CVE-2015-8776
glibc: Segmentation fault caused by passing out-of-range data to strftime()
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · September 20, 2015
Updated · November 21, 2025
Description
It was found that out-of-range time values passed to the strftime() function could result in an out-of-bounds memory access. This could lead to application crash or, potentially, information disclosure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Check time values before they are passed to strftime, or call strftime only with struct tm values computed by gmtime or localtime.
CVSS / CWE
CVSS 3.0 · 6.5CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS 2.0 · 4AV:N/AC:H/Au:N/C:P/I:N/A:P
CWE not specified