drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in glibc (Aktualisierung)
Name: |
Mehrere Probleme in glibc (Aktualisierung) |
|
ID: |
USN-2985-2 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 15.10 |
|
Datum: |
Do, 26. Mai 2016, 21:48 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8121
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8776
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8777
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3075
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8778
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2856
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8779 |
|
Applikationen: |
GNU C library |
|
Update von: |
Mehrere Probleme in glibc |
|
Originalnachricht |
--===============2358410099322978385== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="9amGYk9869ThD9tj" Content-Disposition: inline
--9amGYk9869ThD9tj Content-Type: text/plain; charset=us-ascii Content-Disposition: inlin Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2985-2 May 26, 2016
eglibc, glibc regression ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS
Summary:
USN-2985-1 introduced a regression in the GNU C Library.
Software Description: - glibc: GNU C Library - eglibc: GNU C Library
Details:
USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for CVE-2014-9761 introduced a regression which affected applications that use the libm library but were not fully restarted after the upgrade. This update removes the fix for CVE-2014-9761 and a future update will be provided to address this issue.
We apologize for the inconvenience.
Original advisory details:
Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. (CVE-2013-2207, CVE-2016-2856) Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite loop). (CVE-2014-8121) Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761) Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2015-1781) Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not handle long lines in the files databases correctly. A local attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277) Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-range argument data. An attacker could use this to cause a denial of service (application crash) or possibly expose sensitive information. (CVE-2015-8776) Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege boundaries. A local attacker could use this to exploit an existing vulnerability more easily. (CVE-2015-8777) Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size argument, leading to an integer overflow. An attacker could use to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-8778) Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C Library when handling long catalog names. An attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-8779) Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly handle long names passed as arguments. An attacker could use to cause a denial of service (stack exhaustion leading to an application crash). (CVE-2016-3075)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 15.10: libc-bin 2.21-0ubuntu4.3 libc6 2.21-0ubuntu4.3 libc6-dev 2.21-0ubuntu4.3
Ubuntu 14.04 LTS: libc-bin 2.19-0ubuntu6.9 libc6 2.19-0ubuntu6.9 libc6-dev 2.19-0ubuntu6.9
Ubuntu 12.04 LTS: libc-bin 2.15-0ubuntu10.15 libc6 2.15-0ubuntu10.15 libc6-dev 2.15-0ubuntu10.15
After a standard system update you need to reboot your computer to make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2985-2 http://www.ubuntu.com/usn/usn-2985-1 https://launchpad.net/bugs/1585614
Package Information: https://launchpad.net/ubuntu/+source/glibc/2.21-0ubuntu4.3 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.9 https://launchpad.net/ubuntu/+source/eglibc/2.15-0ubuntu10.15
--9amGYk9869ThD9tj Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJXRxCzAAoJEC8Jno0AXoH0ybsP/3WmSVhAN07kDVPwSmvu4x/K 8/rwuURotXE7wsEKUXbHrzkr/ns01EVGPaHhSGkiG4gDX5JZiIVuJmgL3HOxKHkc UXezCAc2cqfJjgT29vp8c2hNhtj080mikiWVwf8bfHNfFn1CjB7JzP1WnIWfNbuY hswHtYSBL33X6B7KhoaUhA9VMpNZ9nepcS5gQHDEPxGSIT8MajI49wHHxOUn2715 8oDfHIHOaKc5DNvVZdZcsjKE9VcOQ1TpdmVk23M22zGuMRq6mpF6ES7nTU//Micg ZDk4BPD2mx/wKN06ceRfkbu49Q+g1YkmWpHoe7ACZJK2qJ8xyxNQ96H2ES2UQz2Q zEgbSxHtu88HSFOrAUe/Q6GAbaSJvIdacLRcx+GTIxPXdHyQRzZd0PPBhapLnQKZ yfl2Zn1FcwoEzSEAMsnTSORzd/8Rbgmm9S2Yyu9txcdfn1S8k59ddUNZLM1sXjNd mfRAlKH/z4bEJJtAsenTyIVxug8mMA90PzzPLYTRWjYiipiINceXzZuCWPdm9XDV z8mjENnXExLWPvmpdSXRTcXFHOxUxeMsvCLkGS5ZO3CepiXT6GsQNyhlJ5uMOu6D lPZH0fOp2dUT4U6+CjEmXn4mS3Q4uypPlesYrbC0eccHdVsAJLOR+zSx6WdgK35D a4TxWuVmuGbissomTRhj =UipM -----END PGP SIGNATURE-----
--9amGYk9869ThD9tj--
--===============2358410099322978385== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============2358410099322978385==--
|
|
|
|