- Locale names, including those obtained from environment     variables (LANG and the LC_* variables), are more     tightly checked for proper syntax. setlocale will now     fail (with EINVAL) for locale names that are overly     long, contain slashes without starting with a slash, or     contain '..' path components. (CVE-2014-0475)     Previously, some valid locale names were silently     replaced with the 'C' locale when running in AT_SECURE     mode (e.g., in a SUID program). This is no longer     necessary because of the additional checks.

  - Support for loadable gconv transliteration modules has     been removed because it did not work at all. Regular     gconv conversion modules are still supported.
    (CVE-2014-5119)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1110 advisory.

    [2.12-1.132.4]
    - Remove gconv transliteration loadable modules support (CVE-2014-5119,
      - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated glibc packages that fix two security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119)

A directory traversal flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475)

Red Hat would like to thank Stephane Chazelas for reporting CVE-2014-0475.

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application.

Updated glibc packages fix security vulnerabilities :

Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC_* and LANG variables. Together with typical OpenSSH configurations (with suitable AcceptEnv settings in sshd_config), this could conceivably be used to bypass ForceCommand restrictions (or restricted shells), assuming the attacker has sufficient level of access to a file system location on the host to create crafted locale definitions there (CVE-2014-0475).

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where posix_spawn_file_actions_addopen fails to copy the path argument (glibc bz #17048) which can, in conjunction with many common memory management techniques from an application, lead to a use after free, or other vulnerabilities (CVE-2014-4043).

This update also fixes the following issues: x86: Disable x87 inline functions for SSE2 math (glibc bz #16510) malloc: Fix race in free() of fastbin chunk (glibc bz #15073)

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.

This update removes support of loadable gconv transliteration modules.
Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose (CVE-2014-5119).

Adhemerval Zanella Netto discovered out-of-bounds reads in additional code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) that can be used to crash the systems, causing a denial of service conditions (CVE-2014-6040).

The function wordexp() fails to properly handle the WRDE_NOCMD flag when processing arithmetic inputs in the form of '$((... ))' where '...' can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDE_NOCMD forbade command substitution. This allows an attacker to attempt to pass dangerous commands via constructs of the above form, and bypass the WRDE_NOCMD flag. This update fixes the issue (CVE-2014-7817).

The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not properly restrict the use of the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers (CVE-2012-3406).

The nss_dns implementation of getnetbyname could run into an infinite loop if the DNS response contained a PTR record of an unexpected format (CVE-2014-9402).

Also glibc lock elision (new feature in glibc 2.18) has been disabled as it can break glibc at runtime on newer Intel hardware (due to hardware bug)

Under certain conditions wscanf can allocate too little memory for the to-be-scanned arguments and overflow the allocated buffer (CVE-2015-1472).

The incorrect use of '__libc_use_alloca (newsize)' caused a different (and weaker) policy to be enforced which could allow a denial of service attack (CVE-2015-1473).

This glibc update fixes a critical privilege escalation problem and the following security and non-security issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#882600: Copy filename argument in     posix_spawn_file_actions_addopen. (CVE-2014-4043)

  - bnc#860501: Use O_LARGEFILE for utmp file.

  - bnc#842291: Fix typo in     glibc-2.5-dlopen-lookup-race.diff.

  - bnc#839870: Fix integer overflows in malloc.
    (CVE-2013-4332)

  - bnc#834594: Fix readdir_r with long file names.
    (CVE-2013-4237)

  - bnc#824639: Drop lock before calling malloc_printerr.

  - bnc#801246: Fix buffer overrun in regexp matcher.
    (CVE-2013-0242)

  - bnc#779320: Fix buffer overflow in strcoll.
    (CVE-2012-4412)

  - bnc#894556 / bnc#894553: Fix crashes on invalid input in     IBM gconv modules. (CVE-2014-6040, CVE-2012-6656,     bnc#894553, bnc#894556, BZ#17325, BZ#14134)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation problem and two additional issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#836746: Avoid race between {, __de}allocate_stack     and __reclaim_stacks during fork.

  - bnc#844309: Fixed various overflows, reading large     /etc/hosts or long names. (CVE-2013-4357)

  - bnc#894553, bnc#894556: Fixed various crashes on invalid     input in IBM gconv modules. (CVE-2014-6040,     CVE-2012-6656)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation problem and two non-security issues :

  - An off-by-one error leading to a heap-based buffer     overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119). (bnc#892073)

  - setenv-alloca.patch: Avoid unbound alloca in setenv.
    (bnc#892065)

  - printf-multibyte-format.patch: Don't parse %s format     argument as multi-byte string. (bnc#888347)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc)     allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via     vectors related to the CHARSET environment variable and gconv transliteration modules. (CVE-2014-5119)

Note that Nessus relies on the presence of the package as reported by the vendor.

An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119)

A directory traversal flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475)

glibc was updated to fix three security issues :

  - A directory traversal in locale environment handling was     fixed (CVE-2014-0475, bnc#887022, GLIBC BZ #17137)

  - Disable gconv transliteration module loading which could     be used for code execution (CVE-2014-5119, bnc#892073,     GLIBC BZ #17187)

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, bnc#894553, BZ #17325)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1118 advisory.

    The glibc packages contain the standard C libraries used by multiple     programs on the system. These packages contain the standard C and the     standard math libraries. Without these two libraries, a Linux system cannot     function properly.

    An off-by-one heap-based buffer overflow flaw was found in glibc's internal
    __gconv_translit_find() function. An attacker able to make an application     call the iconv_open() function with a specially crafted argument could     possibly use this flaw to execute arbitrary code with the privileges of     that application. (CVE-2014-5119)

    All glibc users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
77430	Fedora 20 : glibc-2.18-14.fc20 (2014-9824)	Nessus	Fedora Local Security Checks	2014/8/29	2021/1/11	high
77463	Oracle Linux 5 / 6 / 7 : glibc (ELSA-2014-1110)	Nessus	Oracle Linux Local Security Checks	2014/8/30	2024/11/1	critical
77464	RHEL 5 / 6 / 7 : glibc (RHSA-2014:1110)	Nessus	Red Hat Local Security Checks	2014/8/30	2021/1/14	high
78342	Amazon Linux AMI : glibc (ALAS-2014-399)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	high
82421	Mandriva Linux Security Advisory : glibc (MDVSA-2015:168)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	high
83638	SUSE SLES10 Security Update : glibc (SUSE-SU-2014:1128-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
83639	SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1129-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
77673	SuSE 11.3 Security Update : glibc (SAT Patch Number 9669)	Nessus	SuSE Local Security Checks	2014/9/13	2021/1/19	high
218336	Linux Distros Unpatched Vulnerability : CVE-2014-5119	Nessus	Misc.	2025/3/4	2026/1/28	critical
77465	Scientific Linux Security Update : glibc on SL5.x, SL6.x i386/x86_64 (20140829)	Nessus	Scientific Linux Local Security Checks	2014/8/30	2021/1/14	high
77659	openSUSE Security Update : glibc (openSUSE-SU-2014:1115-1)	Nessus	SuSE Local Security Checks	2014/9/12	2021/1/19	high
79044	RHEL 6 : glibc (RHSA-2014:1118)	Nessus	Red Hat Local Security Checks	2014/11/8	2025/4/15	critical

检测

插件搜索

high

critical

high

high

high

high

high

high

critical

high

high

critical