Scientific Linux: SLSA-2013:0769-1 Low: glibc Memory Crash Risk

Date: Thu, 25 Apr 2013 14:05:45 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Low: glibc on SL5.x i386/x86_64
MIME-Version: 1.0

Synopsis: Low: glibc security and bug fix update
Advisory ID: SLSA-2013:0769-1
Issue Date: 2013-04-24
CVE Numbers: CVE-2013-0242
 CVE-2013-1914
--

It was found that getaddrinfo() did not limit the amount of stack memory
used during name resolution. An attacker able to make an application
resolve an attacker-controlled hostname or IP address could possibly cause
the application to exhaust all stack memory and crash. (CVE-2013-1914)

A flaw was found in the regular expression matching routines that process
multibyte character input. If an application utilized the glibc regular
expression matching mechanism, an attacker could provide specially-crafted
input that, when processed, would cause the application to crash.
(CVE-2013-0242)

This update also fixes the following bugs:

* The improvements made in a previous update to the accuracy of floating point
functions in the math library caused performance regressions for those
functions. The performance regressions were analyzed and a fix was applied
that retains the current accuracy but reduces the performance penalty to
acceptable levels.

* It was possible that a memory location freed by the localization code
could be accessed immediately after, resulting in a crash. The fix ensures
that the application does not crash by avoiding the invalid memory access.
--

SL5
 x86_64
 glibc-2.5-107.el5_9.4.i686.rpm
 glibc-2.5-107.el5_9.4.x86_64.rpm
 glibc-common-2.5-107.el5_9.4.x86_64.rpm
 glibc-debuginfo-2.5-107.el5_9.4.i386.rpm
 glibc-debuginfo-2.5-107.el5_9.4.i686.rpm
 glibc-debuginfo-2.5-107.el5_9.4.x86_64.rpm
 glibc-debuginfo-common-2.5-107.el5_9.4.i386.rpm
 glibc-devel-2.5-107.el5_9.4.i386.rpm
 glibc-devel-2.5-107.el5_9.4.x86_64.rpm
 glibc-headers-2.5-107.el5_9.4.x86_64.rpm
 glibc-utils-2.5-107.el5_9.4.x86_64.rpm
 nscd-2.5-107.el5_9.4.x86_64.rpm
 i386
 glibc-2.5-107.el5_9.4.i386.rpm
 glibc-2.5-107.el5_9.4.i686.rpm
 glibc-common-2.5-107.el5_9.4.i386.rpm
 glibc-debuginfo-2.5-107.el5_9.4.i386.rpm
 glibc-debuginfo-2.5-107.el5_9.4.i686.rpm
 glibc-debuginfo-common-2.5-107.el5_9.4.i386.rpm
 glibc-devel-2.5-107.el5_9.4.i386.rpm
 glibc-headers-2.5-107.el5_9.4.i386.rpm
 glibc-utils-2.5-107.el5_9.4.i386.rpm
 nscd-2.5-107.el5_9.4.i386.rpm

- Scientific Linux Development Team