CVE-2015-7547

What it actually does

Stack-based buffer overflows in send_dg and send_vc functions of libresolv allow remote code execution or denial of service when getaddrinfo is called with AF_UNSPEC or AF_INET6 during dual A/AAAA DNS queries.

Why it matters to the business

Affected Linux systems and dependent applications face remote crashes or full compromise, risking service outages, data breaches, and operational disruption across enterprise and cloud environments with high ecosystem prevalence.

How an attack unfolds

An attacker supplies a crafted DNS response that triggers the overflow when a vulnerable application invokes getaddrinfo; high EPSS and public exploit maturity enable rapid weaponization by threat actors for initial access or denial of service.

How to fix it

Upgrade glibc to version 2.23 or newer on all affected distributions; rebuild and restart services linked against the vulnerable library.

How to confirm the fix worked

Confirm installed glibc version meets or exceeds 2.23; perform functional testing of DNS resolution with mixed IPv4/IPv6 queries and review build logs for updated NSS modules.

Typical attack path

1. Position malicious DNS resolver or intercept legitimate responses
2. Send oversized or malformed DNS packet during address resolution
3. Trigger getaddrinfo call with AF_UNSPEC or AF_INET6
4. Overflow stack buffer in libresolv leading to crash or code execution

How to detect it

Review application and system logs for segmentation faults or crashes during DNS lookups; inspect network captures for unusually large or malformed DNS responses targeting resolver traffic.

What your security team should do

• Prioritize patching glibc across all Linux hosts given high EPSS and exploit availability
• Inventory and update downstream packages that depend on the affected library
• Implement network controls to limit exposure of DNS resolvers until patches are deployed