4 ms·

The upstream patch is dated "Mon, 21 Jan 2013". Does this affect Redhat and Debian because they use older glibc versions and didn't backport this fix?

• 0x0 12y ago
  yes
  • eslaught 12y ago
    What versions are affected? E.g. Ubuntu 14.04 appears to be on 2.19-0ubuntu6.5 (just updated). Does that include the fix?
    • phoboslab 12y ago
      You can check the libc version with: dpkg -s libc6 For my Debian 7 servers it reports "Version: 2.13-38+deb7u7" after upgrading. Everything below that (eg. "*u6") is vulnerable. I don't know about the specific version numbers in Ubuntu though. Edit: the fixed Ubuntu version is "2.15-0ubuntu10.10"
    • skuhn 12y ago
      Per the Ubuntu security advisory for this, 14.04 is not impacted.
    • jerematasno 12y ago
      Full blog post coming, but 14.04 was never vulnerable. glibc 2.17 was the last vulnerable version.