http://hmarco.org/bugs/glibc_ptr_mangle_weakness.html

FEDORA-2016-0480defc94

SUSE-SU-2016:0470

SUSE-SU-2016:0471

SUSE-SU-2016:0472

SUSE-SU-2016:0473

DSA-3480

[oss-security] 20160119 Re: CVE assignment request for security bugs fixed in glibc 2.23

81469

1034811

USN-2985-1

USN-2985-2

RHSA-2017:1916

GLSA-201702-11

https://sourceware.org/bugzilla/show_bug.cgi?id=18928

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An integer overflow vulnerability was found in     hcreate() and hcreate_r() functions which could result     in an out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution.(CVE-2015-8778)

  - A stack-based buffer overflow was found in the way the     libresolv library performed dual A/AAAA DNS queries. A     remote attacker could create a specially crafted DNS     response which could cause libresolv to crash or,     potentially, execute code with the permissions of the     user running the library. Note: this issue is only     exposed when libresolv is called from the nss_dns NSS     service module.(CVE-2015-7547)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide     specially-crafted input that, when processed, would     cause the application to crash.(CVE-2013-0242)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is glibc-side mitigation which blocks     processing of LD_LIBRARY_PATH for programs running in     secure-execution mode and reduces the number of     allocations performed by the processing of LD_AUDIT,     LD_PRELOAD, and LD_HWCAP_MASK, making successful     exploitation of this issue more     difficult.(CVE-2017-1000366)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

  - It was found that the files back end of Name Service     Switch (NSS) did not isolate iteration over an entire     database from key-based look-up API calls. An     application performing look-ups on a database while     iterating over it could enter an infinite loop, leading     to a denial of service.(CVE-2014-8121)

  - Stack-based buffer overflow in the getaddrinfo function     in sysdeps/posix/getaddrinfo.c in the GNU C Library     (aka glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458.(CVE-2016-3706)

  - In glibc 2.26 and earlier there is confusion in the     usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer     underflow and potential code     execution.(CVE-2018-1000001)

  - Stack-based buffer overflow in string/strcoll_l.c in     the GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string that triggers a malloc failure and use of     the alloca function.(CVE-2012-4424)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-8777)

  - The glob function in glob.c in the GNU C Library (aka     glibc or libc6) before 2.27 contains a buffer overflow     during unescaping of user names with the ~     operator.(CVE-2017-15804)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on     the files and obtain access to arbitrary     pseudo-terminals by leveraging a FUSE file     system.(CVE-2013-2207)

  - A stack overflow flaw was found in glibc's swscanf()     function. An attacker able to make an application call     the swscanf() function could use this flaw to crash     that application or, potentially, execute arbitrary     code with the permissions of the user running the     application.(CVE-2015-1473)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-4458)

  - A heap-based buffer overflow was found in glibc's
    __nss_hostname_digits_dots() function, which is used by     the gethostbyname() and gethostbyname2() glibc function     calls. A remote attacker able to make an application     call either of these functions could use this flaw to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-0235)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory     allocator functions (pvalloc, valloc, and memalign). If     an application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application.(CVE-2013-4332)

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

  - A stack based buffer overflow vulnerability was found     in the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code.(CVE-2015-8779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack overflow vulnerability was found in nan*     functions that could cause applications, which process     long strings with the nan function, to crash or,     potentially, execute arbitrary code. (CVE-2014-9761)

  - It was found that out-of-range time values passed to     the strftime() function could result in an     out-of-bounds memory access. This could lead to     application crash or, potentially, information     disclosure. (CVE-2015-8776)

  - An integer overflow vulnerability was found in     hcreate() and hcreate_r() functions which could result     in an out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution. (CVE-2015-8778)

  - A stack based buffer overflow vulnerability was found     in the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code. (CVE-2015-8779)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application. (CVE-2015-8777)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unbounded stack allocation in catopen function

