CVE-2015-0235: apple mac_os_x Out-of-bounds Write

Modified

AliasesRHSA-2015:0090RHSA-2015:0092RHSA-2015:0099+4 more

Published 28-01-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-0235 is a high (CVSS 10.0) Out-of-bounds Write vulnerability in apple mac_os_x. EPSS estimates a 94.56% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 16 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 18-03-2015)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

94.56%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits16reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 5 · Related 3

DSA-3142-1 OPENSUSE-SU-2024:10290-1 OPENSUSE-SU-2024:10344-1 OPENSUSE-SU-2024:11169-1 RHSA-2015:0126

Timeline

28-01-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

94.56%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 94.56% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

16 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Show all 16 exploits

referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databasedoslinuxUnverified
Exim ESMTP 4.80 - glibc gethostbyname Denial of Service
Maturity: poc
exploit-databaseremotelinuxVerified
Exim - 'GHOST' glibc gethostbyname Buffer Overflow (Metasploit)
Maturity: weaponized
MetasploitremoteUnverified
WordPress XMLRPC GHOST Vulnerability Scanner
auxiliary/scanner/http/wordpress_ghost_scanner
Maturity: poc
MetasploitremoteVerified
Exim GHOST (glibc gethostbyname) Buffer Overflow
exploit/linux/smtp/exim_gethostbyname_bof
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat12 products

virtualization6.0
glibc< 0:2.5-123.el5_11.1 | < 0:2.12-1.149.el6_6.5 | < 0:2.17-55.el7_0.5 | < 0:2.5-58.el5_6.6 | < 0:2.5-107.el5_9.8 | < 0:2.12-1.107.el6_4.7 | < 0:2.12-1.132.el6_5.5 | < 0:2.12-1.47.el6_2.15 | < 0:2.3.4-2.57.el4.2
glibc-common< 0:2.5-123.el5_11.1 | < 0:2.12-1.149.el6_6.5 | < 0:2.17-55.el7_0.5 | < 0:2.5-58.el5_6.6 | < 0:2.5-107.el5_9.8 | < 0:2.12-1.107.el6_4.7 | < 0:2.12-1.132.el6_5.5 | < 0:2.12-1.47.el6_2.15 | < 0:2.3.4-2.57.el4.2
glibc-debuginfo< 0:2.5-123.el5_11.1 | < 0:2.12-1.149.el6_6.5 | < 0:2.17-55.el7_0.5 | < 0:2.5-58.el5_6.6 | < 0:2.5-107.el5_9.8 | < 0:2.12-1.107.el6_4.7 | < 0:2.12-1.132.el6_5.5 | < 0:2.12-1.47.el6_2.15 | < 0:2.3.4-2.57.el4.2
glibc-debuginfo-common< 0:2.5-123.el5_11.1 | < 0:2.12-1.149.el6_6.5 | < 0:2.17-55.el7_0.5 | < 0:2.5-58.el5_6.6 | < 0:2.5-107.el5_9.8 | < 0:2.12-1.107.el6_4.7 | < 0:2.12-1.132.el6_5.5 | < 0:2.12-1.47.el6_2.15 | < 0:2.3.4-2.57.el4.2

Show all 12

Oracle11 products

communications_application_session_controller< 3.7.1
communications_eagle_application_processor16.0
communications_eagle_lnp_application_processor10.0
communications_lsms13.1
communications_policy_management9.7.3 | 9.9.1 | 10.4.1 | 11.5 | 12.1.1

Show all 11

Debian3 products

eglibc< 2.11.3-4+deb6u4
glibc< 2.18-1
debian_linuxEOL7.0 | 8.0

Ibm2 products

pureapplication_system1.0.0.0 | 1.1.0.0 | 2.0.0.0
security_access_manager_for_enterprise_single_sign-on8.2

Apple1 product

mac_os_x< 10.11.1

Gnu1 product

glibc≥ 2.0, < 2.18

Php1 product

php≥ 5.4.0, < 5.4.38 | ≥ 5.5.0, < 5.5.22 | ≥ 5.6.0, < 5.6.6

Ubuntu1 product

eglibc< 2.19-0ubuntu6

8 vendors · 32 products

References

111 links

www.securityfocus.com/bid/72325VDB EntryX Refsource BIDThird Party Advisory
marc.info?l=bugtraq&m=142296726407499&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21696131X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62883Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62691Third Party AdvisoryX Refsource SECUNIANot Applicable
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRMThird Party Advisory
lists.apple.com/archives/security-announce/2015/Oct/msg00005.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
packetstormsecurity.com/files/130974/Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
support.apple.com/HT205375X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=142722450701342&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory

