MGASA-2021-0053 - Updated glibc packages fix security vulnerability

Publication date: 24 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0053.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-25013,
     CVE-2020-6096,
     CVE-2020-29562

Security fixes:
- fix buffer overrun in EUC-KR conversion module [bz #2497] (CVE-2019-25013)
- arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620]
- arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]
- iconv: Fix incorrect UCS4 inner loop bounds [BZ #26923] (CVE-2020-29562)
other upstream fixes:
- libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203]
- string.h: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]
- misc/test-errno-linux: Handle EINVAL from quotactl
- nss_compat: internal_end*ent may clobber errno, hiding ERANGE [BZ #25976]
- Fix avx2 strncmp offset compare condition check [BZ #25933]
- AArch64: Align ENTRY to a cacheline
- AArch64: Add optimized Q-register memcpy
- AArch64: Improve backwards memmove performance
- AArch64: Rename IS_ARES to IS_NEOVERSE_N1
- AArch64: Increase small and medium cases for __memcpy_generic
- AArch64: Improve integer memcpy
- AArch64: Use __memcpy_simd on Neoverse N2/V1
- AArch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
- AArch64: fix stack missing after sp is updated
- x86-64: Avoid rep movsb with short distance [BZ #27130]
- x86: Assume --enable-cet if GCC defaults to CET [BZ #25225]
- x86: Check IFUNC definition in unrelocated executable [BZ #20019]
- x86: Set header.feature_1 in TCB for always-on CET [BZ #27177]
- Fix parsing of /sys/devices/system/cpu/online [BZ #25859]
- Use O_CLOEXEC in sysconf [BZ #26791]

References:
- https://bugs.mageia.org/show_bug.cgi?id=28161
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25013
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6096
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29562

SRPMS:
- 7/core/glibc-2.29-21.mga7

Mageia 2021-0053: glibc security update

Security fixes: - fix buffer overrun in EUC-KR conversion module [bz #2497] (CVE-2019-25013) - arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620] - arm: CVE-2...

Summary

Security fixes: - fix buffer overrun in EUC-KR conversion module [bz #2497] (CVE-2019-25013) - arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620] - arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620] - iconv: Fix incorrect UCS4 inner loop bounds [BZ #26923] (CVE-2020-29562) other upstream fixes: - libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203] - string.h: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232] - misc/test-errno-linux: Handle EINVAL from quotactl - nss_compat: internal_end*ent may clobber errno, hiding ERANGE [BZ #25976] - Fix avx2 strncmp offset compare condition check [BZ #25933] - AArch64: Align ENTRY to a cacheline - AArch64: Add optimized Q-register memcpy - AArch64: Improve backwards memmove performance - AArch64: Rename IS_ARES to IS_NEOVERSE_N1 - AArch64: Increase small and medium cases for __memcpy_generic - AArch64: Improve integer memcpy - AArch64: Use __memcpy_simd on Neoverse N2/V1 - AArch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798] - AArch64: fix stack missing after sp is updated - x86-64: Avoid rep movsb with short distance [BZ #27130] - x86: Assume --enable-cet if GCC defaults to CET [BZ #25225] - x86: Check IFUNC definition in unrelocated executable [BZ #20019] - x86: Set header.feature_1 in TCB for always-on CET [BZ #27177] - Fix parsing of /sys/devices/system/cpu/online [BZ #25859] - Use O_CLOEXEC in sysconf [BZ #26791]

References

- https://bugs.mageia.org/show_bug.cgi?id=28161

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25013

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6096

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29562

Resolution

MGASA-2021-0053 - Updated glibc packages fix security vulnerability

SRPMS

- 7/core/glibc-2.29-21.mga7

Severity
Publication date: 24 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0053.html
Type: security
CVE: CVE-2019-25013, CVE-2020-6096, CVE-2020-29562

Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved