eglibc - Security Update
Summary
DSA-2976-1: eglibc - security update. Affects eglibc versions < 2.13-38+deb7u3. Fixed in 2.13-38+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU C library (glibc) is a critical component of the Debian 7 operating system. It provides essential functionality for programs written in the C programming language. This vulnerability affects version 2.13-38+deb7u3 of the eglibc package in Debian 7.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0475, involves the processing of ".." path segments in locale-related environment variables by the glibc library. Attackers can exploit this issue by supplying crafted locale settings, potentially circumventing intended restrictions such as ForceCommand in OpenSSH. This vulnerability could lead to unauthorized access or privilege escalation.
How To Fix
Minimum fixed version
2.13-38+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade eglibcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The eglibc package in Debian 7 is vulnerable to a security issue that allows attackers to bypass intended restrictions. It is crucial to upgrade to version 2.13-38+deb7u3 or later to mitigate this vulnerability. For additional support and information, please contact DevNack.com.
See every vulnerability recorded for eglibc →
FAQ
The vulnerability allows attackers to bypass intended restrictions and potentially gain unauthorized access or escalate privileges.
The vulnerability affects version 2.13-38+deb7u3 of the eglibc package in Debian 7.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
There are no known exploits available for this vulnerability at the moment.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for eglibc.
