bugtraq - [ MDVSA-2015:218 ] glibc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1YnjpB-0004Dy-1L@titan.mandriva.com>
Date: Thu, 30 Apr 2015 10:28:01 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2015:218 ] glibc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:218
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : glibc
 Date    : April 30, 2015
 Affected: Business Server 1.0, Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in glibc:
 
 It was discovered that, under certain circumstances, glibc&#039;s
 getaddrinfo\(\) function would send DNS queries to random file
 descriptors. An attacker could potentially use this flaw to send DNS
 queries to unintended recipients, resulting in information disclosure
 or data loss due to the application encountering corrupted data
 (CVE-2013-7423).
 
 A buffer overflow flaw was found in the way glibc&#039;s gethostbyname_r\(\)
 and other related functions computed the size of a buffer when passed
 a misaligned buffer as input. An attacker able to make an application
 call any of these functions with a misaligned buffer could use this
 flaw to crash the application or, potentially, execute arbitrary
 code with the permissions of the user running the application
 (CVE-2015-1781).
 
 The updated packages provides a solution for these security issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7423
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1781
 https://rhn.redhat.com/errata/RHSA-2015-0863.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 92aa475c44c712eaf19898ef76e04183  mbs1/x86_64/glibc-2.14.1-12.12.mbs1.x86_64.rpm
 606cdd33e041f9853eae18f53c9d73de  mbs1/x86_64/glibc-devel-2.14.1-12.12.mbs1.x86_64.rpm
 133deb850840d464335e5c659cba1627  mbs1/x86_64/glibc-doc-2.14.1-12.12.mbs1.noarch.rpm
 7a3d5170647c52cd4a34d2dcda711397  mbs1/x86_64/glibc-doc-pdf-2.14.1-12.12.mbs1.noarch.rpm
 96c842afb6110ac18a40b843b51548fc  mbs1/x86_64/glibc-i18ndata-2.14.1-12.12.mbs1.x86_64.rpm
 703e73278d416a53096fe19c7652c95e  mbs1/x86_64/glibc-profile-2.14.1-12.12.mbs1.x86_64.rpm
 12f09ed16d9c4b0f9a94e931569dacc3  mbs1/x86_64/glibc-static-devel-2.14.1-12.12.mbs1.x86_64.rpm
 09715361d0af4a4dd5fba44239c5e690  mbs1/x86_64/glibc-utils-2.14.1-12.12.mbs1.x86_64.rpm
 c9a293ac29070d215eb1988bba58aaec  mbs1/x86_64/nscd-2.14.1-12.12.mbs1.x86_64.rpm 
 8d8b74de2d7c0e982e0ad82ac73091b2  mbs1/SRPMS/glibc-2.14.1-12.12.mbs1.src.rpm

 Mandriva Business Server 2/X86_64:
 e59cee8712d211add638c1b6c1952fa6  mbs2/x86_64/glibc-2.18-10.2.mbs2.x86_64.rpm
 baf9e44f8c4f82c75a0154d44b6fce72  mbs2/x86_64/glibc-devel-2.18-10.2.mbs2.x86_64.rpm
 f3eb6e3ed435f8a06dcffbfa7a44525b  mbs2/x86_64/glibc-doc-2.18-10.2.mbs2.noarch.rpm
 5df45f7cae82ef7d354fa14c7ac363c9  mbs2/x86_64/glibc-i18ndata-2.18-10.2.mbs2.x86_64.rpm
 24ef48d58c7a4114068e7b70dbefad79  mbs2/x86_64/glibc-profile-2.18-10.2.mbs2.x86_64.rpm
 5f67c12f02dbc3f4cbf78f1a8c7d5ad5  mbs2/x86_64/glibc-static-devel-2.18-10.2.mbs2.x86_64.rpm
 f24e67e1ed1b01e5305c28b3a9b02852  mbs2/x86_64/glibc-utils-2.18-10.2.mbs2.x86_64.rpm
 bae4b399bc43be8af24ddd93257ca31a  mbs2/x86_64/nscd-2.18-10.2.mbs2.x86_64.rpm 
 740d9b3d14292be8847da92243340b62  mbs2/SRPMS/glibc-2.18-10.2.mbs2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVQdmKmqjQ0CJFipgRAu9OAJwI4qgyYarvpMKjETt/eXgSHaamygCgmXKN
CcYQqcoEvRpdXRja7wZi/zk=
=26+M
-----END PGP SIGNATURE-----