MGASA-2024-0026 - Updated glibc packages fix security vulnerabilities

Publication date: 04 Feb 2024
URL: https://advisories.mageia.org/MGASA-2024-0026.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-6246,
     CVE-2023-6779,
     CVE-2023-6780

The updated packages fix security vulnerabilities:
A heap-based buffer overflow was found in the __vsyslog_internal
function of the glibc library. This function is called by the syslog and
vsyslog functions. This issue occurs when the openlog function was not
called, or called with the ident argument set to NULL, and the program
name (the basename of argv[0]) is bigger than 1024 bytes, resulting in
an application crash or local privilege escalation. (CVE-2023-6246)
An off-by-one heap-based buffer overflow was found in the
__vsyslog_internal function of the glibc library. This function is
called by the syslog and vsyslog functions. This issue occurs when these
functions are called with a message bigger than INT_MAX bytes, leading
to an incorrect calculation of the buffer size to store the message,
resulting in an application crash. (CVE-2023-6779)
An integer overflow was found in the __vsyslog_internal function of the
glibc library. This function is called by the syslog and vsyslog
functions. This issue occurs when these functions are called with a very
long message, leading to an incorrect calculation of the buffer size to
store the message, resulting in undefined behavior. (CVE-2023-6780)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32796
- https://security-tracker.debian.org/tracker/DSA-5611-1
- https://bodhi.fedoraproject.org/updates/FEDORA-2024-aec80d6e8a
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6246
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6779
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6780

SRPMS:
- 9/core/glibc-2.36-52.mga9

Mageia 2024-0026: glibc security update

The updated packages fix security vulnerabilities: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library

Summary

The updated packages fix security vulnerabilities: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. (CVE-2023-6246) An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. (CVE-2023-6779) An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. (CVE-2023-6780)

References

- https://bugs.mageia.org/show_bug.cgi?id=32796

- https://security-tracker.debian.org/tracker/DSA-5611-1

- https://bodhi.fedoraproject.org/updates/FEDORA-2024-aec80d6e8a

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6246

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6779

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6780

Resolution

MGASA-2024-0026 - Updated glibc packages fix security vulnerabilities

SRPMS

- 9/core/glibc-2.36-52.mga9

Severity
Publication date: 04 Feb 2024
URL: https://advisories.mageia.org/MGASA-2024-0026.html
Type: security
CVE: CVE-2023-6246, CVE-2023-6779, CVE-2023-6780

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo