U radu programskog paketa glibc uočena je sigurnosna ranjivost koju potencijalni napadač može iskoristiti za izvršavanje proizvoljnog programskog koda.

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-0018
2012-01-02 21:22:41
--------------------------------------------------------------------------------

Name        : glibc
Product     : Fedora 15
Version     : 2.14.1
Release     : 5
URL         : http://www.gnu.org/software/glibc/
Summary     : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.

--------------------------------------------------------------------------------
Update Information:

Revert change from -6 which filtered out GLIBC_PRIVATE symbols.  Not appropriate
for an update release.

Check values from TZ file header (#767696)
Convert tzdata-update to lua (#743034)
Mark __clone as .cantunwind (#749556)
Update to 2.24.1 release
Correctly reparse group line after enlarging the buffer (#739360)
Avoid race between {,de}allocate_stack and reclaim_stacks during fork
--------------------------------------------------------------------------------
ChangeLog:

* Sun Jan  1 2012 Jeff Law  <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14.1-5
- Revert change from -6 which filtered out GLIBC_PRIVATE symbols.
* Mon Dec 19 2011 Jeff Law  <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14.1-4
- Check values from TZ file header (#767696)
* Fri Oct 28 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14.1-2
- Convert tzdata-update to lua (#743034)
- Mark __clone as .cantunwind (#749556)
* Fri Oct  7 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14.1-1
- Update to 2.14.1 release
  - Correctly reparse group line after enlarging the buffer (#739360)
  - Avoid race between {,__de}allocate_stack and __reclaim_stacks during fork
* Thu Sep  8 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-7
- Update from 2.14 branch
  - Fix cfi directive in audit trampoline code
  - Correct cycle detection during dependency sorting (BZ#11724)
  - Fix fopen (non-existing-file, "re") errno (BZ#13114)
  - Fix CFI info in x86-64 trampolines
* Mon Aug 15 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-6
- Update from 2.14 branch
  - Locale-independent parsing in libintl (#726536)
  - Fix stack alignment on x86_64 (#728762)
- Filter out GLIBC_PRIVATE symbols again
* Fri Aug  5 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-5
- Update from 2.14 branch
  - Properly tokenize nameserver line for servers with IPv6 address
  - Fix encoding name for IDN in getaddrinfo (#725755)
  - Fix inline strncat/strncmp on x86
  - Fix check for AVX enablement (BZ#13007)
  - Check for overflows in expressions (BZ#12852)
  - Force La_x86_64_ymm to be 16-byte aligned
  - Fix alloca accounting in strxfm
  - Avoid possible crashes in anormal nscd exits
  - Handle Lustre filesystem (BZ#12868)
  - Handle W; without long options in getopt (BZ#12922)
  - Change error code for underflows in strtod (BZ#9696)
  - Fix robust mutex handling after fork
  - Make sure RES_USE_INET6 is always restored
  - Fix quoting in some installed shell scripts (#726483)
- Use eabi for arm
* Tue Jun 28 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-4
- Update from 2.14 branch
  - Fix crash in GB18030 encoder (#712901)
- Fix more bugs in GB18030 charmap
- Don't use gethostbyaddr to determine canonical name
* Tue Jun 21 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-3
- Update from 2.14 branch
  - Fix typo in recent resolver change which causes segvs (#710279)
  - Fix memory leak in getaddrinfo (#712178)
  - Fix <bits/mqueue2.h> for C++ (BZ#12841)
  - Assume Intel Core i3/i5/i7 processor if AVX is available
- Filter results from gethostbyname4_r according to request flags
  (#711827)
- Repair GB18030 charmap (#712901)
- Revert "Use .machine to prevent AS from complaining about z9-109
  instructions in iconv modules" (#711330)
* Fri Jun  3 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-2
- Revert "Handle DNS server failures in case of AF_UNSPEC lookups
  correctly" (#710279)
* Tue May 31 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.14-1
- Update to 2.14 release
  - Handle DNS server failures in case of AF_UNSPEC lookups correctly
    (BZ#12684)
  - Prevent loader from loading itself
  - Restore _res correctly (BZ#12350)
  - Interpret numeric values in shadow file as signed (BZ#11099)
  - Recognize use-vc option in resolv.conf (BZ#11558)
  - Mark malloc hook variables as deprecated
  - Declare malloc hook variables as volatile (BZ#11781)
  - Don't document si_code used for raise (BZ#11799)
  - Fix unnecessary overallocation due to incomplete character (BZ#12811)
  - Handle failure of _nl_explode_name in all cases
  - Add support for time syscall in vDSO (BZ#12813)
  - Add sendmmsg and setns syscalls
  - Use getcpu definition from vDSO on x86-64 (BZ#12813)
- Don't free non-malloced memory and fix memory leak (#709267)
* Fri May 27 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.13.90-14
- Update from master
  - Fix conversion to ISO-2022-JP-2 with ISO-8859-7 designation
    (BZ#12814)
  - Undo accidental change in x86-64 user.h
  - Update Japanese translation
  - Define RLIMIT_RTTIME (BZ#12795)
  - Update longlong.h from GCC
  - Add a few more alloca size checks (BZ#12671)
  - Fix flags parameter value passed to pltenter and pltexit
  - Define CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM
  - Always fill output buffer in XPG strerror function (BZ#12782)
  - Nicer output for negative error numbers in strerror_r
  - Fix CP1258 conversion (BZ#12777)
  - Fix handling of LC_CTYPE in locale name handling (BZ#12788)
  - Set stream errors in more cases (BZ#12792)
  - Don't unconditionally use alloca in gaih_inet (BZ#11869)
  - Update documentation in regex.h (BZ#11857)
  - Prevent Altivec and VSX insns on PowerPC64 when no FPRs or VRs are
    available
  - Fix typo in x86-64 powl (BZ#12775)
- Avoid overriding CFLAGS (#703880)
* Wed May 18 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.13.90-13
- Update from master
  - Update GB18030 to 2005 version (BZ#11837)
  - Update RE_SYNTAX*_AWK constants in regex.h
  - Handle long variable names in putenv (BZ#11892)
  - Fix test for error_one_per_line mode in error (BZ#12766)
  - Cleanup x86-64 sys/user.h (BZ#11820)
  - Several locale data updates (BZ#11987, BZ#9732, BZ#9730, BZ#4357,
    BZ#12582)
  - Avoid potential deadlock in mtrace (BZ#6420)
  - Fix a few problems in fopen and freopen
  - Provide more helpful error message in getopt (BZ#7101)
  - Make stack canary value harder to read through read overflow (BZ#10149)
  - Use mmap for allocation of buffers used for __abort_msg (BZ#11901)
  - Fix handling of static TLS in dlopen'ed objects (BZ#12453)
  - Fix initialization of optimization values for AIO (BZ#12083)
  - Fix handling of conversion problem in CP932 module (BZ#12601)
  - Fix potential problem with out-of-scope buffer (BZ#12626)
  - Handle recursive calls in backtrace better (BZ#12432)
  - Fix handling of incomplete character storage in state
  - Fix file descriptor position after fclose (BZ#12724)
- Reinstall NIS RPC headers
* Fri May 13 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.13.90-12
- Update from master
  - Fix resizing table for unique symbols when adding symbol for copy
    relocation (BZ#12511)
  - Fix sched_setscheduler call in spawn implementation (BZ#12052)
  - Report write error in addmnt even for cached streams (BZ#12625)
  - Translate kernel error into what pthread_create should return
    (BZ#386)
  - More configurability for secondary group lookup (BZ#11257)
  - Several locale data updates (BZ#11258, BZ#11487, BZ#11532,
    BZ#11578, BZ#11653, BZ#11668, BZ#11945, BZ#11947, BZ#12158,
    BZ#12200, BZ#12178, BZ#12178, BZ#12346, BZ#12449, BZ#12545,
    BZ#12551, BZ#12611, BZ#12660, BZ#12681, BZ#12541, BZ#12711,
    BZ#12738)
  - Fix Linux getcwd for long paths (BZ#12713)
  - static tls memory leak on TLS_DTV_AT_TP archs
  - Actually undefine ARG_MAX from <linux/limits.h>
  - Backport BIND code to query name as TLD (BZ#12734)
  - Allow $ORIGIN to reference trusted directoreis in SUID binaries
    (BZ #12393)
  - Add missing {__BEGIN,__END}_DECLS to sys/sysmacros.h
  - Report if no record is found by initgroups in nss_files
- Never leave $ORIGIN unexpanded
- Revert "Ignore origin of privileged program"
- Reexport RPC interface
* Thu May  5 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.13.90-11
- Update from master
  - Don't use removed rpc headers
- Install rpc/netdb.h again
* Wed May  4 2011 Andreas Schwab <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.13.90-10
- Update from master
  - ldconfig: don't crash on empty path in config file (#699784)
  - getaddrinfo(AF_INET6) does not return scope_id info provided by
    NSS modules (BZ#12714)
  - Fix pathconf(_PC_BUF_SIZE) (BZ#12723)
  - Fix getnameinfo flags parameter type (BZ#12717)
  - Add finer grained control for initgroups lookups to NSS
  - Use all possible bytes from fopen mode string (BZ#12685, #698025)
  - Define initgroups callback for nss_files
  - elf.h: Define R_ARM_IRELATIVE reloc type
  - Fix static linking with checking x86/x86-64 memcpy (BZ#12653)
  - Fix POWER4/POWER7 optimized strncmp to not read past differing bytes
  - Fix FPU context handling in getcontext on x86-64 (BZ#12420)
  - Skip extra zeroes when searching auxv on s390
  - Obsolete RPC implementation in libc
  - Fix memory leak in TLS of loaded objects (BZ#12650)
  - Don't leave empty element in rpath when skipping an element
  - Make ppc sync_file_range cancelable
  - Maintain stack alignment in ____longjmp_chk on x86_64
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #761245 - CVE-2009-5029 glibc: __tzfile_read integer overflow to
buffer overflow
        https://bugzilla.redhat.com/show_bug.cgi?id=761245
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update glibc' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce