CVE-2017-1000366

HIGH

glibc <2.25 - RCE

Title source: llm

Description

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Qualys Corporation · clocallinux_x86
https://www.exploit-db.com/exploits/42276
exploitdb WORKING POC VERIFIED
by Qualys Corporation · clocallinux_x86-64
https://www.exploit-db.com/exploits/42275
exploitdb WORKING POC VERIFIED
by Qualys Corporation · clocallinux_x86
https://www.exploit-db.com/exploits/42274

References (20)

Scores

CVSS v3 7.8
EPSS 0.0887
EPSS Percentile 92.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (48)
debian/debian_linux 8.0
debian/debian_linux 9.0
gnu/glibc < 2.25
mcafee/web_gateway < 7.6.2.14
novell/suse_linux_enterprise_desktop 12.0 sp2
novell/suse_linux_enterprise_point_of_sale 11.0 sp3
novell/suse_linux_enterprise_server 11.0 sp3
openstack/cloud_magnum_orchestration 7
opensuse/leap 42.2
redhat/enterprise_linux 5
... and 38 more
Published Jun 19, 2017
Tracked Since Feb 18, 2026