Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the nss_files backend for the     Name Service Switch in glibc would return incorrect     data to applications or corrupt the heap (depending on     adjacent heap contents). A local attacker could     potentially use this flaw to execute arbitrary code on     the system.(CVE-2015-5277)

  - A directory traveral flaw was found in the way glibc     loaded locale files. An attacker able to make an     application use a specially crafted locale name value     (for example, specified in an LC_* environment     variable) could possibly use this flaw to execute     arbitrary code with the privileges of that     application.(CVE-2014-0475)

  - It was found that out-of-range time values passed to     the strftime() function could result in an     out-of-bounds memory access. This could lead to     application crash or, potentially, information     disclosure.(CVE-2015-8776)

  - The GNU C Library (aka glibc or libc6) before 2.27     contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related     to the processing of home directories using the ~     operator followed by a long string.(CVE-2017-15670)

  - The PTR_MANGLE implementation in the GNU C Library (aka     glibc or libc6) 2.4, 2.17, and earlier, and Embedded     GLIBC (EGLIBC) does not initialize the random value for     the pointer guard, which makes it easier for     context-dependent attackers to control execution flow     by leveraging a buffer-overflow vulnerability in an     application and using the known zero value pointer     guard to calculate a pointer address.(CVE-2013-4788)

  - An out-of-bounds read flaw was found in the way glibc's     iconv() function converted certain encoded data to     UTF-8. An attacker able to make an application call the     iconv() function with a specially crafted argument     could use this flaw to crash that     application.(CVE-2014-6040)

  - A stack overflow vulnerability was found in
    _nss_dns_getnetbyname_r. On systems with nsswitch     configured to include ''networks: dns'' with a     privileged or network-facing service that would attempt     to resolve user-provided network names, an attacker     could provide an excessively long network name,     resulting in stack corruption and code     execution.(CVE-2016-3075)

  - Integer overflow in string/strcoll_l.c in the GNU C     Library (aka glibc or libc6) 2.17 and earlier allows     context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string, which triggers a heap-based buffer     overflow.(CVE-2012-4412)

  - A heap-based buffer overflow flaw was found in glibc's     swscanf() function. An attacker able to make an     application call the swscanf() function could use this     flaw to crash that application or, potentially, execute     arbitrary code with the permissions of the user running     the application.(CVE-2015-1472)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-1914)

  - A stack overflow vulnerability was found in nan*     functions that could cause applications, which process     long strings with the nan function, to crash or,     potentially, execute arbitrary code.(CVE-2014-9761)

  - An out-of-bounds write flaw was found in the way the     glibc's readdir_r() function handled file system     entries longer than the NAME_MAX character constant. A     remote attacker could provide a specially crafted NTFS     or CIFS file system that, when processed by an     application using readdir_r(), would cause that     application to crash or, potentially, allow the     attacker to execute arbitrary code with the privileges     of the user running the application.(CVE-2013-4237)

  - It was discovered that, under certain circumstances,     glibc's getaddrinfo() function would send DNS queries     to random file descriptors. An attacker could     potentially use this flaw to send DNS queries to     unintended recipients, resulting in information     disclosure or data loss due to the application     encountering corrupted data.(CVE-2013-7423)

  - A buffer overflow flaw was found in the way glibc's     gethostbyname_r() and other related functions computed     the size of a buffer when passed a misaligned buffer as     input. An attacker able to make an application call any     of these functions with a misaligned buffer could use     this flaw to crash the application or, potentially,     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-1781)

  - The nss_dns implementation of getnetbyname in GNU C     Library (aka glibc) before 2.21, when the DNS backend     in the Name Service Switch configuration is enabled,     allows remote attackers to cause a denial of service     (infinite loop) by sending a positive answer while a     network name is being process.(CVE-2014-9402)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201602-02 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library:
      The Google Security Team and Red Hat discovered a stack-based buffer         overflow in the send_dg() and send_vc() functions due to a buffer         mismanagement when getaddrinfo() is called with AF_UNSPEC         (CVE-2015-7547).
      The strftime() function access invalid memory when passed         out-of-range data, resulting in a crash (CVE-2015-8776).
      An integer overflow was found in the __hcreate_r() function         (CVE-2015-8778).
      Multiple unbounded stack allocations were found in the catopen()         function (CVE-2015-8779).
    Please review the CVEs referenced below for additional vulnerabilities       that had already been fixed in previous versions of sys-libs/glibc, for       which we have not issued a GLSA before.
  Impact :

    A remote attacker could exploit any application which performs host name       resolution using getaddrinfo() in order to execute arbitrary code or       crash the application. The other vulnerabilities can possibly be       exploited to cause a Denial of Service or leak information.
  Workaround :

    A number of mitigating factors for CVE-2015-7547 have been identified.
      Please review the upstream advisory and references below.

glibc has been updated to fix four security issues :

  - CVE-2014-0475: Directory traversal in locale environment     handling (bnc#887022)

  - CVE-2014-7817: wordexp failed to honour WRDE_NOCMD     (bsc#906371)

