WaratekVRT Sign in

CVE-2024-33600 glibc

Affected softwareglibc
Severity5.9 Medium CVSS 3.1
WeaknessCWE-476
Published6 May 2024
Updated17 Jun 2026

Description

nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.2% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Communications / Automated Test Suite (glibc) (9.0.0.0.0-9.0.2.0.0)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Communications / Alarms, KPI, and Measurements (glibc) (23.4.0-23.4.6)
Oracle Communications / Configuration (glibc) (23.4.0, 24.1.0, 24.2.0)
Oracle Communications / Management Service (glibc) (23.4.0-23.4.5)
Oracle Communications / Mediation Engine (glibc) (5.1, 5.2)
Oracle Communications / Platform (glibc) (9.1.1.8.0)
Oracle Communications / Routing (glibc) (9.1.0, 9.2.0, 9.3.0)
Oracle Communications / Routing (glibc) (9.1.5)
Oracle Communications / System (glibc) (4.1.0, 4.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Alarms, KPI, and Measurements (glibc) 23.4.0-23.4.6
Oracle Communications Automated Test Suite (glibc) 9.0.0.0.0-9.0.2.0.0
Oracle Communications Configuration (glibc) 23.4.0, 24.1.0, 24.2.0 23.4.0 · 24.1.0 · 24.2.0
Oracle Communications Management Service (glibc) 23.4.0-23.4.5
Oracle Communications Mediation Engine (glibc) 5.1, 5.2 5.1 · 5.2
Oracle Communications Platform (glibc) 9.1.1.8.0 9.1.1.8.0
Oracle Communications Routing (glibc) 9.1.0, 9.2.0, 9.3.0 9.1.0 · 9.1.5 · 9.2.0 · 9.3.0
Oracle Communications System (glibc) 4.1.0, 4.2.0 4.1.0 · 4.2.0

Products and versions

12 products, 12 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 10.0
nvd gnu glibc generic ≥ 2.15 and ＜ 2.40
nvd netapp active iq unified manager generic any version
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h610c firmware generic any version
nvd netapp h610s firmware generic any version
nvd netapp h615c firmware generic any version
nvd netapp h700s firmware generic any version
nvd netapp hci bootstrap os generic any version

References

URLTags
http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0013/ Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006 Broken Link
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Timeline
Published2024-05-06By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.