CVE-2017-1000409 — glibc: Buffer overflow triggerable via LD_LIBRARY_PATH

Back Back to CVE browser

HIGH

glibc: Buffer overflow triggerable via LD_LIBRARY_PATH

Published Feb 1, 2018

7.0

HIGH

CVSS 3.0

EPSS 1.21%

Description

A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

Affected products

Red Hat Enterprise Linux 5

compat-glibc

Not affected
Red Hat Enterprise Linux 5

glibc

Not affected
Red Hat Enterprise Linux 6

compat-glibc

Not affected
Red Hat Enterprise Linux 6

glibc

Not affected
Red Hat Enterprise Linux 7

compat-glibc

Not affected
Red Hat Enterprise Linux 7

glibc

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	compat-glibc	Not affected	n/a
Red Hat Enterprise Linux 5	glibc	Not affected	n/a
Red Hat Enterprise Linux 6	compat-glibc	Not affected	n/a
Red Hat Enterprise Linux 6	glibc	Not affected	n/a
Red Hat Enterprise Linux 7	compat-glibc	Not affected	n/a
Red Hat Enterprise Linux 7	glibc	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of glibc as shipped with Red Hat Enterprise Linux 5, 6 and 7 after CVE-2017-1000366 fix: https://access.redhat.com/security/cve/cve-2017-1000366

Metrics

1.21% 0.01208

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.01208

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	1.21% (0.01208)	67.30th	v5 (v2026.06.15)
Jun 15, 2026	1.23% (0.01231)	64.93th	v5 (v2026.06.15)
Mar 30, 2025	1.77% (0.01774)	81.02th	v4 (v2025.03.14)
Mar 29, 2025	3.74% (0.03739)	79.77th	v4 (v2025.03.14)
Mar 17, 2025	1.77% (0.01774)	81.44th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00074)	33.99th	v3 (v2023.03.01)
Jun 21, 2024	0.07% (0.00074)	32.07th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00074)	30.03th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00890)	30.33th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00890)	28.64th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00890)	26.62th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00890)	12.04th	v2 (v2022.01.01)
Feb 3, 2022	3.63% (0.03630)	71.73th	v1
Jan 6, 2022	3.63% (0.03630)	71.48th	v1
Sep 1, 2021	3.63% (0.03630)	82.60th	v1
Apr 14, 2021	3.63% (0.03630)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-120

Classic Buffer Overflow

References (7)

http://seclists.org/oss-sec/2017/q4/385
mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-1000409
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1522830
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-1000409
https://security.netapp.com/advisory/ntap-20190404-0003/
x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2017-1000409
https://www.exploit-db.com/exploits/43331/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://seclists.org/oss-sec/2017/q4/385		mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-1000409		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1522830		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-1000409
https://security.netapp.com/advisory/ntap-20190404-0003/		x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2017-1000409
https://www.exploit-db.com/exploits/43331/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry