CVE-2015-0235
CriticalPublic exploitHeap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Published May 5, 2021 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2015-0235, DLA-139-1, GHOST glibc, UBUNTU-CVE-2015-0235, glibc GHOST
Key Facts
Patch immediately- CVE-2015-0235 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Glibc (Gnu), Pureapplication System (Ibm), Security Access Manager For Enterprise Single Sign-On (Ibm) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 95% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache2-mod_php5 5.6.28-1.1, apache2-mod_php7 7.0.14-1.4, Mac OS X 10.11.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
95%
Higher than 99.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2015-0235 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Heap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Affected Products
439 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GlibcGnu | See advisory | 2.18 |
| Pureapplication SystemIbm | 1.0.0.0, 1.1.0.0, 2.0.0.0 | n/a |
| Security Access Manager For Enterprise Single Sign-OnIbm | 8.2 | n/a |
| Communications Application Session ControllerOracle | See advisory | 3.7.1 |
| Communications Eagle Application ProcessorOracle | 16.0 | n/a |
Patched Releases
apache2-mod_php5
5.6.28-1.1
apache2-mod_php7
7.0.14-1.4
Mac OS X
10.11.1
eglibc
2.11.3-4+deb6u4, 2.13-38+deb7u7
Glibc
0:2.12-1.132.el6_5.5, 0:2.17-55.el7_0.5, 0:2.3.4-2.57.el4.2, 0:2.5-107.el5_9.8, 2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14, 2.12-1.149.el6_6.5, 2.12-1.212.el6_10.3+sp999, 2.17-55.0.4.el7_0.5, 2.17-55.93.amzn1, 2.18-1, 2.5-123.0.1.el5_11.1, 2.18
glibc-32bit
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-common
2.12-1.149.el6_6.5, 2.17-55.0.4.el7_0.5, 2.17-55.93.amzn1, 2.5-123.0.1.el5_11.1
glibc-debuginfo-common
2.17-55.93.amzn1
glibc-devel
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14, 2.12-1.149.el6_6.5, 2.17-55.0.4.el7_0.5, 2.17-55.93.amzn1, 2.5-123.0.1.el5_11.1
glibc-devel-32bit
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-headers
2.12-1.149.el6_6.5, 2.17-55.0.4.el7_0.5, 2.17-55.93.amzn1, 2.5-123.0.1.el5_11.1
glibc-html
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-i18ndata
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-info
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-locale
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-locale-32bit
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-locale-x86
2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-profile
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-profile-32bit
2.11.1-0.58.1, 2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-profile-x86
2.11.3-17.45.49.1, 2.11.3-17.72.14
glibc-static
2.12-1.149.el6_6.5, 2.17-55.0.4.el7_0.5, 2.17-55.93.amzn1
glibc-utils
2.12-1.149.el6_6.5, 2.17-55.0.4.el7_0.5, 2.17-55.93.amzn1, 2.5-123.0.1.el5_11.1
glibc-x86
2.11.3-17.45.49.1, 2.11.3-17.72.14
libxcrypt
3.0.3-0.4.1
libxcrypt-32bit
3.0.3-0.4.1
Timeline
Publicly disclosed
May 5, 2021
Last updated
Aug 4, 2026
Weakness Type
- CWE-122 Heap-based Buffer Overflow
- CWE-131 Incorrect Calculation of Buffer Size
- CWE-787 Out-of-bounds Write
References
- advisoryhttp://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/
- advisoryhttp://linux.oracle.com/errata/ELSA-2015-0090.html
- advisoryhttp://linux.oracle.com/errata/ELSA-2015-0092.html
- advisoryAPPLE-SA-2015-06-30-2
- advisoryAPPLE-SA-2015-10-21-4
FAQ
Common Questions.
Heap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Affected: Glibc (Gnu); Pureapplication System (Ibm) versions 1.0.0.0, 1.1.0.0, 2.0.0.0; Security Access Manager For Enterprise Single Sign-On (Ibm) versions 8.2, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including apache2-mod_php5 5.6.28-1.1, apache2-mod_php7 7.0.14-1.4, Mac OS X 10.11.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2015-0235 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo