Multiple vulnerabilities has been found and corrected in glibc :

It was discovered that, under certain circumstances, glibc's getaddrinfo\(\) function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data (CVE-2013-7423).

A buffer overflow flaw was found in the way glibc's gethostbyname_r\(\) and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application (CVE-2015-1781).

The updated packages provides a solution for these security issues.

This update for glibc provides fixes for security and non-security issues.

These security issues have been fixed :

  - CVE-2015-1781: Buffer length after padding in     resolv/nss_dns/dns-host.c. (bsc#927080)

  - CVE-2013-2207: pt_chown did not properly check     permissions for tty files, which allowed local users to     change the permission on the files and obtain access to     arbitrary pseudo-terminals by leveraging a FUSE file     system. (bsc#830257)

  - CVE-2014-8121: DB_LOOKUP in the Name Service Switch     (NSS) did not properly check if a file is open, which     allowed remote attackers to cause a denial of service     (infinite loop) by performing a look-up while the     database is iterated over the database, which triggers     the file pointer to be reset. (bsc#918187)

  - Fix read past end of pattern in fnmatch. (bsc#920338)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc was updated to fix bugs and security issues.

Security issues fixed :

  - A buffer overflow in nss_dns was fixed that could lead     to crashes. (CVE-2015-1781, bsc#927080, BZ #18287)

  - A denial of service attack (out of memory) in the NSS     files backend was fixed (CVE-2014-8121, bsc#918187,     GLIBC BZ #18007)

Non security bugs fixed :

  - Fix regression in threaded application malloc     performance (bsc#915955, GLIBC#17195)

  - Fix read past end of pattern in fnmatch (bsc#920338,     GLIBC#17062, GLIBC#18032, GLIBC#18036)

  - Record TTL also for DNS PTR queries (bsc#928723,     GLIBC#18513)

  - Increase MINSIGSTKSZ and SIGSTKSZ for aarch64     (bsc#931480, GLIBC#16850)

  - Fix handling of IPv6 nameservers (bsc#939211,     GLIBC#13028, GLIBC#17053)

  - Avoid use of asm/ptrace.h (bsc#934084)

  - Do not corrupt the top of a threaded heap if top chunk     is MINSIZE (GLIBC#18502)

  - Terminate unwinding after makecontext_ret on s390     (bsc#940332. bsc#944494, GLIBC#18508)

  - Restore signal mask in set/swapcontext on s390     (bsc#940195, bsc#944494, GLIBC#18080)

  - fix dlopen in static binaries (bsc#937853, GLIBC#17250)

  - Properly reread entry after failure in nss_files getent     function (bsc#945779, BZ #18991)

Features added :

  - AVX512 support (fate#318844)

  - Add compatibility symlinks for LSB 3.0 (fate#318933)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been fixed in the GNU C Library, eglibc.

The CVE-2015-7547 vulnerability listed below is considered to have critical impact.

  - CVE-2014-8121     Robin Hack discovered that the nss_files database did     not correctly implement enumeration interleaved with     name-based or ID-based lookups. This could cause the     enumeration enter an endless loop, leading to a denial     of service.

  - CVE-2015-1781     Arjun Shankar discovered that the _r variants of host     name resolution functions (like gethostbyname_r), when     performing DNS name resolution, suffered from a buffer     overflow if a misaligned buffer was supplied by the     applications, leading to a crash or, potentially,     arbitrary code execution. Most applications are not     affected by this vulnerability because they use aligned     buffers.

  - CVE-2015-7547     The Google Security Team and Red Hat discovered that the     eglibc host name resolver function, getaddrinfo, when     processing AF_UNSPEC queries (for dual A/AAAA lookups),     could mismanage its internal buffers, leading to a     stack-based buffer overflow and arbitrary code     execution. This vulnerability affects most applications     which perform host name resolution using getaddrinfo,     including system services.

  - CVE-2015-8776     Adam Nielsen discovered that if an invalid separated     time value is passed to strftime, the strftime function     could crash or leak information. Applications normally     pass only valid time information to strftime; no     affected applications are known.

  - CVE-2015-8777     Hector Marco-Gisbert reported that LD_POINTER_GUARD was     not ignored for SUID programs, enabling an unintended     bypass of a security feature. This update causes eglibc     to always ignore the LD_POINTER_GUARD environment     variable.

  - CVE-2015-8778     Szabolcs Nagy reported that the rarely-used hcreate and     hcreate_r functions did not check the size argument     properly, leading to a crash (denial of service) for     certain arguments. No impacted applications are known at     this time.

  - CVE-2015-8779     The catopen function contains several unbound stack     allocations (stack overflows), causing it the crash the     process (denial of service). No applications where this     issue has a security impact are currently known.

The following fixed vulnerabilities currently lack CVE assignment :

  - Joseph Myers reported that an integer overflow in the     strxfrm can lead to heap-based buffer overflow, possibly     allowing arbitrary code execution. In addition, a     fallback path in strxfrm uses an unbounded stack     allocation (stack overflow), leading to a crash or     erroneous application behavior.
  - Kostya Serebryany reported that the fnmatch function     could skip over the terminating NUL character of a     malformed pattern, causing an application calling     fnmatch to crash (denial of service).

  - Joseph Myers reported that the IO_wstr_overflow     function, internally used by wide-oriented character     streams, suffered from an integer overflow, leading to a     heap-based buffer overflow. On GNU/Linux systems,     wide-oriented character streams are rarely used, and no     affected applications are known.

  - Andreas Schwab reported a memory leak (memory allocation     without a matching deallocation) while processing     certain DNS answers in getaddrinfo, related to the
    _nss_dns_gethostbyname4_r function. This vulnerability     could lead to a denial of service.

While it is only necessary to ensure that all processes are not using the old eglibc anymore, it is recommended to reboot the machines after applying the security upgrade.

This update for glibc fixes the following issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

  - CVE-2013-2207: pt_chown tricked into granting access to     another users pseudo-terminal (bsc#830257)

  - CVE-2013-4458: Stack (frame) overflow in getaddrinfo()     when called with AF_INET6 (bsc#847227)

  - CVE-2014-8121: denial of service issue in the NSS     backends (bsc#918187)

  - bsc#920338: Read past end of pattern in fnmatch

  - CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
83170	Mandriva Linux Security Advisory : glibc (MDVSA-2015:218)	Nessus	Mandriva Local Security Checks	2015/5/1	2021/1/14	medium
85624	SUSE SLED11 / SLES11 Security Update : glibc (SUSE-SU-2015:1424-1)	Nessus	SuSE Local Security Checks	2015/8/25	2021/1/6	medium
86696	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2015:1844-1)	Nessus	SuSE Local Security Checks	2015/11/2	2021/1/6	medium
88767	Debian DSA-3480-1 : eglibc - security update	Nessus	Debian Local Security Checks	2016/2/17	2024/6/18	critical
88831	SUSE SLES11 Security Update : glibc (SUSE-SU-2016:0470-1)	Nessus	SuSE Local Security Checks	2016/2/18	2024/6/18	critical

检测

插件搜索

medium

medium

medium

critical

critical