WaratekVRT Sign in

CVE-2024-33602 glibc

Affected softwareglibc
Severity7.4 High CVSS 3.1
WeaknessCWE-466
Published6 May 2024
Updated17 Jun 2026

Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.40% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Communications / Automated Test Suite (glibc) (9.0.0.0.0-9.0.2.0.0)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Communications / Alarms, KPI, and Measurements (glibc) (23.4.0-23.4.6)
Oracle Communications / Configuration (glibc) (23.4.0, 24.1.0, 24.2.0)
Oracle Communications / Management Service (glibc) (23.4.0-23.4.5)
Oracle Communications / Mediation Engine (glibc) (5.1, 5.2)
Oracle Communications / Platform (glibc) (9.1.1.8.0)
Oracle Communications / Routing (glibc) (9.1.0, 9.2.0, 9.3.0)
Oracle Communications / Routing (glibc) (9.1.5)
Oracle Communications / System (glibc) (4.1.0, 4.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Alarms, KPI, and Measurements (glibc) 23.4.0-23.4.6
Oracle Communications Automated Test Suite (glibc) 9.0.0.0.0-9.0.2.0.0
Oracle Communications Configuration (glibc) 23.4.0, 24.1.0, 24.2.0 23.4.0 · 24.1.0 · 24.2.0
Oracle Communications Management Service (glibc) 23.4.0-23.4.5
Oracle Communications Mediation Engine (glibc) 5.1, 5.2 5.1 · 5.2
Oracle Communications Platform (glibc) 9.1.1.8.0 9.1.1.8.0
Oracle Communications Routing (glibc) 9.1.0, 9.2.0, 9.3.0 9.1.0 · 9.1.5 · 9.2.0 · 9.3.0
Oracle Communications System (glibc) 4.1.0, 4.2.0 4.1.0 · 4.2.0

Products and versions

11 products, 11 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 10.0
nvd gnu glibc generic ≥ 2.15 and ＜ 2.40
nvd netapp element software generic any version
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h700s firmware generic any version
nvd netapp hci bootstrap os generic any version
nvd netapp solidfire \& hci management node generic any version
nvd netapp solidfire \& hci storage node generic any version

References

URLTags
http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0012/ Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008 Broken Link
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Timeline
Published2024-05-06By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.