2:28 a.m.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-c69aee3e63
2018-12-02 08:24:31.362933
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 29
Version : 2.28
Release : 23.fc29
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
This update to the `glibc` package adds a new security hardening feature. *
malloc: tcache double free check (RHBZ#1647395)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 29 2018 DJ Delorie <dj(a)redhat.com> - 2.28-23
- Auto-sync with upstream branch release/2.28/master,
commit b8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa.
- malloc: tcache double free check (#1647395)
* Wed Nov 28 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-22
- Auto-sync with upstream branch release/2.28/master,
commit ce6ba630dbc96f49eb1f30366aa62261df4792f9:
- CVE-2018-19591: if_nametoindex: Fix descriptor leak (#1654000)
- support: Print timestamps in timeout handler
- libio/tst-readline: Increase timeout
* Mon Nov 26 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-21
- Do not use parallel make for building locales (#1652228)
* Mon Nov 19 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-20
- Auto-sync with upstream branch release/2.28/master,
commit f44c2ca5eacd2df76fc38be75f9ebb8f0ff555eb:
- Update system call list to Linux 4.19
- time: Fix tzfile low-memory assertion failure (swbz#21716)
- Add newlines in __libc_fatal calls (swbz#20271)
- nscd: Fix use-after-free in addgetnetgrentX (swbz#23520)
- malloc: Additional heap integrity checks
- Add an additional test to resolv/tst-resolv-network.c (swbz#17630)
* Fri Nov 9 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-19
- Auto-sync with upstream branch release/2.28/master,
commit 3e8d8dd5afba18a847ff7a80f473336f777cc329:
- Disable CET for binaries created by older link editors (#1648297)
* Wed Nov 7 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-18
- Drop patches that were applied to upstream release/2.28/master branch:
glibc-rh1614705.patch
glibc-rh1615608.patch
glibc-error-va_end.patch
glibc-nscd-leak.patch
glibc-nss_files-leak.patch
glibc-rh1622669.patch
glibc-1622674-1.patch
glibc-1622674-2.patch
glibc-rh1631338-1.patch
glibc-rh1631338-2.patch
glibc-rh1623519.patch
glibc-rh1631719.patch
glibc-rh1631728.patch
glibc-rh1623519-2.patch
- Auto-sync with upstream branch release/2.28/master,
commit fc0e3393ff775aa795b523083bb0db7f18d3b91e:
- RISC-V: Move libc_fesetround_riscv after libc_feholdexcept_riscv
- pthread_spawn: Fix potential segfault in maybe_script_execute
- preadv2/pwritev2: Fix misreported errno (swbz#23579)
- kl_GL: Fix spelling of Sunday, should be "sapaat" (swbz#20209)
- i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK (swbz#23716)
- pthread_mutex_lock: Fix race while promoting to PTHREAD_MUTEX_ELISION_NP
(swbz#23275)
- signal: Use correct type for si_band in siginfo_t (swbz#23562)
- stdlib/test-bz22786: Avoid spurious test failures using alias mappings
- x86: Fix Haswell CPU string flags (swbz#23709)
- libanl: Fix crash if first helper thread creation failed (#1646381)
* Thu Nov 1 2018 Mike FABIAN <mfabian(a)redhat.com> - 2.28-17
- Include Esperanto (eo) in glibc-all-langpacks (#1643756)
* Thu Sep 27 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-16
- stdlib/tst-setcontext9 test suite failure on ppc64le (#1623519)
* Wed Sep 26 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-15
- Add missing ENDBR32 in start.S (#1631728)
* Wed Sep 26 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-14
- Fix bug in generic strstr with large needles (#1631719)
* Wed Sep 26 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-13
- stdlib/tst-setcontext9 test suite failure (#1623519)
* Wed Sep 26 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-12
- gethostid: Missing NULL check for gethostbyname_r result (#1631338)
* Wed Sep 5 2018 Florian Weimer <fweimer(a)redhat.com> - 2.28-11
- Add python3-devel build dependency for downstream benefit
* Wed Sep 5 2018 Carlos O'Donell <carlos(a)redhat.com> - 2.28-10
- Provide compatibility support for linking against libpthread_nonshared.a
(#1625507)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1647395 - glibc: the execution continued with double free in the program
https://bugzilla.redhat.com/show_bug.cgi?id=1647395
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-c69aee3e63' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------