CVE-2015-8776: The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attack...

Security readout for executives and security teams

CVE-2015-8776 affects GNU C Library strftime before glibc 2.23. If an application formats attacker-influenced, out-of-range time values, it may crash and possibly expose sensitive information. The impact depends on whether exposed application paths pass untrusted time data into this library function. Linux systems or appliances with glibc/libc6 before 2.23 may be exposed where applications format untrusted dates or timestamps. Distribution backports may fix vulnerable packages without changing the apparent upstream version, so package advisory status matters. Treat this as a patch-management issue with moderate urgency. It affects a foundational library, but the public evidence provided does not show active exploitation and exposure depends on application input paths. Mitigation focus: Apply the relevant vendor glibc/libc6 security update for each Linux distribution.; Check vendor advisories before assuming upstream version numbers prove exposure.; Prioritize internet-facing services that parse or format user-supplied dates..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.