[SECURITY] Fedora 40 Update: glibc-2.39-8.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-eafbf519ec
2024-04-19 21:20:20.798294
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 40
Version : 2.39
Release : 8.fc40
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
This update includes several bug fixes from the upstream glibc release branch,
including the fix for a buffer overflow in iconv when converting to the
ISO-2022-CN-EXT character set (CVE-2024-2961, RHBZ#2275855).
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 18 2024 Florian Weimer <fweimer(a)redhat.com> - 2.39-8
- Sync with upstream branch release/2.39/master,
commit 31da30f23cddd36db29d5b6a1c7619361b271fb4:
- iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence
(CVE-2024-2961)
- x86_64: Exclude SSE, AVX and FMA4 variants in libm multiarch
- Apply the Makefile sorting fix
- powerpc: Fix ld.so address determination for PCREL mode (bug 31640)
- x86-64: Simplify minimum ISA check ifdef conditional with if
- x86-64: Don't use SSE resolvers for ISA level 3 or above
- AArch64: Check kernel version for SVE ifuncs
- aarch64: fix check for SVE support in assembler
- aarch64/fpu: Sync libmvec routines from 2.39 and before with AOR
- i386: Use generic memrchr in libc (bug 31316)
* Thu Apr 4 2024 Arjun Shankar <arjun(a)redhat.com> - 2.39-7
- Sync with upstream branch release/2.39/master,
commit 5d070d12b3a52bc44dd1b71743abc4b6243862ae:
- x86: Expand the comment on when REP STOSB is used on memset
- x86: Do not prefer ERMS for memset on Zen3+
- x86: Fix Zen3/Zen4 ERMS selection (BZ 30994)
- Add tst-gnu2-tls2mod1 to test-internal-extras
- elf: Enable TLS descriptor tests on aarch64
- arm: Update _dl_tlsdesc_dynamic to preserve caller-saved registers (BZ 31372)
- Ignore undefined symbols for -mtls-dialect=gnu2
- x86-64: Allocate state buffer space for RDI, RSI and RBX
- x86-64: Update _dl_tlsdesc_dynamic to preserve AMX registers
- x86: Update _dl_tlsdesc_dynamic to preserve caller-saved registers
- x86-64: Save APX registers in ld.so trampoline
- LoongArch: Correct {__ieee754, _}_scalb -> {__ieee754, _}_scalbf
- powerpc: Placeholder and infrastructure/build support to add Power11 related changes.
- powerpc: Add HWCAP3/HWCAP4 data to TCB for Power Architecture.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2275855 - CVE-2024-2961 glibc: Out of bounds write in iconv may lead to
remote code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2275855
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-eafbf519ec' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------