Updated glibc packages fixes the following security issues :

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow (CVE-2012-4412).

Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function (CVE-2012-4424).

pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system (CVE-2013-2207).
NOTE! This is fixed by removing pt_chown wich may break chroots if their devpts was not mounted correctly (make sure to mount the devpts correctly with gid=5).

sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted (1) NTFS or (2) CIFS image (CVE-2013-4237).

Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4) memalign, or (5) aligned_alloc functions (CVE-2013-4332).

A stack (frame) overflow flaw, which led to a denial of service (application crash), was found in the way glibc's getaddrinfo() function processed certain requests when called with AF_INET6. A similar flaw to CVE-2013-1914, this affects AF_INET6 rather than AF_UNSPEC (CVE-2013-4458).

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context- dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address (CVE-2013-4788).

Other fixes in this update :

  - Correct the processing of '\x80' characters in     crypt_freesec.c

    - fix typo in nscd.service

This update for glibc contains the following fixes :

  - Fix integer overflows in malloc. (CVE-2013-4332,     bnc#839870)

  - Fix buffer overflow in glob. (bnc#691365)

  - Fix buffer overflow in strcoll. (CVE-2012-4412,     bnc#779320)

  - Update mount flags in <sys/mount.h>. (bnc#791928)

  - Fix buffer overrun in regexp matcher. (CVE-2013-0242,     bnc#801246)

  - Fix memory leaks in dlopen. (bnc#811979)

  - Fix stack overflow in getaddrinfo with many results.
    (CVE-2013-1914, bnc#813121)

  - Don't raise UNDERFLOW in tan/tanf for small but normal     argument. (bnc#819347)

  - Properly cross page boundary in SSE4.2 implementation of     strcmp. (bnc#822210)

  - Fix robust mutex handling after fork. (bnc#827811)

  - Fix missing character in IBM-943 charset. (bnc#828235)

  - Fix use of alloca in gaih_inet. (bnc#828637)

  - Initialize pointer guard also in static executables.
    (CVE-2013-4788, bnc#830268)

  - Fix readdir_r with long file names. (CVE-2013-4237,     bnc#834594)

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library.

#553206 CVE-2015-1472 CVE-2015-1473

The scanf family of functions do not properly limit stack allocation, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2012-3405

The printf family of functions do not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service.

CVE-2012-3406

The printf family of functions do not properly limit stack allocation, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string.

CVE-2012-3480

Multiple integer overflows in the strtod, strtof, strtold, strtod_l, and other related functions allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

CVE-2012-4412

Integer overflow in the strcoll and wcscoll functions allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.

CVE-2012-4424

Stack-based buffer overflow in the strcoll and wcscoll functions allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.

CVE-2013-0242

Buffer overflow in the extend_buffers function in the regular expression matcher allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.

CVE-2013-1914 CVE-2013-4458

Stack-based buffer overflow in the getaddrinfo function allows remote attackers to cause a denial of service (crash) via a hostname or IP address that triggers a large number of domain conversion results.

CVE-2013-4237

readdir_r allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a malicious NTFS image or CIFS service.

CVE-2013-4332

Multiple integer overflows in malloc/malloc.c allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the pvalloc, valloc, posix_memalign, memalign, or aligned_alloc functions.

CVE-2013-4357

The getaliasbyname, getaliasbyname_r, getaddrinfo, getservbyname, getservbyname_r, getservbyport, getservbyport_r, and glob functions do not properly limit stack allocation, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2013-4788

When the GNU C library is statically linked into an executable, the PTR_MANGLE implementation does not initialize the random value for the pointer guard, so that various hardening mechanisms are not effective.

CVE-2013-7423

The send_dg function in resolv/res_send.c does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.

CVE-2013-7424

The getaddrinfo function may attempt to free an invalid pointer when handling IDNs (Internationalised Domain Names), which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2014-4043

The posix_spawn_file_actions_addopen function does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

For the oldstable distribution (squeeze), these problems have been fixed in version 2.11.3-4+deb6u5.

For the stable distribution (wheezy), these problems were fixed in version 2.13-38+deb7u8 or earlier.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation vulnerability and the following security and non-security issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#886416: Avoid redundant shift character in iconv     output at block boundary.

  - bnc#883022: Initialize errcode in     sysdeps/unix/opendir.c.

  - bnc#882600: Copy filename argument in     posix_spawn_file_actions_addopen. (CVE-2014-4043)

  - bnc#864081: Take lock in pthread_cond_wait cleanup     handler only when needed.

  - bnc#843735: Don't crash on unresolved weak symbol     reference.

  - bnc#839870: Fix integer overflows in malloc.
    (CVE-2013-4332)

  - bnc#836746: Avoid race between {,__de}allocate_stack and
    __reclaim_stacks during fork.

