CVE-2015-1781

CVE-2015-1781 is a medium-severity vulnerability in Suse Linux Enterprise Debuginfo with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.8)
• EPSS exploit prediction: 5% (92nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Suse Linux Enterprise Debuginfo
• Published: 2015-09-28
• Last modified: 2026-06-17

Description

Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

Frequently asked questions

What is CVE-2015-1781?

Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

How severe is CVE-2015-1781?

CVE-2015-1781 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2015-1781 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-1781?

CVE-2015-1781 primarily affects Suse Linux Enterprise Debuginfo. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-1781?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-1781 published?

CVE-2015-1781 was published on 2015-09-28 and last updated on 2026-06-17.

References

• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html
• http://www.debian.org/security/2016/dsa-3480
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/74255
• http://www.securitytracker.com/id/1032178
• http://www.ubuntu.com/usn/USN-2985-1
• http://www.ubuntu.com/usn/USN-2985-2
• https://rhn.redhat.com/errata/RHSA-2015-0863.html
• https://security.gentoo.org/glsa/201602-02
• https://sourceware.org/bugzilla/show_bug.cgi?id=18287
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=2959eda9272a03386
• https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html

Affected products (12)

• cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*
• cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
• cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*
• cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

More vulnerabilities in Suse Linux Enterprise Debuginfo

• CVE-2017-18017 — Critical (CVSS 9.8): The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before…
• CVE-2017-14491 — Critical (CVSS 9.8): Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or…
• CVE-2016-5772 — Critical (CVSS 9.8): Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37,…
• CVE-2016-5118 — Critical (CVSS 9.8): The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute…
• CVE-2016-0718 — Critical (CVSS 9.8): Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a…
• CVE-2015-8779 — Critical (CVSS 9.8): Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows…

All CVEs affecting Suse Linux Enterprise Debuginfo →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-77946 — Critical (CVSS 10.0): A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function…
• CVE-2026-76008 — Critical (CVSS 10.0): A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file…
• CVE-2026-75784 — Critical (CVSS 10.0): A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of…
• CVE-2026-74843 — Critical (CVSS 10.0): A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function…
• CVE-2026-16367 — Critical (CVSS 10.0): Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox…
• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →