TI-2022-11964 CVE-2022-29503 · GHSA-8544-pv22-r7m4
Memory corruption in Anker Eufy Homebase 2
Priority HIGH 76
A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40.
Vulnerabilities
7 records
TI-2022-12530 CVE-2022-30295 · GHSA-gv7v-mf7r-p93f
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs…
Priority MEDIUM 42
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning.
TI-2021-08909 CVE-2021-27419 · GHSA-499x-cvfw-94w6
uClibc-ng Integer Overflow or Wraparound
Priority MEDIUM 51
uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple.
TI-2021-19416 CVE-2021-43523 · GHSA-65xv-vmv6-8r3f
In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain…
Priority HIGH 76
In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames…
TI-2016-02030 CVE-2016-2225 · GHSA-rh88-rf49-8c8f
The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows…
Priority LOW 38
The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.
TI-2016-02029 CVE-2016-2224 · GHSA-f95j-r4jh-f3j8
The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows…
Priority LOW 38
The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.
TI-2016-05366 CVE-2016-6264 · GHSA-5f7g-9m8m-qhpv
Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before…
Priority LOW 38
Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a denial of service (crash) via a negative length value to the memset function.