GHOST Vulnerability CVE-2015-0235 | Linux glibc RCE Bug | Qualys
Summary: Qualys researchers found a buffer overflow in the __nss_hostname_digits_dots() function of glibc, triggerable locally and remotely through the gethostbyname() functions, and disclosed it with coordinated patches released January 27, 2015. The flaw dates to glibc-2.2 from November 10, 2000, was fixed on May 21, 2013 without being recognized as a security threat, leaving Debian 7, Red Hat Enterprise Linux 6 and 7, CentOS 6 and 7, and Ubuntu 12.04 exposed.
Bottom line: Qualys built a proof-of-concept that sends a crafted email to a mail server and returns a remote shell, bypassing ASLR, PIE and NX on both 32-bit and 64-bit systems, giving an attacker complete control of the host. The fix sat unrecognized in glibc for roughly 20 months before disclosure, so the exposure window was measured in years, not days.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-0235
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026