CVE-2024-33601

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

nscd: netgroup cache may terminate daemon on memory allocation failure

The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-617

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-336027.4nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory w CVE-2024-336035.3The LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to acces CVE-2024-336046.1A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker t CVE-2024-336057.5Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affecte CVE-2024-336068.8An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a Mi CVE-2024-336075.6Out-of-bounds read in some Intel(R) TDX module software before version TDX_1.5.07.00.774 may allow an authenticated user to potentially enab CVE-2024-336087.5When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: CVE-2024-33618.8A vulnerability has been found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this vulnerability is an CVE-2024-336109.1"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' sessio CVE-2024-336113.4Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to po CVE-2024-336126.8An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance CVE-2024-336158.8A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file