A stack based buffer overflow vulnerability was found in the catopen() function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.(CVE-2015-8779)

Integer overflow in hcreate and hcreate_r

An integer overflow vulnerability was found in hcreate() and hcreate_r() functions which could result in an out-of-bounds memory access. This could lead to application crash or, potentially, arbitrary code execution. (CVE-2015-8778)

Unbounded stack allocation in nan* functions

A stack overflow vulnerability was found in nan* functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. (CVE-2014-9761)

LD_POINTER_GUARD in the environment is not sanitized

It was found that the dynamic loader did not sanitize the LD_POINTER_GUARD environment variable. An attacker could use this flaw to bypass the pointer guarding protection on set-user-ID or set-group-ID programs to execute arbitrary code with the permissions of the user running the application.(CVE-2015-8777)

Segmentation fault caused by passing out-of-range data to strftime()

It was found that out-of-range time values passed to the strftime() function could result in an out-of-bounds memory access. This could lead to application crash or, potentially, information disclosure.
(CVE-2015-8776)

An update for glibc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es) :

* A stack overflow vulnerability was found in nan* functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code.
(CVE-2014-9761)

* It was found that out-of-range time values passed to the strftime() function could result in an out-of-bounds memory access. This could lead to application crash or, potentially, information disclosure.
(CVE-2015-8776)

* An integer overflow vulnerability was found in hcreate() and hcreate_r() functions which could result in an out-of-bounds memory access. This could lead to application crash or, potentially, arbitrary code execution. (CVE-2015-8778)

* A stack based buffer overflow vulnerability was found in the catopen() function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.
(CVE-2015-8779)

* It was found that the dynamic loader did not sanitize the LD_POINTER_GUARD environment variable. An attacker could use this flaw to bypass the pointer guarding protection on set-user-ID or set-group-ID programs to execute arbitrary code with the permissions of the user running the application. (CVE-2015-8777)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Security Fix(es) :

  - A stack overflow vulnerability was found in nan*     functions that could cause applications, which process     long strings with the nan function, to crash or,     potentially, execute arbitrary code. (CVE-2014-9761)

  - It was found that out-of-range time values passed to the     strftime() function could result in an out-of-bounds     memory access. This could lead to application crash or,     potentially, information disclosure. (CVE-2015-8776)

  - An integer overflow vulnerability was found in hcreate()     and hcreate_r() functions which could result in an     out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution. (CVE-2015-8778)

  - A stack based buffer overflow vulnerability was found in     the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code. (CVE-2015-8779)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application. (CVE-2015-8777)

From Red Hat Security Advisory 2017:1916 :

An update for glibc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es) :

* A stack overflow vulnerability was found in nan* functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code.
(CVE-2014-9761)

* It was found that out-of-range time values passed to the strftime() function could result in an out-of-bounds memory access. This could lead to application crash or, potentially, information disclosure.
(CVE-2015-8776)

* An integer overflow vulnerability was found in hcreate() and hcreate_r() functions which could result in an out-of-bounds memory access. This could lead to application crash or, potentially, arbitrary code execution. (CVE-2015-8778)

* A stack based buffer overflow vulnerability was found in the catopen() function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.
(CVE-2015-8779)

* It was found that the dynamic loader did not sanitize the LD_POINTER_GUARD environment variable. An attacker could use this flaw to bypass the pointer guarding protection on set-user-ID or set-group-ID programs to execute arbitrary code with the permissions of the user running the application. (CVE-2015-8777)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The remote host is affected by the vulnerability described in GLSA-201702-11 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process, disclose sensitive information, or cause a       Denial of Service condition via multiple vectors.
  Workaround :

    There is no known workaround at this time.

USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for CVE-2014-9761 introduced a regression which affected applications that use the libm library but were not fully restarted after the upgrade.
This update removes the fix for CVE-2014-9761 and a future update will be provided to address this issue.

