CVE-2014-9984

NameCVE-2014-9984
Descriptionnscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glibc (PTS)buster2.28-10+deb10u1fixed
buster (security)2.28-10+deb10u2fixed
bullseye2.31-13+deb11u8fixed
bullseye (security)2.31-13+deb11u7fixed
bookworm, bookworm (security)2.36-9+deb12u4fixed
trixie, sid2.37-15fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
eglibcsourcewheezy(not affected)
eglibcsource(unstable)(unfixed)
glibcsource(unstable)2.19-14

Notes

[wheezy] - eglibc <not-affected> (Vulnerable code not present)
Upstream bug: https://sourceware.org/bugzilla/show_bug.cgi?id=16695
Fixed by: https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=c44496df2f090a56d3bf75df930592dac6bba46f

Search for package or bug name: Reporting problems