CVE-2023-4527

Name of the Vulnerable Software and Affected Versions glibc (affected versions not specified)

Description A flaw was found in glibc. When the getaddrinfo function is called with the AF UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. The issue is related to reading data beyond the buffer boundaries in memory, which can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.