Red Hat: RHSA-2021-1585-01 Moderate: glibc Buffer Over-read
red hat
May 18, 2021
An update for glibc is now available for Red Hat Enterprise Linux 8
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
For the update to take effect, all services linked to the glibc library
must be restarted, or the system rebooted.
Summary
The glibc packages provide the standard C libraries (libc), POSIX thread
libraries (libpthread), standard math libraries (libm), and the name
service cache daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: buffer over-read in iconv when processing invalid multi-byte input
sequences in the EUC-KR encoding (CVE-2019-25013)
* glibc: regular-expression match via proceed_next_node in posix/regexec.c
leads to heap-based buffer over-read (CVE-2019-9169)
* glibc: assertion failure in ISO-2022-JP-3 gconv module related to
combining characters (CVE-2021-3326)
* glibc: iconv program can hang when invoked with the -c option
(CVE-2016-10228)
* glibc: iconv when processing invalid multi-byte input sequences fails to
advance the input state, which could result in an infinite loop
(CVE-2020-27618)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.4 Release Notes linked from the References section.
References
https://access.redhat.com/security/cve/CVE-2016-10228 https://access.redhat.com/security/cve/CVE-2019-9169 https://access.redhat.com/security/cve/CVE-2019-25013 https://access.redhat.com/security/cve/CVE-2020-27618 https://access.redhat.com/security/cve/CVE-2021-3326 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/
Package List
Red Hat Enterprise Linux AppStream (v. 8):
aarch64:
compat-libpthread-nonshared-2.28-151.el8.aarch64.rpm
glibc-debuginfo-2.28-151.el8.aarch64.rpm
glibc-utils-2.28-151.el8.aarch64.rpm
ppc64le:
compat-libpthread-nonshared-2.28-151.el8.ppc64le.rpm
glibc-debuginfo-2.28-151.el8.ppc64le.rpm
glibc-debuginfo-common-2.28-151.el8.ppc64le.rpm
glibc-utils-2.28-151.el8.ppc64le.rpm
s390x:
compat-libpthread-nonshared-2.28-151.el8.s390x.rpm
glibc-debuginfo-2.28-151.el8.s390x.rpm
glibc-debuginfo-common-2.28-151.el8.s390x.rpm
glibc-utils-2.28-151.el8.s390x.rpm
x86_64:
compat-libpthread-nonshared-2.28-151.el8.x86_64.rpm
glibc-debuginfo-2.28-151.el8.x86_64.rpm
glibc-debuginfo-common-2.28-151.el8.x86_64.rpm
glibc-utils-2.28-151.el8.x86_64.rpm
Red Hat Enterprise Linux BaseOS (v. 8):
Source:
glibc-2.28-151.el8.src.rpm
aarch64:
glibc-2.28-151.el8.aarch64.rpm
glibc-all-langpacks-2.28-151.el8.aarch64.rpm
glibc-common-2.28-151.el8.aarch64.rpm
glibc-debuginfo-2.28-151.el8.aarch64.rpm
glibc-devel-2.28-151.el8.aarch64.rpm
glibc-headers-2.28-151.el8.aarch64.rpm
glibc-langpack-aa-2.28-151.el8.aarch64.rpm
glibc-langpack-af-2.28-151.el8.aarch64.rpm
glibc-langpack-agr-2.28-151.el8.aarch64.rpm
glibc-langpack-ak-2.28-151.el8.aarch64.rpm
glibc-langpack-am-2.28-151.el8.aarch64.rpm
Read the Full Advisory
PREVIOUS
NEXT
Advisory ID: RHSA-2021:1585-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1585
Issue date: 2021-05-18
Topic
An update for glibc is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Relevant Releases Architectures
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64
Bugs Fixed
1428290 - CVE-2016-10228 glibc: iconv program can hang when invoked with the -c option
1684057 - CVE-2019-9169 glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read
1704868 - CVE-2016-10228 glibc: iconv: Fix converter hangs and front end option parsing for //TRANSLIT and //IGNORE [rhel-8]
1855790 - glibc: Update Intel CET support from upstream
1856398 - glibc: Build with -moutline-atomics on aarch64
1868106 - glibc: Transaction ID collisions cause slow DNS lookups in getaddrinfo
1871385 - glibc: Improve auditing implementation (including DT_AUDIT, and DT_DEPAUDIT)
1871387 - glibc: Improve IBM POWER9 architecture performance
1871394 - glibc: Fix AVX2 off-by-one error in strncmp (swbz#25933)
1871395 - glibc: Improve IBM Z (s390x) Performance
1871396 - glibc: Improve use of static TLS surplus for optimizations.
1871397 - glibc: Fix fgetsgent_r data corruption bug
1880670 - glibc: memcpy calls are slower for x86_64 processors on RHEL 8 than on RHEL 7
1893662 - glibc: Fix DT_AARCH64_VARIANT_PCS handling (lazy binding not disabled)
1893708 - CVE-2020-27618 glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop
1912960 - CVE-2019-25013 glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!