Ubuntu 12.04 LTS USN-1589-1 Critical GNU C Library Buffer Overflow

ubuntu

October 2, 2012

Multiple security issues were fixed in the GNU C Library.

Summary

Multiple security issues were fixed in the GNU C Library.

Software Description:

- eglibc: GNU C Library

- glibc: GNU C Library

Details:

It was discovered that positional arguments to the printf() family

of functions were not handled properly in the GNU C Library. An

attacker could possibly use this to cause a stack-based buffer

overflow, creating a denial of service or possibly execute arbitrary

code. (CVE-2012-3404, CVE-2012-3405, CVE-2012-3406)

It was discovered that multiple integer overflows existed in the

strtod(), strtof() and strtold() functions in the GNU C Library. An

attacker could possibly use this to trigger a stack-based buffer

overflow, creating a denial of service or possibly execute arbitrary

code. (CVE-2012-3480)

Topics Covered

security advisory denial of service buffer overflow glibc ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libc6                           2.15-0ubuntu10.2

Ubuntu 11.10:
  libc6                           2.13-20ubuntu5.2

Ubuntu 11.04:
  libc6                           2.13-0ubuntu13.2

Ubuntu 10.04 LTS:
  libc6                           2.11.1-0ubuntu7.11

Ubuntu 8.04 LTS:
  libc6                           2.7-10ubuntu8.2

After a standard system update you need to reboot your computer to make
all the necessary changes.