Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 442
Alerts This Week
Warning Icon 1 442

Mageia: 2022-0028 Critical: Glibc Buffer Overflow and Code Execution Risk

mageia
Calendar Grey January 23, 2022
Scroller Mageia
Fedora enhances python packages to mitigate security vulnerabilities and code injection threats in advisory FSA-2022-0030.
Updated glibc packages fix security vulnerabilities: The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies...

Summary

Updated glibc packages fix security vulnerabilities:
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution (CVE-2022-23218).
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution (CVE-2022-23219).

References

- https://bugs.mageia.org/show_bug.cgi?id=29928

- https://www.cve.org/CVERecord?id=CVE-2022-23218

- https://www.cve.org/CVERecord?id=CVE-2022-23219

Topics%20covered

Topics Covered

security advisory denial of service security update buffer overflow arbitrary code execution glibc Mageia

Resolution

SRPMS

- 8/core/glibc-2.32-23.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 23 Jan 2022
URL: https://advisories.mageia.org/MGASA-2022-0028.html
Type: security
CVE: CVE-2022-23218, CVE-2022-23219

Topics%20covered

Topics Covered

security advisory denial of service security update buffer overflow arbitrary code execution glibc Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.