This update for glibc fixes the following issues :

  - glob-altdirfunc.patch: Do not copy d_name field of     struct dirent (CVE-2016-1234, boo#969727, BZ #19779)

  - nss-dns-memleak-2.patch: fix memory leak in
    _nss_dns_gethostbyname4_r (boo#973010)

  - nss-dns-getnetbyname.patch: fix stack overflow in
    _nss_dns_getnetbyname_r (CVE-2016-3075, boo#973164, BZ     #19879)

  - getaddrinfo-hostent-conv-stack-overflow.patch:
    getaddrinfo stack overflow in hostent conversion     (CVE-2016-3706, boo#980483, BZ #20010)

  - clntudp-call-alloca.patch: do not use alloca in     clntudp_call (CVE-2016-4429, boo#980854, BZ #20112)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3239-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the strxfrm() function. An attacker could use     this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected     Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8982)

    It was discovered that an integer overflow existed in the _IO_wstr_overflow() function of the GNU C     Library. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This     issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8983)

    It was discovered that the fnmatch() function in the GNU C Library did not properly handle certain     malformed patterns. An attacker could use this to cause a denial of service. This issue only affected     Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8984)

    Alexander Cherepanov discovered a stack-based buffer overflow in the glob implementation of the GNU C     Library. An attacker could use this to specially craft a directory layout and cause a denial of service.
    (CVE-2016-1234)

    Florian Weimer discovered a NULL pointer dereference in the DNS resolver of the GNU C Library. An attacker     could use this to cause a denial of service. (CVE-2015-5180)

    Michael Petlan discovered an unbounded stack allocation in the getaddrinfo() function of the GNU C     Library. An attacker could use this to cause a denial of service. (CVE-2016-3706)

    Aldy Hernandez discovered an unbounded stack allocation in the sunrpc implementation in the GNU C Library.
    An attacker could use this to cause a denial of service. (CVE-2016-4429)

    Tim Ruehsen discovered that the getaddrinfo() implementation in the GNU C Library did not properly track     memory allocations. An attacker could use this to cause a denial of service. This issue only affected     Ubuntu 16.04 LTS. (CVE-2016-5417)

    Andreas Schwab discovered that the GNU C Library on ARM 32-bit platforms did not properly set up execution     contexts. An attacker could use this to cause a denial of service. (CVE-2016-6323)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc provides the following fixes :

  - Increase DTV_SURPLUS limit. (bsc#968787)

  - Do not copy d_name field of struct dirent.
    (CVE-2016-1234, bsc#969727)

  - Fix memory leak in _nss_dns_gethostbyname4_r.
    (bsc#973010)

  - Fix stack overflow in _nss_dns_getnetbyname_r.
    (CVE-2016-3075, bsc#973164)

  - Fix malloc performance regression from SLE 11.
    (bsc#975930)

  - Fix getaddrinfo stack overflow in hostent conversion.
    (CVE-2016-3706, bsc#980483)

  - Do not use alloca in clntudp_call. (CVE-2016-4429,     bsc#980854)

  - Remove mtrace.1, now included in the man-pages package.
    (bsc#967190)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - Drop old fix that could break services that start before     IPv6 is up. (bsc#931399)

  - Do not copy d_name field of struct dirent.
    (CVE-2016-1234, bsc#969727)

  - Fix memory leak in _nss_dns_gethostbyname4_r.
    (bsc#973010)

  - Relocate DSOs in dependency order, fixing a potential     crash during symbol relocation phase. (bsc#986302)

  - Fix nscd assertion failure in gc. (bsc#965699)

  - Fix stack overflow in _nss_dns_getnetbyname_r.
    (CVE-2016-3075, bsc#973164)

  - Fix getaddrinfo stack overflow in hostent conversion.
    (CVE-2016-3706, bsc#980483)

  - Do not use alloca in clntudp_call. (CVE-2016-4429,     bsc#980854)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc provides the following fixes :

  - Increase DTV_SURPLUS limit. (bsc#968787)

  - Do not copy d_name field of struct dirent.
    (CVE-2016-1234, bsc#969727)

  - Fix memory leak in _nss_dns_gethostbyname4_r.
    (bsc#973010)

  - Fix stack overflow in _nss_dns_getnetbyname_r.
    (CVE-2016-3075, bsc#973164)

  - Fix malloc performance regression from SLE 11.
    (bsc#975930)

  - Fix getaddrinfo stack overflow in hostent conversion.
    (CVE-2016-3706, bsc#980483)

  - Do not use alloca in clntudp_call. (CVE-2016-4429,     bsc#980854)

  - Remove mtrace.1, now included in the man-pages package.
    (bsc#967190)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91534	openSUSE Security Update : glibc (openSUSE-2016-699)	Nessus	SuSE Local Security Checks	2016/6/9	2021/1/19	high
97856	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3239-1)	Nessus	Ubuntu Local Security Checks	2017/3/21	2025/12/29	high
93175	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2016:1733-1)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	high
93309	SUSE SLES11 Security Update : glibc (SUSE-SU-2016:2156-1)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	high
91987	openSUSE Security Update : glibc (openSUSE-2016-852)	Nessus	SuSE Local Security Checks	2016/7/11	2021/1/19	critical

检测

插件搜索

high

high

high

high

critical