[SECURITY] Fedora 37 Update: glibc-2.36-14.fc37
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2023-028062484e
2023-10-04 15:47:53.759539
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 37
Version : 2.36
Release : 14.fc37
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2023-4911, CVE-2023-4806, and CVE-2023-4527.
CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the
environment of a setuid program and NAME is valid, it may result in a buffer
overflow, which could be exploited to achieve escalated privileges. This flaw
was introduced in glibc 2.34. CVE-2023-4806: When an NSS plugin only implements
the _gethostbyname2_r and _getcanonname_r callbacks, getaddrinfo could use
memory that was freed during buffer resizing, potentially causing a crash or
read or write to arbitrary memory. CVE-2023-4527: If the system is configured
in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC
address family, and a DNS response is received over TCP that is larger than 2048
bytes, getaddrinfo may potentially disclose stack contents via the returned
address data, or crash.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 3 2023 Arjun Shankar <arjun(a)redhat.com> - 2.36-14
- Auto-sync with upstream branch release/2.36/master,
22955ad85186ee05834e47e665056148ca07699c:
- tunables: Terminate if end of input is reached (CVE-2023-4911)
* Tue Oct 3 2023 Arjun Shankar <arjun(a)redhat.com> - 2.36-13
- Auto-sync with upstream branch release/2.36/master,
32957eb6a86acdbeec9f38a60a7d5a0ff32db03d:
- Document CVE-2023-4806 and CVE-2023-5156 in NEWS
- Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]
- getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
- io: Fix record locking contants for powerpc64 with __USE_FILE_OFFSET64
- CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2234712 - CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa
mode
https://bugzilla.redhat.com/show_bug.cgi?id=2234712
[ 2 ] Bug #2237782 - CVE-2023-4806 glibc: potential use-after-free in getaddrinfo()
https://bugzilla.redhat.com/show_bug.cgi?id=2237782
[ 3 ] Bug #2238352 - CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege
escalation
https://bugzilla.redhat.com/show_bug.cgi?id=2238352
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2023-028062484e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------