Fedora 29: FEDORA-2018-f6b7df660d Moderate: glibc Denial Of Service

The glibc package contains standard libraries which are used by

multiple programs on the system. In order to save disk space and

memory, as well as to make upgrading easier, common system code is

kept in one place and shared between programs. This particular package

contains the most important sets of shared libraries: the standard C

library and the standard math library. Without these two libraries, a

Linux system will not function.

This update for the `glibc` package addresses one moderate security

vulnerability and a minor defect: * CVE-2018-19591: A file descriptor leak in

`if_nametoindex` can lead to a denial of service due to resource exhaustion when

processing `getaddrinfo` calls with crafted host names. Reported by Guido

Vranken. (RHBZ#1654000) * Parallel building of locales led to nondeterminism in

the RPM build process. (RHBZ#1652228)

* Wed Nov 28 2018 Florian Weimer - 2.28-22

- Auto-sync with upstream branch release/2.28/master,

commit ce6ba630dbc96f49eb1f30366aa62261df4792f9:

- CVE-2018-19591: if_nametoindex: Fix descriptor leak (#1654000)

- support: Print timestamps in timeout handler

- libio/tst-readline: Increase timeout

* Mon Nov 26 2018 Florian Weimer - 2.28-21

- Do not use parallel make for building locales (#1652228)

* Mon Nov 19 2018 Florian Weimer - 2.28-20

- Auto-sync with upstream branch release/2.28/master,

commit f44c2ca5eacd2df76fc38be75f9ebb8f0ff555eb:

- Update system call list to Linux 4.19

- time: Fix tzfile low-memory assertion failure (swbz#21716)

- Add newlines in __libc_fatal calls (swbz#20271)

- nscd: Fix use-after-free in addgetnetgrentX (swbz#23520)

- malloc: Additional heap integrity checks

- Add an additional test to resolv/tst-resolv-network.c (swbz#17630)

* Fri Nov 9 2018 Florian Weimer - 2.28-19

- Auto-sync with upstream branch release/2.28/master,

commit 3e8d8dd5afba18a847ff7a80f473336f777cc329:

- Disable CET for binaries created by older link editors (#1648297)

* Wed Nov 7 2018 Florian Weimer - 2.28-18

- Drop patches that were applied to upstream release/2.28/master branch:

glibc-rh1614705.patch

glibc-rh1615608.patch

glibc-error-va_end.patch

glibc-nscd-leak.patch

glibc-nss_files-leak.patch

glibc-rh1622669.patch

glibc-1622674-1.patch

glibc-1622674-2.patch

glibc-rh1631338-1.patch

glibc-rh1631338-2.patch

glibc-rh1623519.patch

glibc-rh1631719.patch

glibc-rh1631728.patch

glibc-rh1623519-2.patch

- Auto-sync with upstream branch release/2.28/master,

commit fc0e3393ff775aa795b523083bb0db7f18d3b91e:

- RISC-V: Move libc_fesetround_riscv after libc_feholdexcept_riscv

- pthread_spawn: Fix potential segfault in maybe_script_execute

- preadv2/pwritev2: Fix misreported errno (swbz#23579)

- kl_GL: Fix spelling of Sunday, should be "sapaat" (swbz#20209)

- i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK (swbz#23716)

- pthread_mutex_lock: Fix race while promoting to PTHREAD_MUTEX_ELISION_NP

(swbz#23275)

- signal: Use correct type for si_band in siginfo_t (swbz#23562)

- stdlib/test-bz22786: Avoid spurious test failures using alias mappings

- x86: Fix Haswell CPU string flags (swbz#23709)

- libanl: Fix crash if first helper thread creation failed (#1646381)

* Thu Nov 1 2018 Mike FABIAN - 2.28-17

- Include Esperanto (eo) in glibc-all-langpacks (#1643756)

* Thu Sep 27 2018 Florian Weimer - 2.28-16

- stdlib/tst-setcontext9 test suite failure on ppc64le (#1623519)

* Wed Sep 26 2018 Florian Weimer - 2.28-15

- Add missing ENDBR32 in start.S (#1631728)

* Wed Sep 26 2018 Florian Weimer - 2.28-14

- Fix bug in generic strstr with large needles (#1631719)

* Wed Sep 26 2018 Florian Weimer - 2.28-13

- stdlib/tst-setcontext9 test suite failure (#1623519)

* Wed Sep 26 2018 Florian Weimer - 2.28-12

- gethostid: Missing NULL check for gethostbyname_r result (#1631338)

* Wed Sep 5 2018 Florian Weimer - 2.28-11

- Add python3-devel build dependency for downstream benefit

* Wed Sep 5 2018 Carlos O'Donell - 2.28-10

- Provide compatibility support for linking against libpthread_nonshared.a

(#1625507)

[ 1 ] Bug #1652228 - glibc: Do not use parallel make for building locales

https://bugzilla.redhat.com/show_bug.cgi?id=1652228

[ 2 ] Bug #1654000 - CVE-2018-19591 glibc: file descriptor leak in if_nametoindex() in sysdeps/unix/sysv/linux/if_index.c [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1654000

su -c 'dnf upgrade --advisory FEDORA-2018-f6b7df660d' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/