Ubuntu 15.10 USN-2985-2 Moderate: glibc Regression Issue

ubuntu

May 26, 2016

USN-2985-1 introduced a regression in the GNU C Library.

Summary

USN-2985-1 introduced a regression in the GNU C Library.

Software Description:

- glibc: GNU C Library

- eglibc: GNU C Library

Details:

USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for

CVE-2014-9761 introduced a regression which affected applications that

use the libm library but were not fully restarted after the upgrade.

This update removes the fix for CVE-2014-9761 and a future update

will be provided to address this issue.

We apologize for the inconvenience.

Original advisory details:

Martin Carpenter discovered that pt_chown in the GNU C Library did not

properly check permissions for tty files. A local attacker could use this

to gain administrative privileges or expose sensitive information.

(CVE-2013-2207, CVE-2016-2856)

Robin Hack discovered that the Name Service Switch (NSS) implementation in

the GNU C Library did not properly manage its file descriptors. An attacker

could use this to cause a denial of service (infin...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu glibc application crash regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libc-bin                        2.21-0ubuntu4.3
  libc6                           2.21-0ubuntu4.3
  libc6-dev                       2.21-0ubuntu4.3

Ubuntu 14.04 LTS:
  libc-bin                        2.19-0ubuntu6.9
  libc6                           2.19-0ubuntu6.9
  libc6-dev                       2.19-0ubuntu6.9

Ubuntu 12.04 LTS:
  libc-bin                        2.15-0ubuntu10.15
  libc6                           2.15-0ubuntu10.15
  libc6-dev                       2.15-0ubuntu10.15

After a standard system update you need to reboot your computer to
make all the necessary changes.