Stay Secure with the Latest Linux Advisories

security advisorymoderatedenial of service

Ubuntu 12.04 LTS USN-3239-3 Moderate: eglibc IPv6 Resolution Issue

USN-3239-1 introduced a regression in the GNU C Library.. =========================================================================Ubuntu Security Notice USN-3239-3 March 24, 2017 eglibc regression ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: USN-3239-1 introduced a regression in the GNU C Library. Software Description: - eglibc: GNU C Library Details: USN-3239-1 fixed vulnerabilities in the GNU C Library. Unfortunately, the fix for CVE-2016-3706 introduced a regression that in some circumstances prevented IPv6 addresses from resolving. This update reverts the change in Ubuntu 12.04 LTS. We apologize for the error. Original advisory details: It was discovered that the GNU C Library incorrectly handled the strxfrm() function. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8982) It was discovered that an integer overflow existed in the _IO_wstr_overflow() function of the GNU C Library. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8983) It was discovered that the fnmatch() function in the GNU C Library did not properly handle certain malformed patterns. An attacker could use this to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8984) Alexander Cherepanov discovered a stack-based buffer overflow in the glob implementation of the GNU C Library. An attacker could use this to specially craft a directory layout and cause a denial of service. (CVE-2016-1234) Michael Petlan discovered an unbounded stack allocation in the getaddrinfo() function of the GNU C Library. An attacker could use this to cause a denial ofservice. (CVE-2016-3706) Aldy Hernandez discovered an unbounded stack allocation in the sunrpc implementation in the GNU C Library. An attacker could use this to cause a denial of service. (CVE-2016-4429) Tim Ruehsen discovered that the getaddrinfo() implementation in the GNU C Library did not properly track memory allocations. An attacker could use this to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5417) Andreas Schwab discovered that the GNU C Library on ARM 32-bit platforms did not properly set up execution contexts. An attacker could use this to cause a denial of service. (CVE-2016-6323) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: libc6 2.15-0ubuntu10.18 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3239-3 https://ubuntu.com/security/notices/USN-3239-1 https://bugs.launchpad.net/glibc/+bug/1674776 Package Information: https://launchpad.net/ubuntu/+source/eglibc/2.15-0ubuntu10.18 . Revision for Ubuntu 12.04 LTS addresses a bug in GNU C Library that impacts IPv6 name resolution.. GNU C Library, ubuntu update, eglibc issue, security fix. . Severity: Important. LinuxSecurity.com Team

Mar 24, 2017 •Important Ubuntu