Updated glibc packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)

This update also fixes the following bugs :

* Due to problems with buffer extension and reallocation, the nscd daemon terminated unexpectedly with a segmentation fault when processing long netgroup entries. With this update, the handling of long netgroup entries has been corrected and nscd no longer crashes in the described scenario. (BZ#1138520)

* If a file opened in append mode was truncated with the ftruncate() function, a subsequent ftell() call could incorrectly modify the file offset. This update ensures that ftell() modifies the stream state only when it is in append mode and the buffer for the stream is not empty. (BZ#1156331)

* A defect in the C library headers caused builds with older compilers to generate incorrect code for the btowc() function in the older compatibility C++ standard library. Applications calling btowc() in the compatibility C++ standard library became unresponsive. With this update, the C library headers have been corrected, and the compatibility C++ standard library shipped with Red Hat Enterprise Linux has been rebuilt. Applications that rely on the compatibility C++ standard library no longer hang when calling btowc(). (BZ#1120490)

* Previously, when using netgroups and the nscd daemon was set up to cache netgroup information, the sudo utility denied access to valid users. The bug in nscd has been fixed, and sudo now works in netgroups as expected. (BZ#1080766)

Users of glibc are advised to upgrade to these updated packages, which fix these issues.

Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)

The CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat Developer Experience Team.

This update also fixes the following bugs :

* Previously, when an address lookup using the getaddrinfo() function for the AF_UNSPEC value was performed on a defective DNS server, the server in some cases responded with a valid response for the A record, but a referral response for the AAAA record, which resulted in a lookup failure. A prior update was implemented for getaddrinfo() to return the valid response, but it contained a typographical error, due to which the lookup could under some circumstances still fail. This error has been corrected and getaddrinfo() now returns a valid response in the described circumstances. (BZ#1172023)

* An error in the dlopen() library function previously caused recursive calls to dlopen() to terminate unexpectedly or to abort with a library assertion. This error has been fixed and recursive calls to dlopen() no longer crash or abort. (BZ#1173469)

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)

Updated glibc packages fix security vulnerabilities :

Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC_* and LANG variables. Together with typical OpenSSH configurations (with suitable AcceptEnv settings in sshd_config), this could conceivably be used to bypass ForceCommand restrictions (or restricted shells), assuming the attacker has sufficient level of access to a file system location on the host to create crafted locale definitions there (CVE-2014-0475).

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where posix_spawn_file_actions_addopen fails to copy the path argument (glibc bz #17048) which can, in conjunction with many common memory management techniques from an application, lead to a use after free, or other vulnerabilities (CVE-2014-4043).

This update also fixes the following issues: x86: Disable x87 inline functions for SSE2 math (glibc bz #16510) malloc: Fix race in free() of fastbin chunk (glibc bz #15073)

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.

This update removes support of loadable gconv transliteration modules.
Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose (CVE-2014-5119).

Adhemerval Zanella Netto discovered out-of-bounds reads in additional code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) that can be used to crash the systems, causing a denial of service conditions (CVE-2014-6040).

The function wordexp() fails to properly handle the WRDE_NOCMD flag when processing arithmetic inputs in the form of '$((... ))' where '...' can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDE_NOCMD forbade command substitution. This allows an attacker to attempt to pass dangerous commands via constructs of the above form, and bypass the WRDE_NOCMD flag. This update fixes the issue (CVE-2014-7817).

The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not properly restrict the use of the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers (CVE-2012-3406).

The nss_dns implementation of getnetbyname could run into an infinite loop if the DNS response contained a PTR record of an unexpected format (CVE-2014-9402).

Also glibc lock elision (new feature in glibc 2.18) has been disabled as it can break glibc at runtime on newer Intel hardware (due to hardware bug)

Under certain conditions wscanf can allocate too little memory for the to-be-scanned arguments and overflow the allocated buffer (CVE-2015-1472).

