Advisories ยป MGASA-2013-0340

Updated glibc package fixes security vulnerabilities

Publication date: 22 Nov 2013
Modification date: 22 Nov 2013
Type: security
Affected Mageia releases : 2 , 3
CVE: CVE-2012-4412 , CVE-2012-4424 , CVE-2013-2207 , CVE-2013-4237 , CVE-2013-4332 , CVE-2013-4458 , CVE-2013-4788

Description

Updated glibc packages fixes the following security issues:

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc
or libc6) 2.17 and earlier allows context-dependent attackers to cause
a denial of service (crash) or possibly execute arbitrary code via a
long string, which triggers a heap-based buffer overflow. (CVE-2012-4412)

Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library
(aka glibc or libc6) 2.17 and earlier allows context-dependent
attackers to cause a denial of service (crash) or possibly execute
arbitrary code via a long string that triggers a malloc failure and
use of the alloca function. (CVE-2012-4424)

pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not
properly check permissions for tty files, which allows local users to
change the permission on the files and obtain access to arbitrary
pseudo-terminals by leveraging a FUSE file system. (CVE-2013-2207)
NOTE! This is fixed by removing pt_chown wich may break chroots
      if their devpts was not mounted correctly. 
      (make sure to mount the devpts correctly with gid=5)

sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6)
2.18 and earlier allows context-dependent attackers to cause a denial
of service (out-of-bounds write and crash) or possibly execute
arbitrary code via a crafted (1) NTFS or (2) CIFS image. (CVE-2013-4237)

Multiple integer overflows in malloc/malloc.c in the GNU C Library
(aka glibc or libc6) 2.18 and earlier allow context-dependent
attackers to cause a denial of service (heap corruption) via a large
value to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4)
memalign, or (5) aligned_alloc functions. (CVE-2013-4332)

A stack (frame) overflow flaw, which led to a denial of service 
(application crash), was found in the way glibc's getaddrinfo() function
processed certain requests when called with AF_INET6. A similar flaw to
CVE-2013-1914, this affects AF_INET6 rather than AF_UNSPEC (CVE-2013-4458).

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6)
2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize
the random value for the pointer guard, which makes it easier for context-
dependent attackers to control execution flow by leveraging a buffer-
overflow vulnerability in an application and using the known zero value
pointer guard to calculate a pointer address. (CVE-2013-4788)

Other fixes in this update:
- Correct the processing of '\x80' characters in crypt_freesec.c
- drop minimal required kernel to 2.6.32 so it works in chroots on top
  of enterprise kernels and for OpenVZ users.
- fix typo in nscd.service

References

SRPMS

2/core

3/core