Ubuntu 14.10 USN-2432-1 Critical: Glibc Denial Of Service Issues

ubuntu

December 3, 2014

The GNU C Library could be made to crash or run programs.

Summary

The GNU C Library could be made to crash or run programs.

Software Description:

- glibc: GNU C Library

- eglibc: GNU C Library

Details:

Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled

certain multibyte characters when using the iconv function. An attacker

could possibly use this issue to cause applications to crash, resulting in

a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu

12.04 LTS. (CVE-2012-6656)

Adhemerval Zanella Netto discovered that the GNU C Library incorrectly

handled certain multibyte characters when using the iconv function. An

attacker could possibly use this issue to cause applications to crash,

resulting in a denial of service. (CVE-2014-6040)

Tim Waugh discovered that the GNU C Library incorrectly enforced the

WRDE_NOCMD flag when handling the wordexp function. An attacker could

possibly use this issue to execute arbitrary commands. (CVE-2014-7817)

Topics Covered

security advisory denial of service Ubuntu glibc service interruption eglibraries

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libc6                           2.19-10ubuntu2.1

Ubuntu 14.04 LTS:
  libc6                           2.19-0ubuntu6.4

Ubuntu 12.04 LTS:
  libc6                           2.15-0ubuntu10.9

Ubuntu 10.04 LTS:
  libc6                           2.11.1-0ubuntu7.19

After a standard system update you need to reboot your computer to make all
the necessary changes.