{
  "threat_severity" : "Critical",
  "public_date" : "2015-01-27T00:00:00Z",
  "bugzilla" : {
    "description" : "glibc: __nss_hostname_digits_dots() heap-based buffer overflow",
    "id" : "1183461",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1183461"
  },
  "cvss" : {
    "cvss_base_score" : "6.8",
    "cvss_scoring_vector" : "AV:N/AC:M/Au:N/C:P/I:P/A:P",
    "status" : "verified"
  },
  "cwe" : "CWE-131->CWE-122",
  "details" : [ "Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka \"GHOST.\"", "A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 4 Extended Lifecycle Support",
    "release_date" : "2015-01-28T00:00:00Z",
    "advisory" : "RHSA-2015:0101",
    "cpe" : "cpe:/o:redhat:rhel_els:4",
    "package" : "glibc-0:2.3.4-2.57.el4.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "release_date" : "2015-01-27T00:00:00Z",
    "advisory" : "RHSA-2015:0090",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5",
    "package" : "glibc-0:2.5-123.el5_11.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5.6 Long Life",
    "release_date" : "2015-01-28T00:00:00Z",
    "advisory" : "RHSA-2015:0099",
    "cpe" : "cpe:/o:redhat:rhel_mission_critical:5.6",
    "package" : "glibc-0:2.5-58.el5_6.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5.9 Extended Update Support",
    "release_date" : "2015-01-28T00:00:00Z",
    "advisory" : "RHSA-2015:0099",
    "cpe" : "cpe:/o:redhat:rhel_eus:5.9",
    "package" : "glibc-0:2.5-107.el5_9.8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2015-01-27T00:00:00Z",
    "advisory" : "RHSA-2015:0092",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "glibc-0:2.12-1.149.el6_6.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.2 Advanced Update Support",
    "release_date" : "2015-01-28T00:00:00Z",
    "advisory" : "RHSA-2015:0099",
    "cpe" : "cpe:/o:redhat:rhel_mission_critical:6.2",
    "package" : "glibc-0:2.12-1.47.el6_2.15"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.4 Extended Update Support",
    "release_date" : "2015-01-28T00:00:00Z",
    "advisory" : "RHSA-2015:0099",
    "cpe" : "cpe:/o:redhat:rhel_eus:6.4",
    "package" : "glibc-0:2.12-1.107.el6_4.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.5 Extended Update Support",
    "release_date" : "2015-01-28T00:00:00Z",
    "advisory" : "RHSA-2015:0099",
    "cpe" : "cpe:/o:redhat:rhel_eus:6.5",
    "package" : "glibc-0:2.12-1.132.el6_5.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2015-01-27T00:00:00Z",
    "advisory" : "RHSA-2015:0092",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "glibc-0:2.17-55.el7_0.5"
  }, {
    "product_name" : "RHEV 3.X Hypervisor and Agents for RHEL-6",
    "release_date" : "2015-02-04T00:00:00Z",
    "advisory" : "RHSA-2015:0126",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6::hypervisor",
    "package" : "rhev-hypervisor6-0:6.6-20150123.1.el6ev"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2015-0235\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-0235\nhttp://www.openwall.com/lists/oss-security/2015/01/27/9\nhttps://access.redhat.com/articles/1332213\nhttps://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability" ],
  "csaw" : true,
  "name" : "CVE-2015-0235"
}