We apologize for the inconvenience.

Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. (CVE-2013-2207, CVE-2016-2856)

Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite loop). (CVE-2014-8121)

Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service (stack exhaustion leading to an application crash) or possibly execute arbitrary code.
(CVE-2014-9761)

Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2015-1781)

Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not handle long lines in the files databases correctly. A local attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code.
(CVE-2015-5277)

Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-range argument data. An attacker could use this to cause a denial of service (application crash) or possibly expose sensitive information. (CVE-2015-8776)

Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege boundaries. A local attacker could use this to exploit an existing vulnerability more easily.
(CVE-2015-8777)

Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size argument, leading to an integer overflow. An attacker could use to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-8778)

Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C Library when handling long catalog names. An attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly handle long names passed as arguments. An attacker could use to cause a denial of service (stack exhaustion leading to an application crash). (CVE-2016-3075).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. (CVE-2013-2207, CVE-2016-2856)

Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite loop). (CVE-2014-8121)

Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2015-1781)

Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not handle long lines in the files databases correctly. A local attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-range argument data. An attacker could use this to cause a denial of service (application crash) or possibly expose sensitive information. (CVE-2015-8776)

Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege boundaries. A local attacker could use this to exploit an existing vulnerability more easily. (CVE-2015-8777)

Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size argument, leading to an integer overflow. An attacker could use to cause a denial of service (application crash) or possibly execute arbitrary code.
(CVE-2015-8778)

Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C Library when handling long catalog names. An attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code.
(CVE-2015-8779)

Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly handle long names passed as arguments.
An attacker could use to cause a denial of service (stack exhaustion leading to an application crash). (CVE-2016-3075).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates addresses a critical security vulnerability in the DNS resolver related to `AF_UNSPEC` queries with `getaddrinfo` (CVE-2015-7547). It also includes security fixes for CVE-2015-8777 and CVE-2015-1781. It improves `malloc` scalability for applications which start and terminate many threads. The output of `locale -a` is now ASCII-only (previously, it contained ISO-8859-1 characters).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following security issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

  - CVE-2013-2207: pt_chown tricked into granting access to     another users pseudo-terminal (bsc#830257)

  - CVE-2013-4458: Stack (frame) overflow in getaddrinfo()     when called with AF_INET6 (bsc#847227)

  - CVE-2014-8121: denial of service issue in the NSS     backends (bsc#918187)

  - bsc#920338: Read past end of pattern in fnmatch

  - CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following security issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

The following non-security bugs were fixed :

  - bsc#955647: Resource leak in resolver

  - bsc#956716: Don't do lock elision on an error checking     mutex

  - bsc#958315: Reinitialize dl_load_write_lock on fork

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Several vulnerabilities have been fixed in the GNU C Library, eglibc.

The CVE-2015-7547 vulnerability listed below is considered to have critical impact.

  - CVE-2014-8121     Robin Hack discovered that the nss_files database did     not correctly implement enumeration interleaved with     name-based or ID-based lookups. This could cause the     enumeration enter an endless loop, leading to a denial     of service.

  - CVE-2015-1781     Arjun Shankar discovered that the _r variants of host     name resolution functions (like gethostbyname_r), when     performing DNS name resolution, suffered from a buffer     overflow if a misaligned buffer was supplied by the     applications, leading to a crash or, potentially,     arbitrary code execution. Most applications are not     affected by this vulnerability because they use aligned     buffers.

  - CVE-2015-7547     The Google Security Team and Red Hat discovered that the     eglibc host name resolver function, getaddrinfo, when     processing AF_UNSPEC queries (for dual A/AAAA lookups),     could mismanage its internal buffers, leading to a     stack-based buffer overflow and arbitrary code     execution. This vulnerability affects most applications     which perform host name resolution using getaddrinfo,     including system services.

  - CVE-2015-8776     Adam Nielsen discovered that if an invalid separated     time value is passed to strftime, the strftime function     could crash or leak information. Applications normally     pass only valid time information to strftime; no     affected applications are known.

