CVE catalog

CVE-2023-4806

glibc: CVE-2023-4806

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.61% · Oct 25, 2026

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglibcsid2.43-7fixed
Debianglibcforky2.43-7fixed
Debianglibctrixie2.41-12+deb13u4fixed
Debianglibcbookworm2.36-9+deb12u14fixed
Debianglibcbookworm-security2.36-9+deb12u7fixed
Ubuntuglibcpro2.26-0ubuntu2vulnerable
Ubuntuglibcpro2.26-0ubuntu2.1vulnerable
Ubuntuglibcpro2.27-0ubuntu2vulnerable
Ubuntuglibcpro2.27-0ubuntu3vulnerable
Ubuntuglibcpro2.27-3ubuntu1vulnerable
Ubuntuglibcpro2.27-3ubuntu1.2vulnerable
Ubuntuglibcpro2.27-3ubuntu1.3vulnerable
Ubuntuglibcpro2.27-3ubuntu1.4vulnerable
Ubuntuglibcpro2.27-3ubuntu1.5vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6+esm1fixed
Ubuntuglibc20.042.30-0ubuntu2vulnerable
Ubuntuglibc20.042.30-0ubuntu3vulnerable
Ubuntuglibc20.042.31-0ubuntu5vulnerable
Ubuntuglibc20.042.31-0ubuntu6vulnerable
Ubuntuglibc20.042.31-0ubuntu7vulnerable
Ubuntuglibc20.042.31-0ubuntu9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.1vulnerable
Ubuntuglibc20.042.31-0ubuntu9.2vulnerable
Ubuntuglibc20.042.31-0ubuntu9.3vulnerable
Ubuntuglibc20.042.31-0ubuntu9.7vulnerable
Ubuntuglibc20.042.31-0ubuntu9.9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.12vulnerable
Ubuntuglibc20.042.31-0ubuntu9.14fixed
Ubuntuglibc22.042.34-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu1vulnerable
Ubuntuglibc22.042.35-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.1vulnerable
Ubuntuglibc22.042.35-0ubuntu3.3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.4vulnerable
Ubuntuglibc22.042.35-0ubuntu3.5fixed
Ubuntueglibcpro2.17-93ubuntu4vulnerable
Ubuntueglibcpro2.18-0ubuntu1vulnerable
Ubuntueglibcpro2.18-0ubuntu2vulnerable
Ubuntueglibcpro2.18-0ubuntu4vulnerable
Ubuntueglibcpro2.18-0ubuntu5vulnerable
Ubuntueglibcpro2.18-0ubuntu6vulnerable
Ubuntueglibcpro2.18-0ubuntu7vulnerable
Ubuntueglibcpro2.19-0ubuntu2vulnerable
Ubuntueglibcpro2.19-0ubuntu3vulnerable
Ubuntueglibcpro2.19-0ubuntu4vulnerable
Ubuntueglibcpro2.19-0ubuntu5vulnerable
Ubuntueglibcpro2.19-0ubuntu6vulnerable
Ubuntueglibcpro2.19-0ubuntu6.1vulnerable
Ubuntueglibcpro2.19-0ubuntu6.3vulnerable
Ubuntueglibcpro2.19-0ubuntu6.4vulnerable
Ubuntueglibcpro2.19-0ubuntu6.5vulnerable
Ubuntueglibcpro2.19-0ubuntu6.6vulnerable
Ubuntueglibcpro2.19-0ubuntu6.7vulnerable
Ubuntueglibcpro2.19-0ubuntu6.8vulnerable
Ubuntueglibcpro2.19-0ubuntu6.9vulnerable
Ubuntueglibcpro2.19-0ubuntu6.10vulnerable
Ubuntueglibcpro2.19-0ubuntu6.11vulnerable
Ubuntueglibcpro2.19-0ubuntu6.13vulnerable
Ubuntueglibcpro2.19-0ubuntu6.14vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm1vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm2vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm3vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm4vulnerable
Ubuntuglibcpro2.26-0ubuntu2vulnerable
Ubuntuglibcpro2.26-0ubuntu2.1vulnerable
Ubuntuglibcpro2.27-0ubuntu2vulnerable
Ubuntuglibcpro2.27-0ubuntu3vulnerable
Ubuntuglibcpro2.27-3ubuntu1vulnerable
Ubuntuglibcpro2.27-3ubuntu1.2vulnerable
Ubuntuglibcpro2.27-3ubuntu1.3vulnerable
Ubuntuglibcpro2.27-3ubuntu1.4vulnerable
Ubuntuglibcpro2.27-3ubuntu1.5vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6+esm1fixed
Ubuntuglibc20.042.30-0ubuntu2vulnerable
Ubuntuglibc20.042.30-0ubuntu3vulnerable
Ubuntuglibc20.042.31-0ubuntu5vulnerable
Ubuntuglibc20.042.31-0ubuntu6vulnerable
Ubuntuglibc20.042.31-0ubuntu7vulnerable
Ubuntuglibc20.042.31-0ubuntu9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.1vulnerable
Ubuntuglibc20.042.31-0ubuntu9.2vulnerable
Ubuntuglibc20.042.31-0ubuntu9.3vulnerable
Ubuntuglibc20.042.31-0ubuntu9.7vulnerable
Ubuntuglibc20.042.31-0ubuntu9.9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.12vulnerable
Ubuntuglibc20.042.31-0ubuntu9.14fixed
Ubuntuglibc22.042.34-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu1vulnerable
Ubuntuglibc22.042.35-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.1vulnerable
Ubuntuglibc22.042.35-0ubuntu3.3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.4vulnerable
Ubuntuglibc22.042.35-0ubuntu3.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglibcsourcesid2.37-10not yet assignedNot reportedNot reported
Debianglibcsourceforky2.37-10not yet assignedNot reportedNot reported
Debianglibcsourcetrixie2.37-10not yet assignedNot reportedNot reported
Debianglibcsourcebookworm2.36-9+deb12u3not yet assignedNot reportedNot reported
Ubuntuglibcdebpro2.27-3ubuntu1.6+esm1Not reportedUSN-6541-1Not reported
Ubuntuglibcdeb20.042.31-0ubuntu9.14Not reportedUSN-6541-1Not reported
Ubuntuglibcdeb22.042.35-0ubuntu3.5Not reportedUSN-6541-1Not reported
Ubuntuglibcdebpro2.27-3ubuntu1.6+esm1Not reportedUBUNTU-CVE-2023-4806Not reported
Ubuntuglibcdeb20.042.31-0ubuntu9.14Not reportedUBUNTU-CVE-2023-4806Not reported
Ubuntuglibcdeb22.042.35-0ubuntu3.5Not reportedUBUNTU-CVE-2023-4806Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]