CVE-2015-20109

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-25 · updated 2026-06-17
Weakness: CWE-120

Description

end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue.

Affected products

GNU C Library (glibc): before 2.22 — fixed in 2.22

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.22. Check the vendor advisory for mitigations.

References

https://security.netapp.com/advisory/ntap-20230731-0009/
https://sourceware.org/bugzilla/show_bug.cgi?id=18036
https://security.netapp.com/advisory/ntap-20230731-0009/
https://sourceware.org/bugzilla/show_bug.cgi?id=18036

Get alerted when CVE-2015-20109 or the next vulnerability affects your stack