The incorrect use of '__libc_use_alloca (newsize)' caused a different (and weaker) policy to be enforced which could allow a denial of service attack (CVE-2015-1473).

This glibc update fixes a critical privilege escalation problem and the following security and non-security issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#882600: Copy filename argument in     posix_spawn_file_actions_addopen. (CVE-2014-4043)

  - bnc#860501: Use O_LARGEFILE for utmp file.

  - bnc#842291: Fix typo in     glibc-2.5-dlopen-lookup-race.diff.

  - bnc#839870: Fix integer overflows in malloc.
    (CVE-2013-4332)

  - bnc#834594: Fix readdir_r with long file names.
    (CVE-2013-4237)

  - bnc#824639: Drop lock before calling malloc_printerr.

  - bnc#801246: Fix buffer overrun in regexp matcher.
    (CVE-2013-0242)

  - bnc#779320: Fix buffer overflow in strcoll.
    (CVE-2012-4412)

  - bnc#894556 / bnc#894553: Fix crashes on invalid input in     IBM gconv modules. (CVE-2014-6040, CVE-2012-6656,     bnc#894553, bnc#894556, BZ#17325, BZ#14134)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation problem and two additional issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#836746: Avoid race between {, __de}allocate_stack     and __reclaim_stacks during fork.

  - bnc#844309: Fixed various overflows, reading large     /etc/hosts or long names. (CVE-2013-4357)

  - bnc#894553, bnc#894556: Fixed various crashes on invalid     input in IBM gconv modules. (CVE-2014-6040,     CVE-2012-6656)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc was updated to fix three security issues :

  - A directory traversal in locale environment handling was     fixed (CVE-2014-0475, bnc#887022, GLIBC BZ #17137)

  - Disable gconv transliteration module loading which could     be used for code execution (CVE-2014-5119, bnc#892073,     GLIBC BZ #17187)

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, bnc#894553, BZ #17325)

- Fix CVE-2014-6040: crash in code page decoding functions     (IBM933, IBM935, IBM937, IBM939, IBM1364)

  - Fix CVE-2014-7817: command execution in wordexp() with     WRDE_NOCMD specified

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library :

  - CVE-2015-0235     Qualys discovered that the gethostbyname and     gethostbyname2 functions were subject to a buffer     overflow if provided with a crafted IP address argument.
    This could be used by an attacker to execute arbitrary     code in processes which called the affected functions.

  The original glibc bug was reported by Peter Klotz.

  - CVE-2014-7817     Tim Waugh of Red Hat discovered that the WRDE_NOCMD     option of the wordexp function did not suppress command     execution in all cases. This allows a context-dependent     attacker to execute shell commands.

  - CVE-2012-6656 CVE-2014-6040     The charset conversion code for certain IBM multi-byte     code pages could perform an out-of-bounds array access,     causing the process to crash. In some scenarios, this     allows a remote attacker to cause a persistent denial of     service.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2432-1 advisory.

    Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled certain multibyte characters when     using the iconv function. An attacker could possibly use this issue to cause applications to crash,     resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS.
    (CVE-2012-6656)

    Adhemerval Zanella Netto discovered that the GNU C Library incorrectly handled certain multibyte     characters when using the iconv function. An attacker could possibly use this issue to cause applications     to crash, resulting in a denial of service. (CVE-2014-6040)

    Tim Waugh discovered that the GNU C Library incorrectly enforced the WRDE_NOCMD flag when handling the     wordexp function. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2014-7817)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

glibc has been updated to fix one security issue and several bugs :

Security issue fixed :

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, CVE-2012-6656)

  - Fixed a stack overflow during hosts parsing     (CVE-2013-4357)

Bugs fixed :

  - don't touch user-controlled stdio locks in forked child     (bsc#864081, GLIBC BZ #12847)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

