OVMSA-2015-0024 - glibc security update
| Type: | SECURITY |
| Impact: | CRITICAL |
| Release Date: | 2015-01-29 |
Description
[2.5-123.0.1.el5_11.1]
- Switch to use malloc when the input line is too long [Orabug 19951108]
- Use a /sys/devices/system/cpu/online for _SC_NPROCESSORS_ONLN implementation [Orabug 17642251] (Joe Jin)
[2.5-123.1]
- Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183532).
[2.5-123]
- Remove gconv transliteration loadable modules support (CVE-2014-5119,
- _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,
[2.5-122]
- Fix patch for integer overflows in *valloc and memalign.
(CVE-2013-4332,#1011805).
[2.5-121]
- Fix return code when starting an already started nscd daemon (#979413).
- Fix getnameinfo for many PTR record queries (#1020486).
- Return EINVAL error for negative sizees to getgroups (#995207).
[2.5-120]
- Fix integer overflows in *valloc and memalign. (CVE-2013-4332,#1011805).
[2.5-119]
- Add support for newer L3 caches on x86-64 and correctly count
the number of hardware threads sharing a cacheline (#1003420).
[2.5-118]
- Revert incomplete fix for bug #758193.
[2.5.117]
- Fix _nl_find_msg malloc failure case, and callers (#957089).
[2.5-116]
- Test on init_fct, not result->__init_fct, after demangling (#816647).
[2.5-115]
- Don't handle ttl == 0 specially (#929035).
[2.5-114]
- Fix multibyte character processing crash in regexp (CVE-2013-0242, #951132)
- Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951132)
[2.5-113]
- Add missing patch to avoid use after free (#816647)
[2.5-112]
- Fix race in initgroups compat_call (#706571)
[2.5-111]
- Fix return value from getaddrinfo when servers are down. (#758193)
[2.5-110]
- Fix fseek on wide character streams. Sync's seeking code with RHEL 6
(#835828)
[2.5-109]
- Call feraiseexcept only if exceptions are not masked (#861871).
[2.5-108]
- Always demangle function before checking for NULL value. (#816647).
[2.5-107]
- Do not fail in ttyname if /proc is not available (#851450).
[2.5-106]
- Fix errno for various overflow situations in vfprintf. Add
missing overflow checks. (#857387)
[2.5-105]
- Handle failure of _nl_explode_name in all cases (#848481)
- Define the default fuzz factor to 2 to make it easier to manipulate
RHEL 5 RPMs on RHEL 6 and newer systems.
[2.5-104]
- Fix race in intl/* testsuite (#849202)
[2.5-103]
- Fix out of bounds array access in strto* exposed by 847930 patch.
[2.5-102]
- Really fix POWER4 strncmp crash (#766832).
- Fix integer overflow leading to buffer overflow in strto* (#847930)
[2.5-101]
- Fix race in msort/qsort (#843672)
- Fix regression due to 797096 changes (#845952)
[2.5-100]
- Do not use PT_IEEE_IP ptrace calls (#839572)
- Update ULPs (#837852)
[2.5-99]
- Fix various transcendentals in non-default rounding modes (#837852)
[2.5-98]
- Fix unbound alloca in vfprintf (#826947)
[2.5-97]
- Fix iconv() segfault if the invalid multibyte character 0xffff is input when
converting from IBM930. (#823905)
[2.5-96]
- Fix fnmatch() when '*' wildcard is applied on a file name containing multibyte chars. (#819430)
[2.5-95]
- Fix unbound allocas use in glob_in_dir, getaddrinfo and others. (#797096)
[2.5-94]
- Fix segfault when running ld.so --verify on some DSO's in current working directory. (#808342)
[2.5-93]
- Incorrect initialization order for dynamic loader (#813348)
[2.5-92]
- Fix return code when stopping already stopped nscd daemon (#678227)
- Remove MAP_32BIT for pthread stack mappings,
use MAP_STACK instead (#641094)
- Fix setuid vs sighandler_setxid race (#769852)
- Fix access after end of search string in regex matcher (#757887)
- Fix POWER4 strncmp crash (#766832)
- Fix SC_*CACHE detection for X5670 cpus (#692182)
- Fix parsing IPV6 entries in /etc/resolv.conf (#703239)
- Fix double-free in nss_nis code (#500767)
[2.5-91]
- Add kernel VDSO support for s390x (#795896)
[2.5-90]
- Fix race in malloc arena creation and make implementation
match documented behaviour (#800240)
[2.5-89]
- Do not override TTL of CNAME with TTL of its alias (#808014)
- Fix short month names in fi_FI locale #(657266).
