Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia: 2022-0028 Critical: Glibc Buffer Overflow and Code Execution Risk

mageia
Calendar Grey January 23, 2022
Dist Mageia Esm H88
Fedora enhances python packages to mitigate security vulnerabilities and code injection threats in advisory FSA-2022-0030.
Updated glibc packages fix security vulnerabilities: The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies...

Summary

Updated glibc packages fix security vulnerabilities:
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution (CVE-2022-23218).
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution (CVE-2022-23219).

References

- https://bugs.mageia.org/show_bug.cgi?id=29928

- https://www.cve.org/CVERecord?id=CVE-2022-23218

- https://www.cve.org/CVERecord?id=CVE-2022-23219

Resolution

SRPMS

- 8/core/glibc-2.32-23.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 23 Jan 2022
URL: https://advisories.mageia.org/MGASA-2022-0028.html
Type: security
CVE: CVE-2022-23218, CVE-2022-23219

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here