[RHSA-2017:0680-01] Moderate: glibc security and bug fix update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: glibc security and bug fix update

Advisory ID: RHSA-2017:0680-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2017-0680.html

Issue date: 2017-03-21

CVE Names: CVE-2014-9761 CVE-2015-8776 CVE-2015-8778

CVE-2015-8779

=====================================================================

 

1. Summary:

 

An update for glibc is now available for Red Hat Enterprise Linux 6.

 

Red Hat Product Security has rated this update as having a security impact

of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

gives a detailed severity rating, is available for each vulnerability from

the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

 

3. Description:

 

The glibc packages provide the standard C libraries (libc), POSIX thread

libraries (libpthread), standard math libraries (libm), and the name

service cache daemon (nscd) used by multiple programs on the system.

Without these libraries, the Linux system cannot function correctly.

 

Security Fix(es):

 

* A stack overflow vulnerability was found in nan* functions that could

cause applications, which process long strings with the nan function, to

crash or, potentially, execute arbitrary code. (CVE-2014-9761)

 

* It was found that out-of-range time values passed to the strftime()

function could result in an out-of-bounds memory access. This could lead to

application crash or, potentially, information disclosure. (CVE-2015-8776)

 

* An integer overflow vulnerability was found in hcreate() and hcreate_r()

functions which could result in an out-of-bounds memory access. This could

lead to application crash or, potentially, arbitrary code execution.

(CVE-2015-8778)

 

* A stack based buffer overflow vulnerability was found in the catopen()

function. An excessively long string passed to the function could cause it

to crash or, potentially, execute arbitrary code. (CVE-2015-8779)

 

Additional Changes:

 

For detailed information on changes in this release, see the Red Hat

Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9

Technical Notes linked from the References section.

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

For the update to take effect, all services linked to the glibc library

must be restarted, or the system rebooted.

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1012343 - Thread issue in glibc can cause the application to not get any identity information

1101858 - glibc: Add el_GR ( -at -) euro, ur_IN, and wal_ET locales

1223095 - access to uninitialized memory in getaddrinfo if nscd is running

1270950 - getaddrinfo() takes long time when lots of IP addresses are configured

1300299 - CVE-2015-8776 glibc: Segmentation fault caused by passing out-of-range data to strftime()

1300303 - CVE-2015-8778 glibc: Integer overflow in hcreate and hcreate_r

1300310 - CVE-2014-9761 glibc: Unbounded stack allocation in nan* functions

1300312 - CVE-2015-8779 glibc: Unbounded stack allocation in catopen function

1338673 - glibc: GCC 6 enablement for struct sockaddr_storage [el6]

1373646 - tzdata-update uses default umask

1416496 - getaddrinfo() call returns wrong IPv6 address if nscd is used

 

6. Package List:

 

Red Hat Enterprise Linux Desktop (v. 6):

 

Source:

glibc-2.12-1.209.el6.src.rpm

 

i386:

glibc-2.12-1.209.el6.i686.rpm

glibc-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-headers-2.12-1.209.el6.i686.rpm

glibc-utils-2.12-1.209.el6.i686.rpm

nscd-2.12-1.209.el6.i686.rpm

 

x86_64:

glibc-2.12-1.209.el6.i686.rpm

glibc-2.12-1.209.el6.x86_64.rpm

glibc-common-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.x86_64.rpm

glibc-headers-2.12-1.209.el6.x86_64.rpm

glibc-utils-2.12-1.209.el6.x86_64.rpm

nscd-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux Desktop Optional (v. 6):

 

i386:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.i686.rpm

 

x86_64:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-static-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux HPC Node (v. 6):

 

Source:

glibc-2.12-1.209.el6.src.rpm

 

x86_64:

glibc-2.12-1.209.el6.i686.rpm

glibc-2.12-1.209.el6.x86_64.rpm

glibc-common-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.x86_64.rpm

glibc-headers-2.12-1.209.el6.x86_64.rpm

glibc-utils-2.12-1.209.el6.x86_64.rpm

nscd-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux HPC Node Optional (v. 6):

 

x86_64:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-static-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux Server (v. 6):

 

