Otkrivena su i ispravljena dva sigurnosna propusta kod programskog paketa glibc. Udaljeni napadač ih je mogao iskoristiti za DoS napad i zaobilaženje postavljenih ograničenja.
Nedostaci su uočeni u programskim funkcijama "extend_alloca()" i "alloca()".
Posljedica:
Navedene probleme napadač može iskoristiti za napad uskraćivanjem usluga (eng. Denial of Service, DoS) i zaobilaženje postavljenih sigurnosnih ograničenja.
Rješenje:
Kao rješenje problema sigurnosti preporuča se instalacija izdane zakrpe.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-11508
2012-08-05 20:51:51
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 17
Version : 2.15
Release : 54.fc17
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
Avoid unbound alloca in vfprintf (#841318)
Revert patch for BZ696143, it made it impossible to use IPV6
addresses explicitly in getaddrinfo, which in turn broke
ssh, apache and other code. (#808147)
--------------------------------------------------------------------------------
ChangeLog:
* Fri Aug 3 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.54
- Remove two extraneous lines from previous patch for BZ841318 (#841318)
* Thu Jul 26 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.53
- Revert patch for BZ696143, it made it impossible to use IPV6
addresses explicitly in getaddrinfo, which in turn broke
ssh, apache and other code. (#808147)
- Avoid unbound alloca in vfprintf (#841318)
* Wed Jul 25 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.52
- Revert recent changes to res_send (804630, 835090).
- Fix memcpy args in res_send (#841787).
* Tue Jul 3 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.51
- Fix FMA4 detection (#829011)
* Thu Jun 28 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.50
- Fix regression after patch for BZ804630 (#835090).
* Wed Jun 20 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.49
- Fix use-after-free in dcigettext.c (#816647).
* Tue Jun 19 2012 Dennis Gilmore <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15-48
- remove armhfp linker changes needs more testing in rawhide before we consider
backporting to f17
* Fri Jun 15 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.47
- Delay setting DECIDED field in locale file structure until
we have read the file's data (#827510).
* Mon Jun 11 2012 Dennis Gilmore <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15-46
- only deal with the arm linker compat hack on armhfp arches
- armsfp arches do not have a linker change
* Fri Jun 8 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.45
- Backward compat hack for armhf binaries.
* Thu Jun 7 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.44
- Fix option rotate with single IPV6 server (#804630)
* Thu Jun 7 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.43
- Do not override TTL of CNAME with TTL of its alias. (#808014)
* Tue Jun 5 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.42
- Last edit accidently removed %patch2058.
* Tue Jun 5 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.41
- Fix DoS in RPC implementation (#767693)
* Tue Jun 5 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15.40
- Fix iconv() segfault when the invalid multibyte character 0xffff is input
when converting from IBM930 (#823905)
* Fri Jun 1 2012 Jeff Law <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15-39
- Update arm specific configury.
* Thu May 24 2012 Patsy Franklin <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2.15-38
- Fix fnmatch() when '*' wildcard is applied on a file name containing
multibyte chars. (#819430)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #841318 - CVE-2012-3405 CVE-2012-3406 glibc various flaws
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=841318
[ 2 ] Bug #808147 - getaddrinfo("::1") now fails on an otherwise-ipv4-only
system
https://bugzilla.redhat.com/show_bug.cgi?id=808147
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update glibc' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke