CVEs / CVE-2015-7547

CVE-2015-7547: n/a n/a vulnerability

high 8.1 CVSS 3.0 (NVD)
EPSS 92.3% chance of exploitation in the next 30 days, higher than 99% of CVEs (1 Nov 2026)
Last changed at its sources 17 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2015-7547

Description

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
The CVE record, via NVD · published 18 Feb 2016 · NVD status: Modified

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a n/a	n/a	—

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.

Severity

CVSS 3.0	8.1 high `CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` Scored by NVD
Weakness	CWE-119

References

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.