.el6_9.2
fixed: vendor fix RHSA-2017:1480
Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-debuginfo-common 2.17-157.el7_3.4
fixed: vendor fix RHSA-2017:1481

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2017-06-19 Published
2017-06-28 First public exploit (EDB-42276)

Exploit prediction

2.73% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-42276 Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack Clash' Local Privilege Escalation local, 2017-06-28
EDB-42275 Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation local, 2017-06-28
EDB-42274 Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5.11/6.0/6.8/7.2.1511) - 'ldso_hwcap Stack Clash' Local Privilege Escalation local, 2017-06-28

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

kc.mcafee.com /corporate/index?page=content&id=SB10205
patch, third-party-advisory
exploit-db.com /exploits/42275/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/42276/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/42274/
exploit, third-party-advisory, vdb-entry
access.redhat.com /errata/RHSA-2017:1712
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:1479
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:1480
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:1567
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:1481
vendor-advisory, third-party-advisory
debian.org /security/2017/dsa-3887
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201706-19
vendor-advisory, third-party-advisory
qualys.com /2017/06/19/stack-clash/stack-clash.txt
technical-description, third-party-advisory
securitytracker.com /id/1038712
vdb-entry, third-party-advisory
suse.com /security/cve/CVE-2017-1000366/
third-party-advisory
securityfocus.com /bid/99127
vdb-entry, third-party-advisory
suse.com /support/kb/doc/?id=7020973
third-party-advisory
access.redhat.com /security/cve/CVE-2017-1000366
third-party-advisory
seclists.org /fulldisclosure/2019/Sep/7
mailing-list
seclists.org /bugtraq/2019/Sep/7
mailing-list
packetstormsecurity.com /files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html

Sources

CVE List CVE-2017-1000366
NVD CVE-2017-1000366

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary