CVE-2018-19591
- State
- Published
- Severity
- 7.5 High
- Published
- Dec 4, 2018
- Updated
- Oct 14, 2026
- Reserved
- Nov 26, 2018
Description
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-404 Improper Resource Shutdown or Release
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD
- FEDORA-2018-f6b7df660dvendor-advisory
- 106037vdb-entry
- https://sourceware.org/bugzilla/show_bug.cgi?id=23927
- FEDORA-2018-060302dc83vendor-advisory
- GLSA-201903-09vendor-advisory
- 1042174vdb-entry
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408
- https://security.netapp.com/advisory/ntap-20190321-0003/
- GLSA-201908-06vendor-advisory
- USN-4416-1vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.