PatchTheCVEuclibc-ng vulnerabilities and fixes
Recent CVEs affecting uclibc-ng, with upgrade or downgrade steps. 3 tracked.
Also searched as: uclibc ng.
uclibc-ng has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-09-29. Highest priority: CVE-2022-29503 (score 67/100).
- CVE-2022-29503 CRITICAL 9.8 DOWNGRADE DOWNGRADE A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and u
- CVE-2021-43523 CRITICAL 9.6 UPGRADE UPGRADE In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DN
- CVE-2021-27419 HIGH 7.3 UPGRADE uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple
FAQ
How do I fix uclibc-ng vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is uclibc-ng being exploited right now?
None of the tracked uclibc-ng CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which uclibc-ng CVE should I patch first?
CVE-2022-29503 currently ranks highest (67/100): A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and u.