Univention Bugzilla – Bug 53548
klibc: Multiple issues (4.4)
Last modified: 2021-07-07 16:34:12 CEST
New Debian klibc 2.0.4-9+deb9u1 fixes: This update addresses the following issues: * An issue was discovered in klibc before 2.0.9. Multiplication in the calloc() function may result in an integer overflow and a subsequent heap buffer overflow. (CVE-2021-31870) * An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit systems. (CVE-2021-31871) * An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buffer overflow or other security impact. (CVE-2021-31872) * An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow. (CVE-2021-31873)
--- mirror/ftp/4.3/unmaintained/4.3-0/source/klibc_2.0.4-9.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/klibc_2.0.4-9+deb9u1.dsc @@ -1,3 +1,15 @@ +2.0.4-9+deb9u1 [Mon, 28 Jun 2021 16:24:37 +0200] Ben Hutchings <benh@debian.org>: + + * Never clean files in quilt status directory + * debian/rules: Use $(MAKE) for recursive make + * debian/rules: Change override_dh_auto_test rule to actually run tests + * Apply security fixes from 2.0.9 (Closes: #989505): + - malloc: Set errno on failure + - malloc: Fail if requested size > PTRDIFF_MAX (CVE-2021-31873) + - calloc: Fail if multiplication overflows (CVE-2021-31870) + - cpio: Fix possible integer overflow on 32-bit systems (CVE-2021-31872) + - cpio: Fix possible crash on 64-bit systems (CVE-2021-31871) + 2.0.4-9 [Sun, 08 May 2016 21:59:37 +0100] Ben Hutchings <ben@decadent.org.uk>: * Change dh_fixperms arguments to restore binary reproducibility <http://piuparts.knut.univention.de/4.4-8/#4461743603348236214>
OK: yaml OK: announce_errata OK: patch OK: piuparts
<https://errata.software-univention.de/#/?erratum=4.4x1004>