This update addresses various minor issues in the glibc package :

  - The DNS stub resolver now picks up changes to     `/etc/resolv.conf` automatically (RHBZ#1374239).

  - The DNS stub resolver supports an unlimited number of     search domains (RHBZ#168253).

  - CVE-2015-5180, a segmentation fault potentially     affecting applications which use the DNS stub resolver     in an unusual way, has been fixed (RHBZ#1251403).

  - `/var/db/Makefile` is now shipped in the `nss_db`     package (RHBZ#1498900).

  - The IBM858 character set is now supported     (RHBZ#1416405).

  - The `compat` NSS service module is again part of the     main glibc package (RHBZ#1400538).

  - A pointer alignment/endianess issue was fixed in the NSS     group merging implementation (RHBZ#1471985).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - glibc: realpath() buffer underflow when getcwd() returns     relative path allows privilege escalation     (CVE-2018-1000001)

  - glibc: Buffer overflow in glob with GLOB_TILDE     (CVE-2017-15670)

  - glibc: Buffer overflow during unescaping of user names     with the ~ operator (CVE-2017-15804)

  - glibc: denial of service in getnetbyname function     (CVE-2014-9402)

  - glibc: DNS resolver NULL pointer dereference with     crafted record type (CVE-2015-5180)

  - glibc: Fragmentation attacks possible when EDNS0 is     enabled (CVE-2017-12132)

Additional Changes :

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An integer overflow vulnerability was found in     hcreate() and hcreate_r() functions which could result     in an out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution.(CVE-2015-8778)

  - A stack-based buffer overflow was found in the way the     libresolv library performed dual A/AAAA DNS queries. A     remote attacker could create a specially crafted DNS     response which could cause libresolv to crash or,     potentially, execute code with the permissions of the     user running the library. Note: this issue is only     exposed when libresolv is called from the nss_dns NSS     service module.(CVE-2015-7547)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide     specially-crafted input that, when processed, would     cause the application to crash.(CVE-2013-0242)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is glibc-side mitigation which blocks     processing of LD_LIBRARY_PATH for programs running in     secure-execution mode and reduces the number of     allocations performed by the processing of LD_AUDIT,     LD_PRELOAD, and LD_HWCAP_MASK, making successful     exploitation of this issue more     difficult.(CVE-2017-1000366)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

  - It was found that the files back end of Name Service     Switch (NSS) did not isolate iteration over an entire     database from key-based look-up API calls. An     application performing look-ups on a database while     iterating over it could enter an infinite loop, leading     to a denial of service.(CVE-2014-8121)

  - Stack-based buffer overflow in the getaddrinfo function     in sysdeps/posix/getaddrinfo.c in the GNU C Library     (aka glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458.(CVE-2016-3706)

  - In glibc 2.26 and earlier there is confusion in the     usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer     underflow and potential code     execution.(CVE-2018-1000001)

  - Stack-based buffer overflow in string/strcoll_l.c in     the GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string that triggers a malloc failure and use of     the alloca function.(CVE-2012-4424)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-8777)

  - The glob function in glob.c in the GNU C Library (aka     glibc or libc6) before 2.27 contains a buffer overflow     during unescaping of user names with the ~     operator.(CVE-2017-15804)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on     the files and obtain access to arbitrary     pseudo-terminals by leveraging a FUSE file     system.(CVE-2013-2207)

  - A stack overflow flaw was found in glibc's swscanf()     function. An attacker able to make an application call     the swscanf() function could use this flaw to crash     that application or, potentially, execute arbitrary     code with the permissions of the user running the     application.(CVE-2015-1473)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-4458)

  - A heap-based buffer overflow was found in glibc's
    __nss_hostname_digits_dots() function, which is used by     the gethostbyname() and gethostbyname2() glibc function     calls. A remote attacker able to make an application     call either of these functions could use this flaw to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-0235)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory     allocator functions (pvalloc, valloc, and memalign). If     an application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application.(CVE-2013-4332)

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

  - A stack based buffer overflow vulnerability was found     in the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code.(CVE-2015-8779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

  - The GNU C Library (aka glibc or libc6) before 2.27     contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related     to the processing of home directories using the ~     operator followed by a long string. (CVE-2017-15670)

  - The DNS stub resolver in the GNU C Library (aka glibc or     libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation. (CVE-2017-12132)

  - The glob function in glob.c in the GNU C Library (aka     glibc or libc6) before 2.27 contains a buffer overflow     during unescaping of user names with the ~ operator.
    (CVE-2017-15804)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash). (CVE-2015-5180)

  - The nss_dns implementation of getnetbyname in GNU C     Library (aka glibc) before 2.21, when the DNS backend in     the Name Service Switch configuration is enabled, allows     remote attackers to cause a denial of service (infinite     loop) by sending a positive answer while a network name     is being process. (CVE-2014-9402)

  - In glibc 2.26 and earlier there is confusion in the     usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer     underflow and potential code execution.
    (CVE-2018-1000001)

  - Stack-based buffer overflow in the getaddrinfo function     in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka     glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458. (CVE-2016-3706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The remote host is affected by the vulnerability described in GLSA-201706-19 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library.
      Please review the CVE identifiers and Qualys&rsquo; security advisory       referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code with the privileges of       the process, escalate privileges or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0805 advisory.

  - glibc: denial of service in getnetbyname function (CVE-2014-9402)

  - glibc: DNS resolver NULL pointer dereference with crafted record type (CVE-2015-5180)

  - glibc: Fragmentation attacks possible when EDNS0 is enabled (CVE-2017-12132)

  - glibc: Buffer overflow in glob with GLOB_TILDE (CVE-2017-15670)

  - glibc: Buffer overflow during unescaping of user names with the ~ operator (CVE-2017-15804)

  - glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation     (CVE-2018-1000001)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following issues :

Security issue fixed :

CVE-2015-5180: Fixed a NULL pointer dereference with internal QTYPE (bsc#941234).

Feature work: IBM zSeries arch13 hardware support in glibc added (fate#327072, bsc#1132678)

Other issue addressed: Fixed a concurrency issue with ldconfig (bsc#1117993).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2926:01 advisory.

    * glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation     (CVE-2018-1000001)
    * glibc: Buffer overflow in glob with GLOB_TILDE (CVE-2017-15670)
    * glibc: Buffer overflow during unescaping of user names with the ~ operator (CVE-2017-15804)
    * glibc: denial of service in getnetbyname function (CVE-2014-9402)
    * glibc: DNS resolver NULL pointer dereference with crafted record type (CVE-2015-5180)
    * glibc: Fragmentation attacks possible when EDNS0 is enabled (CVE-2017-12132)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3239-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the strxfrm() function. An attacker could use     this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected     Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8982)

    It was discovered that an integer overflow existed in the _IO_wstr_overflow() function of the GNU C     Library. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This     issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8983)

    It was discovered that the fnmatch() function in the GNU C Library did not properly handle certain     malformed patterns. An attacker could use this to cause a denial of service. This issue only affected     Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8984)

    Alexander Cherepanov discovered a stack-based buffer overflow in the glob implementation of the GNU C     Library. An attacker could use this to specially craft a directory layout and cause a denial of service.
    (CVE-2016-1234)

    Florian Weimer discovered a NULL pointer dereference in the DNS resolver of the GNU C Library. An attacker     could use this to cause a denial of service. (CVE-2015-5180)

    Michael Petlan discovered an unbounded stack allocation in the getaddrinfo() function of the GNU C     Library. An attacker could use this to cause a denial of service. (CVE-2016-3706)

    Aldy Hernandez discovered an unbounded stack allocation in the sunrpc implementation in the GNU C Library.
    An attacker could use this to cause a denial of service. (CVE-2016-4429)

    Tim Ruehsen discovered that the getaddrinfo() implementation in the GNU C Library did not properly track     memory allocations. An attacker could use this to cause a denial of service. This issue only affected     Ubuntu 16.04 LTS. (CVE-2016-5417)

    Andreas Schwab discovered that the GNU C Library on ARM 32-bit platforms did not properly set up execution     contexts. An attacker could use this to cause a denial of service. (CVE-2016-6323)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
104150	Fedora 26 : glibc (2017-2c63df4fe3)	Nessus	Fedora Local Security Checks	2017/10/26	2025/11/17	high
109447	Scientific Linux Security Update : glibc on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	2018/5/1	2024/10/16	critical
125004	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1551)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	critical
127183	NewStart CGSL CORE 5.04 / MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2019-0024)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	critical
203047	Photon OS 1.0: Glibc PHSA-2017-0048	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
100945	GLSA-201706-19 : GNU C Library: Multiple vulnerabilities (Stack Clash)	Nessus	Gentoo Local Security Checks	2017/6/21	2025/12/15	high
108985	RHEL 7 : glibc (RHSA-2018:0805)	Nessus	Red Hat Local Security Checks	2018/4/11	2024/11/7	critical
126337	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2019:1716-1)	Nessus	SuSE Local Security Checks	2019/6/28	2024/5/14	high
288895	MiracleLinux 7 : glibc-2.17-222.el7 (AXSA:2018-2926:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/10	critical
97856	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3239-1)	Nessus	Ubuntu Local Security Checks	2017/3/21	2025/12/29	high

检测

插件搜索

high

critical

critical

critical

high

high

critical

high

critical

high