CVE-2024-33602

The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

References

Affected packages

Debian:11 / glibc

Package

Name: glibc
Purl: pkg:deb/debian/glibc?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.31-13+deb11u10

Affected versions

2.*

2.31-13

2.31-13+deb11u1

2.31-13+deb11u2

2.31-13+deb11u3

2.31-13+deb11u4

2.31-13+deb11u5

2.31-13+deb11u6

2.31-13+deb11u7

2.31-13+deb11u8

2.31-13+deb11u9

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / glibc

Package

Name: glibc
Purl: pkg:deb/debian/glibc?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.36-9+deb12u7

Affected versions

2.*

2.36-9

2.36-9+deb12u1

2.36-9+deb12u2

2.36-9+deb12u3

2.36-9+deb12u4

2.36-9+deb12u5

2.36-9+deb12u6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / glibc

Package

Name: glibc
Purl: pkg:deb/debian/glibc?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.37-19

Affected versions

2.*

2.36-9

2.36-9+loong64

2.36-10~0

2.37-1

2.37-2

2.37-3

2.37-4

2.37-5

2.37-6

2.37-7

2.37-8

2.37-9

2.37-10

2.37-11

2.37-12

2.37-13

2.37-14

2.37-15~deb13u1

2.37-15

2.37-15.1

2.37-15.1+sh4

2.37-16

2.37-17

2.37-18

Ecosystem specific

{
    "urgency": "not yet assigned"
}