CVE-2015-20109: 
Alma Linux vulnerability analysis and mitigation

The GNU C Library (glibc) before version 2.22 contains a vulnerability in the endpattern function (called from internalfnmatch) that might allow context-dependent attackers to cause a denial of service (application crash). This vulnerability can be triggered by using the fnmatch library function with the **(!() pattern. This issue is tracked as CVE-2015-20109 and is distinct from CVE-2015-8984 (NVD, Ubuntu Notice).

The vulnerability exists in the endpattern function which is called from internalfnmatch in the GNU C Library. When processing certain pattern inputs, specifically the **(!() pattern using the fnmatch library function, the code can read past the end of a buffer, leading to a crash. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The successful exploitation of this vulnerability results in a denial of service condition through application crash. The vulnerability affects the availability of the system but does not impact confidentiality or integrity (NVD, NetApp Advisory).

The vulnerability was fixed in GNU C Library version 2.22. Users are advised to upgrade to this version or later to address the issue. For systems that cannot be immediately upgraded, there are no documented workarounds available (NVD).