CVE-2015-20109
glibc: end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-...
CVE-2015-20109 is fixed in glibc on 1 platform, first by DEBIAN-CVE-2015-20109, released June 25, 2023. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.5
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0032
24th percentile
end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| glibc · Debian 12.15 (bookworm) | 2.22-1 | DEBIAN-CVE-2015-20109 | Jun 25, 2023 |
| glibc · Debian 13.5 (trixie) | 2.22-1 | DEBIAN-CVE-2015-20109 | Jun 25, 2023 |
| glibc · Debian 14 | 2.22-1 | DEBIAN-CVE-2015-20109 | Jun 25, 2023 |