Alerts This Week
Warning Icon 1 905
Alerts This Week
Warning Icon 1 905

Red Hat Enterprise Linux 7 RHSA-2018-3092 Moderate: Glibc Security Fix

red hat
Calendar Grey October 30, 2018
Dist Redhat Esm H88
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ====================================================
An update for glibc is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted.

Summary

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries (CVE-2017-16997)
* glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)
* glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow (CVE-2018-11236)
* glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory security update buffer overflow bug fix Red Hat Enterprise Linux glibc Moderate severity

References

https://access.redhat.com/security/cve/CVE-2017-16997 https://access.redhat.com/security/cve/CVE-2018-6485 https://access.redhat.com/security/cve/CVE-2018-11236 https://access.redhat.com/security/cve/CVE-2018-11237 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: glibc-2.17-260.el7.src.rpm
x86_64: glibc-2.17-260.el7.i686.rpm glibc-2.17-260.el7.x86_64.rpm glibc-common-2.17-260.el7.x86_64.rpm glibc-debuginfo-2.17-260.el7.i686.rpm glibc-debuginfo-2.17-260.el7.x86_64.rpm glibc-debuginfo-common-2.17-260.el7.i686.rpm glibc-debuginfo-common-2.17-260.el7.x86_64.rpm glibc-devel-2.17-260.el7.i686.rpm glibc-devel-2.17-260.el7.x86_64.rpm glibc-headers-2.17-260.el7.x86_64.rpm glibc-utils-2.17-260.el7.x86_64.rpm nscd-2.17-260.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: glibc-debuginfo-2.17-260.el7.i686.rpm glibc-debuginfo-2.17-260.el7.x86_64.rpm glibc-debuginfo-common-2.17-260.el7.i686.rpm glibc-debuginfo-common-2.17-260.el7.x86_64.rpm glibc-static-2.17-260.el7.i686.rpm glibc-static-2.17-260.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: glibc-2.17-260.el7.src.rpm
x86_64: glibc-2.17-260.el7.i686.rpm glibc-2.17-260.el7.x86_64.rpm glibc-common-2.17-260.el7.x86_64.rpm glibc-debuginfo-2.17-260.el7.i686.rpm glibc-debuginfo-2.17-260.el7.x86_64.rpm glibc-debuginfo-common-2.17-260.el7.i686.rpm glibc-debuginfo-common-2.17-260.el7.x86_64.rpm glibc-devel-2.17-260.el7.i686.rpm glibc-devel-2.17-260.el7.x86_64.rpm glibc-headers-2.17-260.el7.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2018:3092-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:3092
Issue date: 2018-10-30

Topic

An update for glibc is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update buffer overflow bug fix Red Hat Enterprise Linux glibc Moderate severity

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x

Bugs Fixed

1349967 - Fix warning: "IN_MODULE" redefined [enabled by default]

1349982 - Fix static analysis warnings in build-locale-archive.c.

1372304 - glibc: backport build/testing time improvements

1401665 - Fix process shared robust mutex defects.

1408964 - RFE: Add Provides: nss_db to the glibc rpm

1448107 - glibc: Add el_GR@euro, ur_IN, and wal_ET locales

1461231 - [RFE] Support OFD locking constants, but disable them for 32-bit offsets (not following upstream) (glibc)

1471405 - glibc: Define O_TMPFILE macro

1476120 - glibc headers don't include linux/falloc.h, and therefore doesn't include fallocate() flags

1505451 - pthread_barrier_init typo has in-theory-undefined behavior

1505477 - strftime_l: Fix multiline macro DO_NUMBER (GCC 8 warnings, and coverity warnings)

1505492 - glibc: Build with -Werror and -Wundef

1505500 - locale: Transliteration function may return address of local variable.

1505647 - NSCD not properly caching netgroup

1526865 - CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries

1531168 - glibc: setcontext/makecontext alignment issues on x86

1542102 - CVE-2018-6485 glibc: Integer overflow in posix_memalign in memalign functions

1560641 - sem_open - valgrind complains about uninitialised bytes

1563046 - getlogin_r: return early when linux sentinel value is set

1563747 - glibc: Adjust system call name list to Linux 4.16+

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here