ubuntu.com Open in urlscan Pro
2620:2d:4000:1::28  Public Scan

Form analysis
1 forms found in the DOM

/search

<form action="/search" class="p-search-box is-light">
  <input type="search" class="p-search-box__input" name="q" placeholder="Search our sites" required="" aria-label="Search our sites">
  <button type="reset" class="p-search-box__reset">
    <i class="p-icon--close"></i>
  </button>
  <button type="submit" class="p-search-box__button">
    <i class="p-icon--search"></i>
  </button>
</form>

Text Content

Skip to main content
Canonical Ubuntu
 * 
 * Menu

 * Products
 * Use cases
 * Support
 * Community
 * Get Ubuntu
 * All Canonical
   * Back
   * Products
     * Back
     * Canonical
     * Ubuntu
     * Ubuntu Pro
     * Snapcraft
     * LXD
     * MAAS
     * OpenStack
     * Ceph
     * Kubernetes
     * Juju
   * Also from Canonical
     * Back
     * Anbox Cloud
     * Launchpad
     * Ubuntu on public clouds
     * Multipass
     * Cloud-init
     * Landscape
     * Netplan
     * Charmed Kubeflow
     * MicroCloud
   * About
     * Back
     * Canonical
     * Press centre
     * Careers
     * Blog
     * Documentation
     * Resources
     * Partners
     * Contact us
 * Sign in
 * 





 * Canonical
   
   Get to know Canonical, the company behind the products.

 * Ubuntu
   
   The world's favourite Linux OS for servers, desktops and IoT.

 * Ubuntu Pro
   
   One subscription for security maintenance, support, FIPS and other compliance
   certifications.

 * Snapcraft
   
   The app store for Linux: secure packages and ultra-reliable updates.

 * LXD
   
   A pure-container hypervisor. Run system containers and VMs at scale.

 * MAAS
   
   Build a bare metal cloud with super fast server provisioning.

 * OpenStack
   
   Upgrades, maintenance, support, and fully managed options for long-term,
   low-cost infra.

 * Ceph
   
   Software-defined storage that lowers your total cost of ownership.

 * Kubernetes
   
   App portability for K8s on VMware, Amazon, Azure, Google, Oracle, IBM and
   bare metal.

 * Juju
   
   Deploy, integrate and manage applications at any scale, on any
   infrastructure.

--------------------------------------------------------------------------------

Also from Canonical
Anbox Cloud

Stream Android applications to any device.

Launchpad

The software collaboration platform behind Ubuntu.

Ubuntu on public clouds

Optimised Ubuntu for public clouds.

Multipass

Spin up Ubuntu VMs on Windows, Mac and Linux.

Cloud-init

Control and customise your cloud instances.

Landscape

Systems management and security patching for Ubuntu.

Netplan

Simplify and standardise complex network configuration.

Charmed Kubeflow

AI and MLOps at any scale, on any cloud.

MicroCloud

Deploy a fully functional cloud in minutes.

--------------------------------------------------------------------------------

About
 * Canonical
 * Press centre
 * Careers
 * Blog
 * Documentation
 * Resources
 * Partners
 * Contact us


Security
 * ESM
 * Livepatch
 * Certifications & Hardening
 * CVEs
 * Notices
 * Docker Images

Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and
upcoming events where you can meet our team.Close


CVE-2023-4806

Published: 18 September 2023

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo
function may access memory that has been freed, resulting in an application
crash. This issue is only exploitable when a NSS module implements only the
_nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the
_nss_*_gethostbyname3_r hook. The resolved name should return a large number of
IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6
address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.


NOTES

AuthorNote

Priority reason:
No known NSS modules expose the vulnerability

mdeslaur

This is only an issue when using an NSS module with a very
specific behaviour. There are no known NSS modules which are
implemented this way.

The fix for this issue introduced a leak, identified as
CVE-2023-5156 which was later fixed with a subsequent commit.

Older releases require backporting a dozen refactoring commits.

ccdm94

One of the refactoring commits needed to fix this issue is also
the fix for CVE-2023-4813.


PRIORITY

Low


CVSS 3 SEVERITY SCORE

5.9

Score breakdown


STATUS

Package Release Status eglibc
Launchpad, Ubuntu, Debian bionic Does not exist


focal Does not exist


jammy Does not exist


lunar Does not exist


mantic Does not exist


noble Does not exist


trusty Needs triage


upstream Needs triage


xenial Does not exist


glibc
Launchpad, Ubuntu, Debian bionic

Released (2.27-3ubuntu1.6+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) focal

