GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

USN-3534-1 (UBUNTU-CVE-2017-15670)

Vulnerability from osv_ubuntu – Published: 2018-01-17 12:57 – Updated: 2026-04-22 07:36 – Source website
VLAI
Summary
eglibc, glibc vulnerabilities
Details

It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in setuid programs and gain administrative privileges. (CVE-2018-1000001)

A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob() implementation. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU C library glob() implementation. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by providing a specially crafted library in the current working directory in order to gain administrative privileges. (CVE-2017-16997)

It was discovered that the GNU C library malloc() implementation could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-based overflow. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-15670",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-15804",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-16997",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-1000408",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-1000409",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-1000001",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "eglibc-source",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-dev-ppc64",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-ppc64",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.19-0ubuntu6.14"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.19-0ubuntu6.14"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "eglibc",
        "purl": "pkg:deb/ubuntu/eglibc@2.19-0ubuntu6.14?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.19-0ubuntu6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.17-93ubuntu4",
        "2.18-0ubuntu1",
        "2.18-0ubuntu2",
        "2.18-0ubuntu4",
        "2.18-0ubuntu5",
        "2.18-0ubuntu6",
        "2.18-0ubuntu7",
        "2.19-0ubuntu2",
        "2.19-0ubuntu3",
        "2.19-0ubuntu4",
        "2.19-0ubuntu5",
        "2.19-0ubuntu6",
        "2.19-0ubuntu6.1",
        "2.19-0ubuntu6.3",
        "2.19-0ubuntu6.4",
        "2.19-0ubuntu6.5",
        "2.19-0ubuntu6.6",
        "2.19-0ubuntu6.7",
        "2.19-0ubuntu6.8",
        "2.19-0ubuntu6.9",
        "2.19-0ubuntu6.10",
        "2.19-0ubuntu6.11",
        "2.19-0ubuntu6.13"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-15670",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-15804",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-16997",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-1000408",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-1000409",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-1000001",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-dev-ppc64",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-ppc64",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.23-0ubuntu10"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.23-0ubuntu10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.23-0ubuntu10?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.23-0ubuntu10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21-0ubuntu4",
        "2.21-0ubuntu5",
        "2.21-0ubuntu6",
        "2.23-0ubuntu1",
        "2.23-0ubuntu2",
        "2.23-0ubuntu3",
        "2.23-0ubuntu4",
        "2.23-0ubuntu5",
        "2.23-0ubuntu6",
        "2.23-0ubuntu7",
        "2.23-0ubuntu9"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the GNU C library did not properly handle all of\nthe possible return values from the kernel getcwd(2) syscall. A local\nattacker could potentially exploit this to execute arbitrary code in setuid\nprograms and gain administrative privileges. (CVE-2018-1000001)\n\nA memory leak was discovered in the _dl_init_paths() function in the GNU\nC library dynamic loader. A local attacker could potentially exploit this\nwith a specially crafted value in the LD_HWCAP_MASK environment variable,\nin combination with CVE-2017-1000409 and another vulnerability on a system\nwith hardlink protections disabled, in order to gain administrative\nprivileges. (CVE-2017-1000408)\n\nA heap-based buffer overflow was discovered in the _dl_init_paths()\nfunction in the GNU C library dynamic loader. A local attacker could\npotentially exploit this with a specially crafted value in the\nLD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408\nand another vulnerability on a system with hardlink protections disabled,\nin order to gain administrative privileges. (CVE-2017-1000409)\n\nAn off-by-one error leading to a heap-based buffer overflow was discovered\nin the GNU C library glob() implementation. An attacker could potentially\nexploit this to cause a denial of service or execute arbitrary code via a\nmaliciously crafted pattern. (CVE-2017-15670)\n\nA heap-based buffer overflow was discovered during unescaping of user names\nwith the ~ operator in the GNU C library glob() implementation. An attacker\ncould potentially exploit this to cause a denial of service or execute\narbitrary code via a maliciously crafted pattern. (CVE-2017-15804)\n\nIt was discovered that the GNU C library dynamic loader mishandles RPATH\nand RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE)\nprograms. A local attacker could potentially exploit this by providing a\nspecially crafted library in the current working directory in order to\ngain administrative privileges. (CVE-2017-16997)\n\nIt was discovered that the GNU C library malloc() implementation could\nreturn a memory block that is too small if an attempt is made to allocate\nan object whose size is close to SIZE_MAX, resulting in a heap-based\noverflow. An attacker could potentially exploit this to cause a denial of\nservice or execute arbitrary code. This issue only affected Ubuntu 17.10.\n(CVE-2017-17426)\n",
  "id": "USN-3534-1",
  "modified": "2026-04-22T07:36:35Z",
  "published": "2018-01-17T12:57:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3534-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-15670"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-15804"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-16997"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17426"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-1000408"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-1000409"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-1000001"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "eglibc, glibc vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2017-15670",
    "UBUNTU-CVE-2017-15804",
    "UBUNTU-CVE-2017-16997",
    "UBUNTU-CVE-2017-17426",
    "UBUNTU-CVE-2017-1000408",
    "UBUNTU-CVE-2017-1000409",
    "UBUNTU-CVE-2018-1000001"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.