CVE-2015-7547

Published: Feb 18, 2016Updated: May 6, 2026 Sources: CVE List NVD BDU csafCWE-119

8.1HIGH

NVD MITRE

Description

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

In plain language

AI Worth attention

CVE-2015-7547 is a glibc (libc6) security bug (in versions older than 2.23) that lets attackers send a specially crafted DNS reply to crash services or, more rarely, potentially run malicious code—if your server uses DNS lookups over the network with IPv6-capable settings. Most small businesses should act if this machine is internet-facing or performs network DNS resolution.

Executive summary

CVE-2015-7547 is a set of stack-based buffer overflows in glibc’s libresolv functions (send_dg/send_vc) in libc6 before 2.23, triggered by a specially crafted DNS response during getaddrinfo resolution for IPv6/dual-stack DNS behavior; it can be reached over the network with no authentication or user interaction.

If affected, business impact

Service crashes and outagesPossible remote code executionSecurity incident risk

What to do now

Check the glibc/libc6 version on each affected machine (you need libc6/glibc older than 2.23 to be at risk).
Verify whether the machine performs DNS lookups in normal operation (especially IPv6/dual-stack address resolution) and whether it can receive network traffic from untrusted sources.
Upgrade glibc/libc6 to version 2.23 or higher on all hosts that run the vulnerable glibc.
Re-test: restart services that use name resolution and confirm normal operation after the upgrade.

Patch / advisory Some work to apply

What is it

Your system uses a core library (glibc/libc6) to translate names (like web addresses) into network addresses. This bug can be triggered by a malicious DNS reply that looks normal enough to pass through, but is specially crafted to overflow internal buffers. The most common outcome is the service crashing (denial of service); in rarer cases, the attacker could potentially run code on the machine.

Who is affected

This matters to you if you run a Linux system using GNU C Library (glibc / libc6) version older than 2.23, including common distro packages such as Debian/Ubuntu (and similar enterprise/unified offerings listed).

The risk is relevant because it is reachable over the network in default configuration, without authentication or user interaction. Practically, it’s most urgent for machines that receive untrusted network traffic and perform DNS resolution with IPv6-capable/dual-stack behavior (e.g., typical server name lookups).

How urgent is it

Attackers can exploit this remotely by sending crafted DNS responses, and it’s reachable in default configuration—so exposed systems are at real risk. Because the system impact ranges from crashes to possible code execution and public exploits exist, you should treat this as an immediate patching priority for affected hosts.

Overall urgency is AMBER: act quickly, starting with internet-facing systems and anything that does DNS lookups over IPv6/dual-stack.

What to do — in detail

Confirm exposure

On each relevant server, check the installed glibc/libc6 version.
- Debian/Ubuntu-style systems (typical): run dpkg -l | grep -E '^ii\s+libc6\s'
- Another common approach: ldd --version (shows the glibc version).
If the version is older than 2.23, the host is affected.

Identify where it matters most

Identify services that do DNS resolution as part of normal operation (for example: web servers/proxies, mail services, VPN/UTM, internal components that resolve names, or anything resolving clients/targets using getaddrinfo with IPv6/dual-stack behavior).
Prioritize systems that are reachable from the internet or untrusted networks.

Upgrade / remediation (the fix)

Upgrade glibc/libc6 to 2.23 or higher.
- Follow your Linux vendor’s recommended update process (package update/upgrade) because glibc is tightly integrated with the OS.
After upgrading, restart the services that use DNS/name resolution.

If you can’t patch immediately (workaround)

Reduce exposure by limiting which external parties can influence DNS responses:
- Ensure DNS resolution is done via trusted resolvers under your control.
- Where possible, restrict outbound DNS traffic and monitor for unusual DNS activity.
- If your environment supports it, temporarily limit IPv6/dual-stack DNS resolution paths on affected services until patched (do this only if your operations can tolerate it).

What to monitor

Watch for:
- Service crashes/restarts related to name resolution.
- Unexpected DNS query patterns from hosts (especially around IPv6/AAAA lookups).
- System logs for errors around DNS resolution during time windows when network traffic occurred.

Timing guidance

CVE-2015-7547 is not listed in CISA KEV, but public exploits exist; patch affected hosts as soon as possible, prioritizing internet-facing and DNS-heavy systems.

Technical context

Severity and what it does

CVE-2015-7547 is a high-impact glibc issue (CWE-119) that can lead to denial of service (crash) and possibly remote code execution. The triggering behavior is a crafted DNS response that causes glibc’s libresolv code paths (send_dg/send_vc) to overflow stack buffers during getaddrinfo-based address resolution.

Attack vector and reachability

Remote / network-reachable, with no authentication and no user interaction.
Affected condition: the system must have glibc/libc6 older than 2.23.
Findings indicate it is reachable in default configuration.

Exploitation status

Public exploits are available (multiple known), and press attention is rising.
KEV is not listed here, so this is not described as confirmed KEV exploitation in the provided findings.

Fix

The provided patch guidance points to updating glibc to 2.23 or higher (vendor remediation references are included in the findings).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.