Univention Bugzilla – Full Text Bug Listing |
Summary: | eglibc: Multiple issues (3.2) | ||
---|---|---|---|
Product: | UCS | Reporter: | Janek Walkenhorst <walkenhorst> |
Component: | Security updates | Assignee: | Moritz Muehlenhoff <jmm> |
Status: | CLOSED FIXED | QA Contact: | Janek Walkenhorst <walkenhorst> |
Severity: | normal | ||
Priority: | P2 | CC: | jmm, walkenhorst |
Version: | UCS 3.2 | ||
Target Milestone: | UCS 3.2-5-errata | ||
Hardware: | Other | ||
OS: | Linux | ||
What kind of report is it?: | --- | What type of bug is this?: | --- |
Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
User Pain: | Enterprise Customer affected?: | ||
School Customer affected?: | ISV affected?: | ||
Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
Ticket number: | Bug group (optional): | ||
Max CVSS v3 score: |
Description
Janek Walkenhorst
2015-01-28 17:22:56 CET
During high load getaddrinfo() may send DNS queries to random fds (CVE-2013-7423) (only recently assigned) Memory corruption in getaddrinfo() if the AI_IDN flag is used (CVE-2013-7424) (only recently assigned) Denial of service by passing overly long input to getaddrinfo, getservbyname* and glob (CVE-2012-6686) > Incorrect error handling in addmntent helper (CVE-2011-1089)
>
> Incorrect memory handling in processing format strings (CVE-2012-3404)
These two issues turned out to be already fixed in squeeze: They are part of the debian/patches/svn-updates.diff patch in the 2.11.3-1 upload.
Denial of service in nss_files (CVE-2014-8121) (In reply to Moritz Muehlenhoff from comment #3) > Denial of service by passing overly long input to getaddrinfo, > getservbyname* and glob (CVE-2012-6686) This was rejected since it turned out to be a non-issue. The scanf() implementation crashes on some inputs (CVE-2011-5320) (ID only assigned yesterday) No backport or upstream fix exists for three issues; they have been moved to Bug 38115 Update has been built, tests were successful. YAML file: 2015-03-23-eglibc.yaml Tests: OK Advisory: OK |