VDB
DEBIAN-CVE-2023-4527
DEBIAN-CVE-2023-4527
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | glibc | 0, 0, 0 |
| Debian | glibc | |
| Debian:12 | glibc | 0, 2.36-9, 2.36-9+deb12u1 |
| Debian:13 | glibc | 0, 0, 0 |
Timeline
- Sep 18, 2023 CVE Published
- Apr 28, 2026 CVE Updated