ELSA-2014-1391

ELSA-2014-1391 - glibc security, bug fix, and enhancement update

Type:	SECURITY
Severity:	MODERATE
Release Date:	2014-10-15

Description

[2.12-1.149]
- Remove gconv transliteration loadable modules support (CVE-2014-5119,
- _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,

[2.12-1.148]
- Switch gettimeofday from INTUSE to libc_hidden_proto (#1099025).

[2.12-1.147]
- Fix stack overflow due to large AF_INET6 requests (CVE-2013-4458, #1111460).
- Fix buffer overflow in readdir_r (CVE-2013-4237, #1111460).

[2.12-1.146]
- Fix memory order when reading libgcc handle (#905941).
- Fix format specifier in malloc_info output (#1027261).
- Fix nscd lookup for innetgr when netgroup has wildcards (#1054846).

[2.12-1.145]
- Add mmap usage to malloc_info output (#1027261).

[2.12-1.144]
- Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (#1087833).

[2.12-1.143]
- [ppc] Add VDSO IFUNC for gettimeofday (#1028285).
- [ppc] Fix ftime gettimeofday internal call returning bogus data (#1099025).

[2.12-1.142]
- Also relocate in dependency order when doing symbol dependency testing
(#1019916).

[2.12-1.141]
- Fix infinite loop in nscd when netgroup is empty (#1085273).
- Provide correct buffer length to netgroup queries in nscd (#1074342).
- Return NULL for wildcard values in getnetgrent from nscd (#1085289).
- Avoid overlapping addresses to stpcpy calls in nscd (#1082379).
- Initialize all of datahead structure in nscd (#1074353).

[2.12-1.140]
- Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN (#1044628).

[2.12-1.139]
- Do not fail if one of the two responses to AF_UNSPEC fails (#845218).

[2.12-1.138]
- nscd: Make SELinux checks dynamic (#1025933).

[2.12-1.137]
- Fix race in free() of fastbin chunk (#1027101).

[2.12-1.136]
- Fix copy relocations handling of unique objects (#1032628).

[2.12-1.135]
- Fix encoding name for IDN in getaddrinfo (#981942).

[2.12-1.134]
- Fix return code from getent netgroup when the netgroup is not found (#1039988).
- Fix handling of static TLS in dlopen'ed objects (#995972).

[2.12-1.133]
- Don't use alloca in addgetnetgrentX (#1043557).
- Adjust pointers to triplets in netgroup query data (#1043557).

Related CVEs

CVE-2013-4237

CVE-2013-4458

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory
Oracle Linux 6 (i386)	glibc-2.12-1.149.el6.src.rpm	c4d014029a2e124ba2e56f8507daa596	ELBA-2019-4614
	glibc-2.12-1.149.el6.i686.rpm	2aaa49ddbe7af8a2fdddcc40338c9ebe	ELBA-2019-4614
	glibc-common-2.12-1.149.el6.i686.rpm	cf1e840c483a984618000c525dac9473	ELBA-2019-4614
	glibc-devel-2.12-1.149.el6.i686.rpm	2f06209691a807eea160e0701f2c4b71	ELBA-2019-4614
	glibc-headers-2.12-1.149.el6.i686.rpm	7f79299de3df4d0e9dc9903b7130bb93	ELBA-2019-4614
	glibc-static-2.12-1.149.el6.i686.rpm	c503611291ebbd0290e5a2d3d1280227	ELBA-2019-4614
	glibc-utils-2.12-1.149.el6.i686.rpm	1a74d650393b0e06b3c07b41a4e1b9c5	ELBA-2019-4614
	nscd-2.12-1.149.el6.i686.rpm	c67670ef8db6716cc24cbd208e1e8cd5	ELBA-2019-4614
Oracle Linux 6 (x86_64)	glibc-2.12-1.149.el6.src.rpm	c4d014029a2e124ba2e56f8507daa596	ELBA-2019-4614
	glibc-2.12-1.149.el6.i686.rpm	2aaa49ddbe7af8a2fdddcc40338c9ebe	ELBA-2019-4614
	glibc-2.12-1.149.el6.x86_64.rpm	1ec166f1d8f231548c466b6ab86e124e	ELBA-2019-4614
	glibc-common-2.12-1.149.el6.x86_64.rpm	2533105ddf1abd9b3d88884f0e0ebb9a	ELBA-2019-4614
	glibc-devel-2.12-1.149.el6.i686.rpm	2f06209691a807eea160e0701f2c4b71	ELBA-2019-4614
	glibc-devel-2.12-1.149.el6.x86_64.rpm	915450155f878d7012f163c40ae0b0b2	ELBA-2019-4614
	glibc-headers-2.12-1.149.el6.x86_64.rpm	2fc537597a19d54c1394a64366758c61	ELBA-2019-4614
	glibc-static-2.12-1.149.el6.i686.rpm	c503611291ebbd0290e5a2d3d1280227	ELBA-2019-4614
	glibc-static-2.12-1.149.el6.x86_64.rpm	e9bc96a4a444d94cea38457f39ea9c2e	ELBA-2019-4614
	glibc-utils-2.12-1.149.el6.x86_64.rpm	a555c83a7ec52c1d5478a078a0fcec61	ELBA-2019-4614
	nscd-2.12-1.149.el6.x86_64.rpm	0c8ef259ca00f850ad5f2b0470959452	ELBA-2019-4614

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team