- Fix nscd crash for group with large number of members (#788989)
[2.5-88]
- Fix Slovakia currency (#799853)
- Fix getent malloc failure check (#806403)
- Fix short month names in zh_CN locale (#657588)
- Fix decimal point symbol for Portuguese currency (#710216)
- Avoid integer overflow in sbrk (#767358)
- Avoid race between {,__de}allocate_stack and __reclaim_stacks during
fork (#738665)
- Fix race between IO_flush_all_lockp & pthread_cancel (#751748)
[2.5-87]
- Fix memory leak in NIS endgrent (#809325)
[2.5-86]
- Allow getaddr to accept SCTP socket types in hints (#765710)
[2.5-85]
- Fix errno handling in vfprintf (#794814)
[2.5-84]
- Filter out when building file lists (#784646).
[2.5-83]
- Avoid 'nargs' integer overflow which could be used to bypass FORTIFY_SOURCE (#794814)
[2.5-82]
- Fix currency_symbol for uk_UA (#639000)
Related CVEs
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
|
| Oracle VM 2.2 (i386) | glibc-2.5-123.0.1.el5_11.1.src.rpm | 55c09f4916008d7a26bec8a77fc332b775c4b571b675b1c8347fea8794943ec5 | OVMBA-2021-0032 | ovm22_i386_latest |
| glibc-2.5-123.0.1.el5_11.1.i386.rpm | 8d9c0d3316775e2e2c0beb84e497a29a41ecd5f42efe29843cb092e66a0a72f8 | OVMBA-2021-0032 | ovm22_i386_latest |
| glibc-2.5-123.0.1.el5_11.1.i686.rpm | 50a1131295663d99ec05f90a2f5ac23a462aa4f91583a1b69a027e3425c50192 | OVMBA-2021-0032 | ovm22_i386_latest |
| glibc-common-2.5-123.0.1.el5_11.1.i386.rpm | 4e6e9f698b802a2e322ef7ce0f353901845ac9b2e5e0e87720da2a3acad7bc7a | OVMBA-2021-0032 | ovm22_i386_latest |
| nscd-2.5-123.0.1.el5_11.1.i386.rpm | e3d6ff4da3fce7fbbfd512e1a063833322e459b014db004176c0eab4b521fb73 | OVMBA-2021-0032 | ovm22_i386_latest |
|
| Oracle VM 3.2 (x86_64) | glibc-2.5-123.0.1.el5_11.1.src.rpm | 55c09f4916008d7a26bec8a77fc332b775c4b571b675b1c8347fea8794943ec5 | OVMBA-2021-0032 | ovm3_3.2.1_x86_64_patch |
| glibc-2.5-123.0.1.el5_11.1.i686.rpm | 50a1131295663d99ec05f90a2f5ac23a462aa4f91583a1b69a027e3425c50192 | OVMBA-2021-0032 | ovm3_3.2.1_x86_64_patch |
| glibc-2.5-123.0.1.el5_11.1.x86_64.rpm | 36c0f4a828076b4dbba6bc6903aac750acefdae2eda185f4b4df0993e34587f5 | OVMBA-2021-0032 | ovm3_3.2.1_x86_64_patch |
| glibc-common-2.5-123.0.1.el5_11.1.x86_64.rpm | 41c4f1fac95771be72584a26093ee2891da8a3578c00d58b2d711f275b538ec0 | OVMBA-2021-0032 | ovm3_3.2.1_x86_64_patch |
| nscd-2.5-123.0.1.el5_11.1.x86_64.rpm | 5e176970faf4548fc6408b6e6e37112ecf00350c84a9822b8c74f0d07174de8b | OVMBA-2021-0032 | ovm3_3.2.1_x86_64_patch |
This page is generated automatically and has not been checked for errors or omissions. For clarification
or corrections please contact the Oracle Linux ULN team