Released (2.31-0ubuntu9.14)
jammy

Released (2.35-0ubuntu3.5)
lunar

Released (2.37-0ubuntu2.2)
mantic

Released (2.38-1ubuntu5)
noble

Released (2.38-1ubuntu5)
trusty Ignored

(end of standard support)
upstream Needs triage


xenial

Released (2.23-0ubuntu11.3+esm5)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) Patches:
upstream:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=973fe93a5675c42798b2161c6f29c01b0e243994
upstream:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=00ae4f10b504bc4564e9f22f00907093f1ab9338
upstream:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6529a7466c935f36e9006b854d6f4e1d4876f942
upstream:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a9728f798ec7f05454c95637ee6581afaa9b487d
upstream:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e3ccb230a961b4797510e6a1f5f21fd9021853e7
upstream:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e09ee267c03e3150c2c9ba28625ab130705a485e



SEVERITY SCORE BREAKDOWN

Parameter Value Base score 5.9 Attack vector Network Attack complexity High
Privileges required None User interaction None Scope Unchanged Confidentiality
None Integrity impact None Availability impact High Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H


REFERENCES

 * https://ubuntu.com/security/notices/USN-6541-1
 * https://ubuntu.com/security/notices/USN-6541-2
 * https://www.cve.org/CVERecord?id=CVE-2023-4806
 * NVD
 * Launchpad
 * Debian


BUGS

 * https://sourceware.org/bugzilla/show_bug.cgi?id=30843


JOIN THE DISCUSSION

 * Ubuntu security updates mailing list
 * Security announcements mailing list


CANONICAL IS OFFERING EXPANDED SECURITY MAINTENANCE

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security
fixes and essential packages.

Find out more about ESM ›


FURTHER READING

 * An overview of machine learning security risks
 * What’s new in security for Ubuntu 24.04 LTS?
 * Canonical at America Digital Congress in Chile
 * Canonical’s showcase at HPE Tech Jam 2024
 * Ubuntu Explained: How to ensure security and stability in cloud
   instances—part 3

Back to top


 * CANONICAL OPENSTACK CANONICAL OPENSTACK
   
   * What is OpenStack
   * Features
   * Managed
   * Consulting
   * Install
   * Support


 * CANONICAL CEPH CANONICAL CEPH
   
   * What is Ceph
   * Managed
   * Consulting
   * Docs
   * Install


 * MANAGED MANAGED
   
   * OpenStack
   * Kubernetes
   * Ceph
   * Apps
   * Observability
   * Firefighting


 * CANONICAL KUBERNETES CANONICAL KUBERNETES
   
   * What is Kubernetes
   * Charmed Kubernetes
   * Managed
   * Install
   * Docs
   * Resources


 * AI / ML AI / ML
   
   * MLOps
   * Kubeflow
   * MLflow
   * Consulting


 * ROBOTICS ROBOTICS
   
   * ROS ESM
   * What is ROS
   * Community
   * Docs


 * CLOUD CLOUD
   
   * What is cloud computing
   * What is private cloud
   * What is hybrid cloud
   * What is multi-cloud
   * Public cloud


 * IOT IOT
   
   * App store
   * Embedded Linux
   * Management


 * UBUNTU CORE UBUNTU CORE
   
   * Features
   * Success stories
   * Services
   * Docs


 * UBUNTU DESKTOP UBUNTU DESKTOP
   
   * Organisations
   * Developers
   * Flavours
   * WSL


 * UBUNTU SERVER UBUNTU SERVER
   
   * Hyperscale
   * Docs


 * SECURITY SECURITY
   
   * ESM
   * Livepatch
   * Certifications & Hardening
   * CVEs
   * Notices
   * Docker Images


 * DOWNLOADS DOWNLOADS
   
   * Desktop
   * Server
   * Core
   * Cloud


 * OBSERVABILITY OBSERVABILITY
   
   * What is observability
   * Managed


 * APPLIANCE APPLIANCE
   
   * About
   * Portfolio
   * Community
   * Hardware
   * Virtual machines


 * SUPPORT SUPPORT
   
   * Your subscriptions
   * Account users
   * Pricing
   * Discourse


 * PRICING PRICING
   
   * Consulting
   * Desktops
   * Devices


 * SECTORS
   
   * Automotive
   * Industrial
   * Government
   * Telco
   * Finance
 * * Containers
   * Tutorials
   * 16-04
   * Software partnerships
   * Landscape
   * Canonical Embedding Programme

--------------------------------------------------------------------------------

 * Contact us
 * Contact us
 * About us
 * Community
 * Careers
 * Blog
 * Resources
 * Press centre

© 2024 Canonical Ltd. Ubuntu and Canonical are registered trademarks of
Canonical Ltd.

 * Legal information
 * Data privacy
 * Manage your tracker settings
 * Report a bug on this site

 * 
 * 
 * 
 * 
 * 

Go to the top of the page



YOUR TRACKER SETTINGS

We use cookies and similar methods to recognise visitors and remember
preferences. We also use them to measure campaign effectiveness and analyse site
traffic.

By selecting ‘Accept‘, you consent to the use of these methods by us and trusted
third parties.

For further details or to change your consent choices at any time see our cookie
policy.

Accept all and visit site Manage your tracker settings