CVE-2015-0235

Key facts

CVSS score

10.0 (v2.0)

Severity

HIGH

CVSS vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness (CWE)

CWE-787

EPSS score

94.6% (100th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2015-0257)

Published

January 28, 2015

NVD last modified

June 17, 2026

Status

Modified

Affected products

• apple / mac os x
• debian / debian linux
• debian / debian linux
• gnu / glibc
• ibm / pureapplication system
• ibm / pureapplication system
• ibm / pureapplication system
• ibm / security access manager for enterprise single sign-on
• oracle / communications application session controller
• oracle / communications eagle application processor
• oracle / communications eagle lnp application processor
• oracle / communications lsms
• oracle / communications policy management
• oracle / communications policy management
• oracle / communications policy management
• oracle / communications policy management
• oracle / communications policy management
• oracle / communications session border controller
• oracle / communications session border controller
• oracle / communications session border controller
• oracle / communications user data repository
• oracle / communications webrtc session controller
• oracle / communications webrtc session controller
• oracle / communications webrtc session controller
• oracle / exalogic infrastructure
• oracle / exalogic infrastructure
• oracle / linux
• oracle / linux
• oracle / vm virtualbox
• php / php
• redhat / virtualization

Certified products that may be affected

6 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Oracle Linux Unbreakable Enterprise Kernel (UEK 5) Cryptographic Module - Oracle Corporation - FIPS 140 3893 - historical
• IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 - IBM Corporation - Common Criteria BSI-DSZ-CC-0683-2014 - archived
• Apple Mac OS X 10.6 - Apple Inc. - Common Criteria BSI-DSZ-CC-0536-2010 - archived
• Oracle Enterprise Linux Version 5 Update 1 - Oracle Corporation - Common Criteria BSI-DSZ-CC-0481-2008 - archived
• Oracle Enterprise Linux Version 4 Update 5 - Oracle Corporation - Common Criteria BSI-DSZ-CC-0468-2007 - archived

See all 6 in the Security Certifications Explorer.

References

• http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/(Third Party Advisory)
• http://linux.oracle.com/errata/ELSA-2015-0090.html(Third Party Advisory)
• http://linux.oracle.com/errata/ELSA-2015-0092.html(Third Party Advisory)
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html(Mailing List, Third Party Advisory)
• http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html(Mailing List, Third Party Advisory)
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html(Mailing List, Third Party Advisory)
• http://marc.info/?l=bugtraq&m=142296726407499&w=2(Issue Tracking, Mailing List, Third Party Advisory)
• http://marc.info/?l=bugtraq&m=142721102728110&w=2(Issue Tracking, Mailing List, Third Party Advisory)
• http://marc.info/?l=bugtraq&m=142722450701342&w=2(Issue Tracking, Mailing List, Third Party Advisory)
• http://marc.info/?l=bugtraq&m=142781412222323&w=2(Issue Tracking, Mailing List, Third Party Advisory)
• http://marc.info/?l=bugtraq&m=143145428124857&w=2(Issue Tracking, Mailing List, Third Party Advisory)
• http://packetstormsecurity.com/files/130171/Exim-ESMTP-GHOST-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html(Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/130974/Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html(Exploit, Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html(Exploit, Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html(Exploit, Third Party Advisory, VDB Entry)
• http://rhn.redhat.com/errata/RHSA-2015-0126.html(Third Party Advisory)
• http://seclists.org/fulldisclosure/2015/Jan/111(Mailing List, Third Party Advisory)
• http://seclists.org/fulldisclosure/2019/Jun/18(Exploit, Mailing List, Third Party Advisory)
• http://seclists.org/fulldisclosure/2021/Sep/0(Exploit, Mailing List, Third Party Advisory)
• http://seclists.org/fulldisclosure/2022/Jun/36(Exploit, Mailing List, Third Party Advisory)
• http://seclists.org/oss-sec/2015/q1/269(Mailing List, Third Party Advisory)
• http://seclists.org/oss-sec/2015/q1/274(Exploit, Mailing List, Third Party Advisory)
• http://secunia.com/advisories/62517(Not Applicable)
• http://secunia.com/advisories/62640(Not Applicable)
• http://secunia.com/advisories/62667(Not Applicable)
• http://secunia.com/advisories/62680(Not Applicable)
• http://secunia.com/advisories/62681(Not Applicable)
• http://secunia.com/advisories/62688(Not Applicable)
• http://secunia.com/advisories/62690(Not Applicable)
• http://secunia.com/advisories/62691(Not Applicable)
• http://secunia.com/advisories/62692(Not Applicable)
• http://secunia.com/advisories/62698(Not Applicable)
• http://secunia.com/advisories/62715(Not Applicable)
• http://secunia.com/advisories/62758(Not Applicable)
• http://secunia.com/advisories/62812(Not Applicable)
• http://secunia.com/advisories/62813(Not Applicable)
• http://secunia.com/advisories/62816(Not Applicable)
• http://secunia.com/advisories/62865(Not Applicable)