Source:

glibc-2.12-1.209.el6.src.rpm

 

i386:

glibc-2.12-1.209.el6.i686.rpm

glibc-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-headers-2.12-1.209.el6.i686.rpm

glibc-utils-2.12-1.209.el6.i686.rpm

nscd-2.12-1.209.el6.i686.rpm

 

ppc64:

glibc-2.12-1.209.el6.ppc.rpm

glibc-2.12-1.209.el6.ppc64.rpm

glibc-common-2.12-1.209.el6.ppc64.rpm

glibc-debuginfo-2.12-1.209.el6.ppc.rpm

glibc-debuginfo-2.12-1.209.el6.ppc64.rpm

glibc-debuginfo-common-2.12-1.209.el6.ppc.rpm

glibc-debuginfo-common-2.12-1.209.el6.ppc64.rpm

glibc-devel-2.12-1.209.el6.ppc.rpm

glibc-devel-2.12-1.209.el6.ppc64.rpm

glibc-headers-2.12-1.209.el6.ppc64.rpm

glibc-utils-2.12-1.209.el6.ppc64.rpm

nscd-2.12-1.209.el6.ppc64.rpm

 

s390x:

glibc-2.12-1.209.el6.s390.rpm

glibc-2.12-1.209.el6.s390x.rpm

glibc-common-2.12-1.209.el6.s390x.rpm

glibc-debuginfo-2.12-1.209.el6.s390.rpm

glibc-debuginfo-2.12-1.209.el6.s390x.rpm

glibc-debuginfo-common-2.12-1.209.el6.s390.rpm

glibc-debuginfo-common-2.12-1.209.el6.s390x.rpm

glibc-devel-2.12-1.209.el6.s390.rpm

glibc-devel-2.12-1.209.el6.s390x.rpm

glibc-headers-2.12-1.209.el6.s390x.rpm

glibc-utils-2.12-1.209.el6.s390x.rpm

nscd-2.12-1.209.el6.s390x.rpm

 

x86_64:

glibc-2.12-1.209.el6.i686.rpm

glibc-2.12-1.209.el6.x86_64.rpm

glibc-common-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.x86_64.rpm

glibc-headers-2.12-1.209.el6.x86_64.rpm

glibc-utils-2.12-1.209.el6.x86_64.rpm

nscd-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux Server Optional (v. 6):

 

i386:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.i686.rpm

 

ppc64:

glibc-debuginfo-2.12-1.209.el6.ppc.rpm

glibc-debuginfo-2.12-1.209.el6.ppc64.rpm

glibc-debuginfo-common-2.12-1.209.el6.ppc.rpm

glibc-debuginfo-common-2.12-1.209.el6.ppc64.rpm

glibc-static-2.12-1.209.el6.ppc.rpm

glibc-static-2.12-1.209.el6.ppc64.rpm

 

s390x:

glibc-debuginfo-2.12-1.209.el6.s390.rpm

glibc-debuginfo-2.12-1.209.el6.s390x.rpm

glibc-debuginfo-common-2.12-1.209.el6.s390.rpm

glibc-debuginfo-common-2.12-1.209.el6.s390x.rpm

glibc-static-2.12-1.209.el6.s390.rpm

glibc-static-2.12-1.209.el6.s390x.rpm

 

x86_64:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-static-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux Workstation (v. 6):

 

Source:

glibc-2.12-1.209.el6.src.rpm

 

i386:

glibc-2.12-1.209.el6.i686.rpm

glibc-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-headers-2.12-1.209.el6.i686.rpm

glibc-utils-2.12-1.209.el6.i686.rpm

nscd-2.12-1.209.el6.i686.rpm

 

x86_64:

glibc-2.12-1.209.el6.i686.rpm

glibc-2.12-1.209.el6.x86_64.rpm

glibc-common-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-devel-2.12-1.209.el6.i686.rpm

glibc-devel-2.12-1.209.el6.x86_64.rpm

glibc-headers-2.12-1.209.el6.x86_64.rpm

glibc-utils-2.12-1.209.el6.x86_64.rpm

nscd-2.12-1.209.el6.x86_64.rpm

 

Red Hat Enterprise Linux Workstation Optional (v. 6):

 

i386:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.i686.rpm

 

x86_64:

glibc-debuginfo-2.12-1.209.el6.i686.rpm

glibc-debuginfo-2.12-1.209.el6.x86_64.rpm

glibc-debuginfo-common-2.12-1.209.el6.i686.rpm

glibc-debuginfo-common-2.12-1.209.el6.x86_64.rpm

glibc-static-2.12-1.209.el6.i686.rpm

glibc-static-2.12-1.209.el6.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2014-9761

https://access.redhat.com/security/cve/CVE-2015-8776

https://access.redhat.com/security/cve/CVE-2015-8778

https://access.redhat.com/security/cve/CVE-2015-8779

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2017 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFY0PUyXlSAg2UNWIIRAhr6AJ41TwpX4GlTdzHFMpTodtlmlfMZTwCfQ0pd

XJUoh8+cFg11T95uhak9bLA=

=V1Eh

-----END PGP SIGNATURE-----

 

 

--