  - Add check for RTLD_DEEPBIND environment variable to     disable deepbinding of NSS modules (bsc#888860)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201602-02 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library:
      The Google Security Team and Red Hat discovered a stack-based buffer         overflow in the send_dg() and send_vc() functions due to a buffer         mismanagement when getaddrinfo() is called with AF_UNSPEC         (CVE-2015-7547).
      The strftime() function access invalid memory when passed         out-of-range data, resulting in a crash (CVE-2015-8776).
      An integer overflow was found in the __hcreate_r() function         (CVE-2015-8778).
      Multiple unbounded stack allocations were found in the catopen()         function (CVE-2015-8779).
    Please review the CVEs referenced below for additional vulnerabilities       that had already been fixed in previous versions of sys-libs/glibc, for       which we have not issued a GLSA before.
  Impact :

    A remote attacker could exploit any application which performs host name       resolution using getaddrinfo() in order to execute arbitrary code or       crash the application. The other vulnerabilities can possibly be       exploited to cause a Denial of Service or leak information.
  Workaround :

    A number of mitigating factors for CVE-2015-7547 have been identified.
      Please review the upstream advisory and references below.

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)

This update also fixes the following bugs :

  - Due to problems with buffer extension and reallocation,     the nscd daemon terminated unexpectedly with a     segmentation fault when processing long netgroup     entries. With this update, the handling of long netgroup     entries has been corrected and nscd no longer crashes in     the described scenario.

  - If a file opened in append mode was truncated with the     ftruncate() function, a subsequent ftell() call could     incorrectly modify the file offset. This update ensures     that ftell() modifies the stream state only when it is     in append mode and the buffer for the stream is not     empty.

  - A defect in the C library headers caused builds with     older compilers to generate incorrect code for the     btowc() function in the older compatibility C++ standard     library. Applications calling btowc() in the     compatibility C++ standard library became unresponsive.
    With this update, the C library headers have been     corrected, and the compatibility C++ standard library     shipped with Scientific Linux has been rebuilt.
    Applications that rely on the compatibility C++ standard     library no longer hang when calling btowc().

  - Previously, when using netgroups and the nscd daemon was     set up to cache netgroup information, the sudo utility     denied access to valid users. The bug in nscd has been     fixed, and sudo now works in netgroups as expected.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update fix for CVE-2015-7547 (#1296028).

  - Create helper threads with enough stack for POSIX AIO     and timers (#1301625).

  - Fix CVE-2015-7547: getaddrinfo stack-based buffer     overflow (#1296028).

  - Support loading more libraries with static TLS     (#1291270).

  - Check for NULL arena pointer in _int_pvalloc (#1256890).

  - Don't change no_dyn_threshold on mallopt failure     (#1256891).

  - Unlock main arena after allocation in calloc (#1256812).

  - Enable robust malloc change again (#1256812).

  - Fix perturbing in malloc on free and simply perturb_byte     (#1256812).

  - Don't fall back to mmap prematurely (#1256812).

  - The malloc deadlock avoidance support has been     temporarily removed since it triggers deadlocks in     certain applications (#1244002).

  - Fix ruserok check to reject, not skip, negative user     checks (#1217186).

  - Optimize ruserok function for large ~/.rhosts     (#1217186).

  - Fix crash in valloc due to the backtrace deadlock fix     (#1207236).

  - Fix buffer overflow in gethostbyname_r with misaligned     buffer (#1209376, CVE-2015-1781).

  - Avoid deadlock in malloc on backtrace (#1066724).

  - Support running applications that use Intel AVX-512     (#1195453).

  - Silence logging of record type mismatch for DNSSEC     records (#1088301).

  - Shrink heap on free when vm.overcommit_memory == 2     (#867679).

  - Enhance nscd to detect any configuration file changes     (#859965).

  - Fix __times handling of EFAULT when buf is NULL     (#1124204).

  - Fix memory leak with dlopen and thread-local storage     variables (#978098).

  - Prevent getaddrinfo from writing DNS queries to random     fd (CVE-2013-7423, - Implement userspace half of in6.h     header coordination (#1053178).

  - Correctely size relocation cache used by profiler     (#1144132).

  - Fix reuse of cached stack leading to bounds overrun of     DTV (#1116050).

  - Return failure in getnetgrent only when all netgroups     have been searched (#1085312).

  - Fix valgrind warning in nscd_stats (#1091915).

  - Initialize xports array (#1159167).

  - Fix tst-default-attr test to not fail on powerpc     (#1023306).

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183534).

  - Fix typo in nscd/selinux.c (#1125307).

  - Actually run test-iconv modules (#1176907).

  - Fix recursive dlopen (#1154563).

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, #1172044).

  - Fix wordexp to honour WRDE_NOCMD (CVE-2014-7817,     #1171296).

  - Fix typo in res_send and res_query (#rh1138769).

Multiple vulnerabilities has been found and corrected in glibc :

When converting IBM930 code with iconv(), if IBM930 code which includes invalid multibyte character 0xffff is specified, then iconv() segfaults (CVE-2012-6656).

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules (CVE-2014-5119).

Crashes were reported in the IBM code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) (CVE-2014-6040).

The updated packages have been patched to correct these issues.

glibc has been updated to fix a security issue and two bugs :

Security issue fixed :

  - Copy filename argument in     posix_spawn_file_actions_addopen (CVE-2014-4043)

Bugs fixed :

  - don't touch user-controlled stdio locks in forked child     (bsc#864081, GLIBC BZ #12847)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
81630	RHEL 7 : glibc (RHSA-2015:0327)	Nessus	Red Hat Local Security Checks	2015/3/5	2021/2/5	medium
80400	CentOS 6 : glibc (CESA-2015:0016)	Nessus	CentOS Local Security Checks	2015/1/8	2021/1/4	medium
80419	Amazon Linux AMI : glibc (ALAS-2015-468)	Nessus	Amazon Linux Local Security Checks	2015/1/9	2018/4/18	medium
82421	Mandriva Linux Security Advisory : glibc (MDVSA-2015:168)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	high
83638	SUSE SLES10 Security Update : glibc (SUSE-SU-2014:1128-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
83639	SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1129-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
77659	openSUSE Security Update : glibc (openSUSE-SU-2014:1115-1)	Nessus	SuSE Local Security Checks	2014/9/12	2021/1/19	high
81616	Fedora 20 : glibc-2.18-19.fc20 (2015-2845)	Nessus	Fedora Local Security Checks	2015/3/5	2021/1/11	medium
81029	Debian DSA-3142-1 : eglibc - security update	Nessus	Debian Local Security Checks	2015/1/28	2021/1/11	high
79718	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2432-1)	Nessus	Ubuntu Local Security Checks	2014/12/4	2025/9/3	high
83673	SUSE SLES11 Security Update : glibc (SUSE-SU-2015:0164-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
88822	GLSA-201602-02 : GNU C Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/2/18	2024/6/18	critical
82044	Amazon Linux AMI : glibc (ALAS-2015-495)	Nessus	Amazon Linux Local Security Checks	2015/3/25	2018/4/18	medium
82250	Scientific Linux Security Update : glibc on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	2015/3/26	2021/1/14	medium
88783	OracleVM 3.3 : glibc (OVMSA-2016-0013) (GHOST)	Nessus	OracleVM Local Security Checks	2016/2/17	2024/6/18	high
77654	Mandriva Linux Security Advisory : glibc (MDVSA-2014:175)	Nessus	Mandriva Local Security Checks	2014/9/12	2021/1/6	high
83674	SUSE SLES11 Security Update : glibc (SUSE-SU-2015:0167-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high

偵測

搜尋 Plugin

medium

medium

medium

high

high

high

high

medium

high

high

high

critical

medium

medium

high

high

high