Show all 100 references

seclists.org/oss-sec/2015/q1/269Mailing ListX Refsource BUGTRAQThird Party Advisory
www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0X Refsource CONFIRMBroken LinkPermissions Required
secunia.com/advisories/62698Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62640Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securitytracker.com/id/1032909VDB EntryX Refsource SECTRACKThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlX Refsource CONFIRMPatchThird Party Advisory
bto.bluecoat.com/security-advisory/sa90X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21696618X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21696600X Refsource CONFIRMThird Party Advisory
www.idirect.net/Partners/~/media/Files/CVE/iDirect-Posted-Common-Vulnerabilities-and-Exposures.pdfX Refsource CONFIRMBroken LinkURL Repurposed
lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlX Refsource CONFIRMThird Party Advisory
www.sophos.com/en-us/support/knowledgebase/121879.aspxX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62688Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62865Third Party AdvisoryX Refsource SECUNIANot Applicable
www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21696243X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=142721102728110&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
lists.apple.com/archives/security-announce/2015/Jun/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10100X Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlX Refsource CONFIRMPatchThird Party Advisory
secunia.com/advisories/62812Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62879Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=bugtraq&m=142781412222323&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
linux.oracle.com/errata/ELSA-2015-0090.htmlX Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62871Third Party AdvisoryX Refsource SECUNIANot Applicable
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRMPatchThird Party Advisory
secunia.com/advisories/62690Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62692Third Party AdvisoryX Refsource SECUNIANot Applicable
support.apple.com/HT205267X Refsource CONFIRMThird Party Advisory
help.ecostruxureit.com/display/…X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62681Third Party AdvisoryX Refsource SECUNIANot Applicable
kb.juniper.net/InfoCenter/index?page=content&id=JSA10671X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21696526X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62667Third Party AdvisoryX Refsource SECUNIANot Applicable
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04874668X Refsource CONFIRMThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2015:039Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.f-secure.com/en/web/labs_global/fsc-2015-1X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21696602X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62517Third Party AdvisoryX Refsource SECUNIANot Applicable
support.apple.com/kb/HT204942X Refsource CONFIRMThird Party Advisory
blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21695695X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62680Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62813Third Party AdvisoryX Refsource SECUNIANot Applicable
packetstormsecurity.com/files/…X Refsource MISCThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/201503-04Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghostVendor AdvisoryX Refsource CISCOThird Party Advisory
www.securityfocus.com/bid/91787VDB EntryX Refsource BIDThird Party Advisory
packetstormsecurity.com/files/130171/Exim-ESMTP-GHOST-Denial-Of-Service.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
rhn.redhat.com/errata/RHSA-2015-0126.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlX Refsource CONFIRMPatchThird Party Advisory
www.securityfocus.com/archive/1/534845/100/0/threadedMailing ListX Refsource BUGTRAQExploitThird Party AdvisoryVDB Entry
secunia.com/advisories/62715Third Party AdvisoryX Refsource SECUNIANot Applicable
www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txtX Refsource MISCThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21695835X Refsource CONFIRMThird Party Advisory
seclists.org/oss-sec/2015/q1/274Mailing ListX Refsource BUGTRAQExploitThird Party Advisory
marc.info?l=bugtraq&m=143145428124857&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
seclists.org/fulldisclosure/2015/Jan/111Mailing ListX Refsource FULLDISCThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21695774X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/62870Third Party AdvisoryX Refsource SECUNIANot Applicable
security.netapp.com/advisory/ntap-20150127-0001/X Refsource CONFIRMThird Party Advisory
linux.oracle.com/errata/ELSA-2015-0092.htmlX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21695860X Refsource CONFIRMThird Party Advisory
www.debian.org/security/2015/dsa-3142Vendor AdvisoryX Refsource DEBIANThird Party Advisory
community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerabilityX Refsource MISCThird Party AdvisoryARTICLE
secunia.com/advisories/62816Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/62758Third Party AdvisoryX Refsource SECUNIANot Applicable
seclists.org/fulldisclosure/2019/Jun/18Mailing ListX Refsource FULLDISCExploitThird Party Advisory
seclists.org/bugtraq/2019/Jun/14Mailing ListX Refsource BUGTRAQExploitThird Party Advisory
packetstormsecurity.com/files/…X Refsource MISCExploitThird Party AdvisoryVDB Entry
cert-portal.siemens.com/productcert/pdf/ssa-994726.pdfX Refsource CONFIRMThird Party Advisory
www.openwall.com/lists/oss-security/2021/05/04/7Mailing ListX Refsource MLISTExploit
seclists.org/fulldisclosure/2021/Sep/0Mailing ListX Refsource FULLDISCExploitThird Party Advisory
packetstormsecurity.com/files/…X Refsource MISCExploitThird Party AdvisoryVDB Entry
www.arista.com/en/support/advisories-notices/security-advisories/1053-security-advisory-9X Refsource MISCThird Party Advisory
seclists.org/fulldisclosure/2022/Jun/36Mailing ListX Refsource FULLDISCExploitThird Party Advisory
packetstormsecurity.com/files/…X Refsource MISCExploitThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2015:0090Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1183461REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0090.jsonAdvisory
access.redhat.com/security/cve/CVE-2015-0235REPORT
access.redhat.com/security/vulnerabilities/ghostARTICLE
www.cve.org/CVERecord?id=CVE-2015-0235AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2015-0235Advisory
www.openwall.com/lists/oss-security/2015/01/27/9ARTICLE
access.redhat.com/articles/1332213ARTICLE

Showing 100 of 111.