Scientific Linux 7: SLSA-2015:2172-1 Important: glibc Heap Corruption

Date: Mon, 21 Dec 2015 23:11:28 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Important: glibc on SL7.x x86_64
MIME-Version: 1.0
Message-ID: <20151221231128.7116.32766@slpackages.fnal.gov>

Synopsis: Important: glibc security update
Advisory ID: SLSA-2015:2172-1
Issue Date: 2015-11-19
CVE Numbers: CVE-2015-5277
--

It was discovered that the nss_files backend for the Name Service Switch
in glibc would return incorrect data to applications or corrupt the heap
(depending on adjacent heap contents) in certain cases. A local attacker
could potentially use this flaw to escalate their privileges.
(CVE-2015-5277)
--

SL7
 x86_64
 glibc-2.17-106.el7_2.1.i686.rpm
 glibc-2.17-106.el7_2.1.x86_64.rpm
 glibc-common-2.17-106.el7_2.1.x86_64.rpm
 glibc-debuginfo-2.17-106.el7_2.1.i686.rpm
 glibc-debuginfo-2.17-106.el7_2.1.x86_64.rpm
 glibc-debuginfo-common-2.17-106.el7_2.1.i686.rpm
 glibc-debuginfo-common-2.17-106.el7_2.1.x86_64.rpm
 glibc-devel-2.17-106.el7_2.1.i686.rpm
 glibc-devel-2.17-106.el7_2.1.x86_64.rpm
 glibc-headers-2.17-106.el7_2.1.x86_64.rpm
 glibc-utils-2.17-106.el7_2.1.x86_64.rpm
 nscd-2.17-106.el7_2.1.x86_64.rpm
 glibc-static-2.17-106.el7_2.1.i686.rpm
 glibc-static-2.17-106.el7_2.1.x86_64.rpm

- Scientific Linux Development Team