  - bnc#834594: Fix readdir_r with long file names.
    (CVE-2013-4237)

  - bnc#830268: Initialize pointer guard also in static     executables. (CVE-2013-4788)

  - bnc#801246: Fix buffer overrun in regexp matcher.
    (CVE-2013-0242)

  - bnc#779320: Fix buffer overflow in strcoll.
    (CVE-2012-4412)

  - bnc#750741: Use absolute timeout in x86     pthread_cond_timedwait.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions (pvalloc, valloc, and memalign). If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-4332)

A flaw was found in the regular expression matching routines that process multibyte character input. If an application utilized the glibc regular expression matching mechanism, an attacker could provide specially crafted input that, when processed, would cause the application to crash. (CVE-2013-0242)

It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash. (CVE-2013-1914)

Among other changes, this update includes an important fix for the following bug :

  - Due to a defect in the initial release of the     getaddrinfo() system call in Scientific Linux 6.0,     AF_INET and AF_INET6 queries resolved from the     /etc/hosts file returned queried names as canonical     names. This incorrect behavior is, however, still     considered to be the expected behavior. As a result of a     recent change in getaddrinfo(), AF_INET6 queries started     resolving the canonical names correctly. However, this     behavior was unexpected by applications that relied on     queries resolved from the /etc/hosts file, and these     applications could thus fail to operate properly. This     update applies a fix ensuring that AF_INET6 queries     resolved from /etc/hosts always return the queried name     as canonical. Note that DNS lookups are resolved     properly and always return the correct canonical names.
    A proper fix to AF_INET6 queries resolution from     /etc/hosts may be applied in future releases; for now,     due to a lack of standard, Red Hat suggests the first     entry in the /etc/hosts file, that applies for the IP     address being resolved, to be considered the canonical     entry.

This glibc update fixes a critical privilege escalation problem and the following security and non-security issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#882600: Copy filename argument in     posix_spawn_file_actions_addopen. (CVE-2014-4043)

  - bnc#860501: Use O_LARGEFILE for utmp file.

  - bnc#842291: Fix typo in     glibc-2.5-dlopen-lookup-race.diff.

  - bnc#839870: Fix integer overflows in malloc.
    (CVE-2013-4332)

  - bnc#834594: Fix readdir_r with long file names.
    (CVE-2013-4237)

  - bnc#824639: Drop lock before calling malloc_printerr.

  - bnc#801246: Fix buffer overrun in regexp matcher.
    (CVE-2013-0242)

  - bnc#779320: Fix buffer overflow in strcoll.
    (CVE-2012-4412)

  - bnc#894556 / bnc#894553: Fix crashes on invalid input in     IBM gconv modules. (CVE-2014-6040, CVE-2012-6656,     bnc#894553, bnc#894556, BZ#17325, BZ#14134)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote VMware ESXi host is version 5.5 prior to build 1623387. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist in the     bundled GNU C Library (glibc) due to improper validation     of user-supplied input. A remote attacker can exploit     these issues to cause a buffer overflow, resulting in a     denial of service condition. (CVE-2013-4332)

  - A flaw exists in the monlist feature in NTP. A remote     attacker can exploit this flaw, using a specially     crafted packet to load the query function in monlist, to     conduct a distributed denial of service attack.
    (CVE-2013-5211)

Existing statically linked applications must be rebuilt to fix CVE-2013-4788.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1411 advisory.

    [2.5-118.2]
    - Fix integer overflows in *valloc and memalign. (#1011804).

    [2.5-118.1]
    - Add support for newer L3 caches on x86-64 and correctly count       the number of hardware threads sharing a cacheline (#1011424).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions (pvalloc, valloc, and memalign). If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-4332)

This update also fixes the following bug :

  - Prior to this update, the size of the L3 cache in     certain CPUs for SMP (Symmetric Multiprocessing) servers     was not correctly detected. The incorrect cache size     detection resulted in less than optimal performance for     routines that used this information, including the     memset() function. To fix this bug, the cache size     detection has been corrected and core routines including     memset() have their performance restored to expected     levels.

Updated glibc packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions (pvalloc, valloc, and memalign). If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-4332)

A flaw was found in the regular expression matching routines that process multibyte character input. If an application utilized the glibc regular expression matching mechanism, an attacker could provide specially crafted input that, when processed, would cause the application to crash. (CVE-2013-0242)

It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash. (CVE-2013-1914)

Among other changes, this update includes an important fix for the following bug :

* Due to a defect in the initial release of the getaddrinfo() system call in Red Hat enterprise Linux 6.0, AF_INET and AF_INET6 queries resolved from the /etc/hosts file returned queried names as canonical names. This incorrect behavior is, however, still considered to be the expected behavior. As a result of a recent change in getaddrinfo(), AF_INET6 queries started resolving the canonical names correctly.
However, this behavior was unexpected by applications that relied on queries resolved from the /etc/hosts file, and these applications could thus fail to operate properly. This update applies a fix ensuring that AF_INET6 queries resolved from /etc/hosts always return the queried name as canonical. Note that DNS lookups are resolved properly and always return the correct canonical names. A proper fix to AF_INET6 queries resolution from /etc/hosts may be applied in future releases; for now, due to a lack of standard, Red Hat suggests the first entry in the /etc/hosts file, that applies for the IP address being resolved, to be considered the canonical entry.
(BZ#1022022)

These updated glibc packages also include additional bug fixes and various enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1605 advisory.

    - Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951213).
    - Fix multibyte character processing crash in regexp (CVE-2013-0242, #951213).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated glibc packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions (pvalloc, valloc, and memalign). If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-4332)

This update also fixes the following bug :

* Prior to this update, the size of the L3 cache in certain CPUs for SMP (Symmetric Multiprocessing) servers was not correctly detected.
The incorrect cache size detection resulted in less than optimal performance for routines that used this information, including the memset() function. To fix this bug, the cache size detection has been corrected and core routines including memset() have their performance restored to expected levels. (BZ#1011424)

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote VMware ESXi host is version 5.1 prior to build 2323236. It is, therefore, affected by the following vulnerabilities in bundled third-party libraries :

  - Multiple vulnerabilities exist in the bundled Python     library. (CVE-2011-3389, CVE-2012-0845, CVE-2012-0876,     CVE-2012-1150, CVE-2013-1752, CVE-2013-4238)

  - Multiple vulnerabilities exist in the bundled GNU C     Library (glibc). (CVE-2013-0242, CVE-2013-1914,     CVE-2013-4332)

  - Multiple vulnerabilities exist in the bundled XML     Parser library (libxml2). (CVE-2013-2877, CVE-2014-0191)

  - Multiple vulnerabilities exist in the bundled cURL     library (libcurl). (CVE-2014-0015, CVE-2014-0138)

It was discovered that the GNU C Library incorrectly handled the strcoll() function. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2012-4412, CVE-2012-4424)

It was discovered that the GNU C Library incorrectly handled multibyte characters in the regular expression matcher. An attacker could use this issue to cause a denial of service. (CVE-2013-0242)

It was discovered that the GNU C Library incorrectly handled large numbers of domain conversion results in the getaddrinfo() function. An attacker could use this issue to cause a denial of service.
(CVE-2013-1914)

It was discovered that the GNU C Library readdir_r() function incorrectly handled crafted NTFS or CIFS images. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2013-4237)

It was discovered that the GNU C Library incorrectly handled memory allocation. An attacker could use this issue to cause a denial of service. (CVE-2013-4332).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
71092	Mandriva Linux Security Advisory : glibc (MDVSA-2013:283)	Nessus	Mandriva Local Security Checks	2013/11/26	2021/1/6	high
71308	SuSE 11.3 Security Update : glibc (SAT Patch Number 8337)	Nessus	SuSE Local Security Checks	2013/12/10	2021/1/19	high
82149	Debian DLA-165-1 : eglibc security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	high
83637	SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1122-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
71193	Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	2013/12/4	2021/1/14	medium
83638	SUSE SLES10 Security Update : glibc (SUSE-SU-2014:1128-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
83781	ESXi 5.5 < Build 1623387 Multiple Vulnerabilities (remote check)	Nessus	Misc.	2015/5/22	2018/8/6	medium
70180	Fedora 19 : glibc-2.17-18.fc19 (2013-17475)	Nessus	Fedora Local Security Checks	2013/9/28	2021/1/11	medium
70363	Oracle Linux 5 : glibc (ELSA-2013-1411)	Nessus	Oracle Linux Local Security Checks	2013/10/10	2025/4/29	high
70393	Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20131008)	Nessus	Scientific Linux Local Security Checks	2013/10/11	2021/1/14	medium
71009	RHEL 6 : glibc (RHSA-2013:1605)	Nessus	Red Hat Local Security Checks	2013/11/21	2021/1/14	medium
71106	Oracle Linux 6 : glibc (ELSA-2013-1605)	Nessus	Oracle Linux Local Security Checks	2013/11/27	2025/4/29	high
79155	CentOS 5 : glibc (CESA-2013:1411)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium
79166	CentOS 6 : glibc (CESA-2013:1605)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium
79862	ESXi 5.1 < Build 2323236 Third-Party Libraries Multiple Vulnerabilities (remote check) (BEAST)	Nessus	Misc.	2014/12/12	2022/12/5	medium
70538	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : eglibc vulnerabilities (USN-1991-1)	Nessus	Ubuntu Local Security Checks	2013/10/22	2019/9/19	high

检测

插件搜索

high

high

high

high

medium

high

medium

medium

high

medium

medium

high

medium

medium

medium

high