  - CVE-2015-8777     Hector Marco-Gisbert reported that LD_POINTER_GUARD was     not ignored for SUID programs, enabling an unintended     bypass of a security feature. This update causes eglibc     to always ignore the LD_POINTER_GUARD environment     variable.

  - CVE-2015-8778     Szabolcs Nagy reported that the rarely-used hcreate and     hcreate_r functions did not check the size argument     properly, leading to a crash (denial of service) for     certain arguments. No impacted applications are known at     this time.

  - CVE-2015-8779     The catopen function contains several unbound stack     allocations (stack overflows), causing it the crash the     process (denial of service). No applications where this     issue has a security impact are currently known.

The following fixed vulnerabilities currently lack CVE assignment :

  - Joseph Myers reported that an integer overflow in the     strxfrm can lead to heap-based buffer overflow, possibly     allowing arbitrary code execution. In addition, a     fallback path in strxfrm uses an unbounded stack     allocation (stack overflow), leading to a crash or     erroneous application behavior.
  - Kostya Serebryany reported that the fnmatch function     could skip over the terminating NUL character of a     malformed pattern, causing an application calling     fnmatch to crash (denial of service).

  - Joseph Myers reported that the IO_wstr_overflow     function, internally used by wide-oriented character     streams, suffered from an integer overflow, leading to a     heap-based buffer overflow. On GNU/Linux systems,     wide-oriented character streams are rarely used, and no     affected applications are known.

  - Andreas Schwab reported a memory leak (memory allocation     without a matching deallocation) while processing     certain DNS answers in getaddrinfo, related to the
    _nss_dns_gethostbyname4_r function. This vulnerability     could lead to a denial of service.

While it is only necessary to ensure that all processes are not using the old eglibc anymore, it is recommended to reboot the machines after applying the security upgrade.

ID	Name	Product	Family	Severity
125004	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1551)	Nessus	Huawei Local Security Checks	critical
103058	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2017-1200)	Nessus	Huawei Local Security Checks	high
103057	EulerOS 2.0 SP1 : glibc (EulerOS-SA-2017-1199)	Nessus	Huawei Local Security Checks	high
102865	Amazon Linux AMI : glibc (ALAS-2017-877)	Nessus	Amazon Linux Local Security Checks	high
102743	CentOS 7 : glibc (CESA-2017:1916)	Nessus	CentOS Local Security Checks	high
102641	Scientific Linux Security Update : glibc on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	high
102288	Oracle Linux 7 : glibc (ELSA-2017-1916)	Nessus	Oracle Linux Local Security Checks	high
102149	RHEL 7 : glibc (RHSA-2017:1916)	Nessus	Red Hat Local Security Checks	high
97254	GLSA-201702-11 : GNU C Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
91341	Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : eglibc, glibc regression (USN-2985-2)	Nessus	Ubuntu Local Security Checks	high
91334	Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : eglibc, glibc vulnerabilities (USN-2985-1)	Nessus	Ubuntu Local Security Checks	high
89473	Fedora 22 : glibc-2.21-11.fc22 (2016-0480defc94)	Nessus	Fedora Local Security Checks	critical
88833	SUSE SLED11 / SLES11 Security Update : glibc (SUSE-SU-2016:0472-1)	Nessus	SuSE Local Security Checks	critical
88832	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2016:0471-1)	Nessus	SuSE Local Security Checks	critical
88831	SUSE SLES11 Security Update : glibc (SUSE-SU-2016:0470-1)	Nessus	SuSE Local Security Checks	critical
88829	openSUSE Security Update : glibc (openSUSE-2016-224)	Nessus	SuSE Local Security Checks	critical
88767	Debian DSA-3480-1 : eglibc - security update	Nessus	Debian Local Security Checks	critical

CVE-2015-8777

LOW

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical