[SECURITY] Fedora 12 Update: glibc-2.11.2-3

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2010-16641
2010-10-27 21:12:32
--------------------------------------------------------------------------------

Name        : glibc
Product     : Fedora 12
Version     : 2.11.2
Release     : 3
URL         : http://sources.redhat.com/glibc/
Summary     : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.

--------------------------------------------------------------------------------
Update Information:

- Correct x86 CPU family and model check (BZ#11640, #596554)
- Don't crash on unresolved weak symbol reference
- sunrpc: Fix spurious fall-through
- Never expand $ORIGIN in privileged programs (#643306, CVE-2010-3847)
- Require suid bit on audit objects in privileged programs (CVE-2010-3856)
--------------------------------------------------------------------------------
ChangeLog:

* Fri Oct 22 2010 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.2-3
- Require suid bit on audit objects in privileged programs (CVE-2010-3856)
* Thu Oct 21 2010 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.2-2
- Update from 2.11 branch
  - Correct x86 CPU family and model check (BZ#11640, #596554)
  - Don't crash on unresolved weak symbol reference
  - sunrpc: Fix spurious fall-through
- Never expand $ORIGIN in privileged programs (#643306, CVE-2010-3847)
* Thu May 20 2010 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.2-1
- Update to 2.11.2 release
* Fri May 14 2010 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.1-7
- Update from 2.11 branch
  - Fix ldconfig to handle symlinks in chroot correctly (BZ#11149)
  - Fix handling if newline in addmntent
  - Fix ttyname_r callers not to expect errno was set (BZ#11538)
  - Don't crash in trace mode when dependencies are missing
  - Fix crash on reloading of gai data in nscd
  - Fix fallocate error return on i386
  - Fix getopt option handing (BZ#11039, BZ#11040, BZ#11041)
  - Handle DNS timeouts in old-style lookup code (BZ#11010)
  - Fix aux cache handling in ldconfig with chroot (BZ#11149)
  - Fix printing error messages in getopt (BZ#11043)
  - Declare iruserok and iruserok_af (BZ#11070)
  - Fix option aliasing in argp (BZ#11254)
  - Fix concurrent handling of __cpu_features (BZ#11292)
  - Handle unnecessary padding in getdents64 (BZ#11333)
  - Fix changes to interface list during getifaddrs calls (BZ#11387)
  - Missing memory barrier in DES initialization (BZ#11449)
  - Calls to cuserid can result in buffer overruns and/or overflows (BZ#11397)
  - Fix R_X86_64_PC32 overflow detection
  - Fix reporting of I/O errors in *dprintf functions (BZ#11319)
  - Fix assertion in palloc and pvalloc as well (BZ#5553)
  - Fix file descriotor leak in nftw with FTW_CHDIR (BZ#11271)
  - Fix endless loop with invalid /etc/shells file (BZ#11242)
  - _nl_load_locale incorrectly handles mmap() failures (BZ#11200)
* Fri Apr 16 2010 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.1-6
- Fix spurious UNAVAIL status in getaddrinfo (#576667, #581673)
* Wed Mar 31 2010 Tom "spot" Callaway <tcallawa(a)redhat.com&gt; - 2.11.1-5
- Fix for sparc64 msgrcv from upstream trunk
* Wed Mar 17 2010 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.1-4
- Update from 2.11 branch
  - regcomp.c: do not ignore memory allocation failure (BZ#11127)
  - Fix typo in feature selection macro use
  - Avoid ELF lookup race
  - Fix a few error cases in *name4_r lookup handling (#573904, BZ#11000)
* Tue Mar  9 2010 Dennis Gilmore <dennis(a)ausil.us&gt; - 2.11.1-3
- add patch to fix sparc TLS reloc (BZ#571551).
* Wed Feb 10 2010 Dennis Gilmore <dennis(a)ausil.us&gt; - 2.11.1-2
- add sparc locale patch commited upstream to the fedora branch
* Mon Dec 14 2009 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11.1-1
- Update to 2.11.1 release.
  - Locale updates.
  - Don't reuse RPC XIDs across forks.
* Mon Nov 30 2009 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11-4
- Update from 2.11 branch
  - Fix sync_file_range on ppc/ppc64.
  - Fix getwc* and putwc* on non-wide streams (BZ#10958).
  - Avoid warnings in CPU_* macros when using const bitsets (BZ#10918).
  - Fix ranges with multibyte characters as endpoints.
  - Handle LC_GLOBAL_LOCALE in duplocale (BZ#10969).
  - Fix _NC_LOCALE_NAME definition (BZ#10968).
  - Add missing Linux MADV_* definitions (BZ#10972).
  - Handle running out of buffer space with IPv6 mapping enabled.
  - Avoid memset warning in one case (#532492).
  - Restore locking in free_check (#504963).
- Fix infloop in __pthread_disable_asynccancel on x86_64 (#537690).
- Prevent unintended file desriptor leak in grantpt (#530558).
- Fix startup to security-relevant statically linked binaries (#528631).
* Tue Nov 24 2009 Andreas Schwab <schwab(a)redhat.com&gt; - 2.11-3
- Enable multi-arch support for ppc and ppc64 on RHEL-6
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #643306 - CVE-2010-3847 glibc: ld.so insecure handling of $ORIGIN in LD_AUDIT
for setuid/setgid programs
        https://bugzilla.redhat.com/show_bug.cgi?id=643306
  [ 2 ] Bug #645672 - CVE-2010-3856 glibc: ld.so arbitrary DSO loading via LD_AUDIT in
setuid/setgid programs
        https://bugzilla.redhat.com/show_bug.cgi?id=645672
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update glibc' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------