-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-07597a0fb3 2024-02-01 01:23:37.270537 --------------------------------------------------------------------------------
Name : glibc Product : Fedora 38 Version : 2.37 Release : 18.fc38 URL : http://www.gnu.org/software/glibc/ Summary : The GNU libc libraries Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function.
-------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780. CVE-2023-6246: __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER containing a long program name failed to update the required buffer size, leading to the allocation and overflow of a too-small buffer on the heap. CVE-2023-6779: __vsyslog_internal used the return value of snprintf/vsnprintf to calculate buffer sizes for memory allocation. If these functions (for any reason) failed and returned -1, the resulting buffer would be too small to hold output. CVE-2023-6780: __vsyslog_internal calculated a buffer size by adding two integers, but did not first check if the addition would overflow. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 30 2024 Patsy Griffin patsy@redhat.com - 2.37-18 - Auto-sync with upstream branch release/2.37/master, commit 2b58cba076e912961ceaa5fa58588e4b10f791c0: - syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780) - syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779) - syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246) - sunrpc: Fix netname build with older gcc * Mon Jan 29 2024 Arjun Shankar arjun@redhat.com - 2.37-17 - Auto-sync with upstream branch release/2.37/master, commit bd9f194c34333c0148fc0a793b8e68e2399f27cb: - libio: Check remaining buffer size in _IO_wdo_write (bug 31183) - getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163) - NEWS: Mention bug fixes for 29039/30745/30843 - x86-64: Fix the tcb field load for x32 [BZ #31185] - x86-64: Fix the dtv field load for x32 [BZ #31184] - elf: Fix TLS modid reuse generation assignment (BZ 29039) - elf: Fix wrong break removal from 8ee878592c -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2249053 - CVE-2023-6246 glibc: heap-based buffer overflow in __vsyslog_internal() https://bugzilla.redhat.com/show_bug.cgi?id=2249053 [ 2 ] Bug #2254395 - CVE-2023-6779 glibc: off-by-one heap-based buffer overflow in __vsyslog_internal() https://bugzilla.redhat.com/show_bug.cgi?id=2254395 [ 3 ] Bug #2254396 - CVE-2023-6780 glibc: integer overflow in __vsyslog_internal() https://bugzilla.redhat.com/show_bug.cgi?id=2254396 --------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-07597a0fb3' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org
-
updates＠fedoraproject.org