Detections
Analytics

Alpine: multiple musl packages: security update to 1.1.16-r13 (deprecated)

high Tenable Cloud Security Plugin ID 400875

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the
 heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that
 additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but
 these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25
 and earlier. (CVE-2017-1000366)

See Also

https://git.alpinelinux.org/aports/commit/?id=765c858d306c713051abcdfca64a875f05462d2b

https://git.alpinelinux.org/aports/commit/?id=a4bfa375739e0b009392cb6aac06b59ff998d0f6

Plugin Details

Severity: High

ID: 400875

Version: Revision 1.24

Type: Local

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.08

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2017-1000366

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/22/2017

Vulnerability Publication Date: 6/19/2017

Reference Information

CVE: CVE-2017-1000366

BID: 99127