# Critical security vulnerability in Linux (CVE-2015-7547, getaddrinfo)

**URL:** <https://discourse.mailinabox.email/t/critical-security-vulnerability-in-linux-cve-2015-7547-getaddrinfo/1101>\
**Category:** Announcements\
**Created:** [February 16, 2016, 9:23pm UTC](https://discourse.mailinabox.email/t/critical-security-vulnerability-in-linux-cve-2015-7547-getaddrinfo/1101 "2016-02-16T21:23:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [February 16, 2016, 9:23pm UTC](https://discourse.mailinabox.email/t/critical-security-vulnerability-in-linux-cve-2015-7547-getaddrinfo/1101/1 "2016-02-16T21:23:08Z")

</div>

A [critical security issue](http://arstechnica.com/security/2016/02/extremely-severe-bug-leaves-dizzying-number-of-apps-and-devices-vulnerable/) in Linux in a core system library has come to light. Although exploits are considered improbable, there’s a risk that malicious people will be able to cause system processes to crash by making certain mail/web/etc. requests that trigger certain sorts of DNS queries.

(For advanced folks, there’s [fun exploit proof-of-concept code](https://github.com/fjserna/CVE-2015-7547).)

Ubuntu has [posted an update](http://www.ubuntu.com/usn/usn-2900-1/). Since Mail-in-a-Box automatically installs security updates I believe that the update will be installed automatically tonight, but you will need to manually reboot the machine in any case.

To update your system manually, and to be sure the update was installed, log in with SSH and run:

```
sudo apt-get update && sudo apt-get upgrade

```

Then reboot by running:

```
sudo reboot

```

To check if you have the new version of the system library (libc6) run (after logging back in with SSH):

```
dpkg -l libc6 | grep libc6

```

You should see in the third column the version `2.19-0ubuntu6.7`. Any previous version such as `2.19-0ubuntu6.6` does not have the update.

---

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [February 17, 2016, 12:04am UTC](https://discourse.mailinabox.email/t/critical-security-vulnerability-in-linux-cve-2015-7547-getaddrinfo/1101/2 "2016-02-17T00:04:32Z")

</div>

^ Post has been updated. Ubuntu has posted an update.

---

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [February 23, 2016, 12:04am UTC](https://discourse.mailinabox.email/t/critical-security-vulnerability-in-linux-cve-2015-7547-getaddrinfo/1101/3 "2016-02-23T00:04:38Z")

</div>

This topic was automatically closed 6 days after the last reply. New replies are no longer allowed.