CVE-2018-19591

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

Affected products

Alt Linux, Ubuntu, Glibc

Gnu Glibc

≤ 2.28

CVSS 3.0

7.5 HIGH

EPSS

5.5% (92th percentile)

Weakness

CWE-404, CWE-20

NVD status

Modified

Published

2018-12-04

No exploit for CVE-2018-19591 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.