{"id":"CVE-2016-3706","published":"2016-06-10T15:00:00Z","modified":"2024-08-06T00:03:34Z","title":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc…","vendor":null,"product":null,"tier":"tail","description":{"text":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05926,"percentile":0.93223,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/88440","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21995039","tags":["x_refsource_CONFIRM"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=20010","tags":["x_refsource_CONFIRM"]},{"url":"https://source.android.com/security/bulletin/2017-12-01","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.securityfocus.com/bid/102073","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":18.6,"factors":[{"name":"EPSS percentile","points":18.64}]},"euvd":{"id":"EUVD-2016-4727","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2013-1914-family-cve-2013-1914","parents":[{"from":"CVE-2013-4458","to":"CVE-2016-3706","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.","from":"CVE.org","in":"CVE-2016-3706"}]}]}}