  - CVE-2014-9402: Avoid infinite loop in nss_dns     getnetbyname (bsc#910599)

  - CVE-2015-1472: Fixed buffer overflow in wscanf     (bsc#916222)

  - CVE-2013-7423: getaddrinfo() wrote DNS queries to random     file descriptors under high load. (bnc#915526)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc has been updated to fix four security issues :

  - CVE-2014-0475: Directory traversal in locale environment     handling (bnc#887022)

  - CVE-2014-7817: wordexp failed to honour WRDE_NOCMD     (bsc#906371)

  - CVE-2014-9402: Avoid infinite loop in nss_dns     getnetbyname (bsc#910599)

  - CVE-2015-1472: Fixed buffer overflow in wscanf     (bsc#916222)

This non-security issue has been fixed :

  - Fix missing zero termination (bnc#918233)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated glibc packages fix security vulnerabilities :

Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC_* and LANG variables. Together with typical OpenSSH configurations (with suitable AcceptEnv settings in sshd_config), this could conceivably be used to bypass ForceCommand restrictions (or restricted shells), assuming the attacker has sufficient level of access to a file system location on the host to create crafted locale definitions there (CVE-2014-0475).

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where posix_spawn_file_actions_addopen fails to copy the path argument (glibc bz #17048) which can, in conjunction with many common memory management techniques from an application, lead to a use after free, or other vulnerabilities (CVE-2014-4043).

This update also fixes the following issues: x86: Disable x87 inline functions for SSE2 math (glibc bz #16510) malloc: Fix race in free() of fastbin chunk (glibc bz #15073)

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.

This update removes support of loadable gconv transliteration modules.
Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose (CVE-2014-5119).

Adhemerval Zanella Netto discovered out-of-bounds reads in additional code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) that can be used to crash the systems, causing a denial of service conditions (CVE-2014-6040).

The function wordexp() fails to properly handle the WRDE_NOCMD flag when processing arithmetic inputs in the form of '$((... ))' where '...' can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDE_NOCMD forbade command substitution. This allows an attacker to attempt to pass dangerous commands via constructs of the above form, and bypass the WRDE_NOCMD flag. This update fixes the issue (CVE-2014-7817).

The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not properly restrict the use of the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers (CVE-2012-3406).

The nss_dns implementation of getnetbyname could run into an infinite loop if the DNS response contained a PTR record of an unexpected format (CVE-2014-9402).

Also glibc lock elision (new feature in glibc 2.18) has been disabled as it can break glibc at runtime on newer Intel hardware (due to hardware bug)

Under certain conditions wscanf can allocate too little memory for the to-be-scanned arguments and overflow the allocated buffer (CVE-2015-1472).

The incorrect use of '__libc_use_alloca (newsize)' caused a different (and weaker) policy to be enforced which could allow a denial of service attack (CVE-2015-1473).

CVE-2014-0475

Stephane Chazelas discovered that the GNU C library, glibc, processed '..' path segments in locale-related environment variables, possibly allowing attackers to circumvent intended restrictions, such as ForceCommand in OpenSSH, assuming that they can supply crafted locale settings.

CVE-2014-5119

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code in eglibc, Debian's version of the GNU C Library. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.

This update removes support of loadable gconv transliteration modules. Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

  - Correct test for detecting cycle during topo sort     (#729661)

  - Check values from TZ file header (#767688)

  - Complete the numeric settings fix (#675259)

  - Complete the change for error codes from pthread_create     (#707998)

  - Truncate time values in Linux futimes when falling back     to utime (#758252)

  - Update systemtaparches

  - Add rules to build libresolv with SSP flags (#756453)

  - Fix PLT reference

  - Workaround misconfigured system (#702300)

  - Update systemtaparches

  - Correct cycle detection during dependency sorting     (#729661)

  - Add gdb hooks (#711924)

  - Fix alloca accounting in strxfm and strcoll (#585433)

  - Correct cycle detection during dependency sorting     (#729661)

  - ldd: never run file directly (#531160)

  - Implement greedy matching of weekday and month names     (#657570)

  - Fix incorrect numeric settings (#675259)

  - Implement new mode for NIS passwd.adjunct.byname table     (#678318)

  - Query NIS domain only when needed (#703345)

  - Count total processors using sysfs (#706894)

  - Translate clone error if necessary (#707998)

  - Workaround kernel clobbering robust list (#711531)

  - Use correct type when casting d_tag (#599056,     CVE-2010-0830)

  - Report write error in addmnt even for cached streams     (#688980, CVE-2011-1089)

  - Don't underestimate length of DST substitution (#694655)

  - Don't allocate executable stack when it cannot be     allocated in the first 4G (#448011)

  - Initialize resolver state in nscd (#676039)

  - No cancel signal in unsafe places (#684808)

  - Check size of pattern in wide character representation     in fnmatch (#681054)

  - Avoid too much stack use in fnmatch (#681054,     CVE-2011-1071)

  - Properly quote output of locale (#625893, CVE-2011-1095)

  - Don't leave empty element in rpath when skipping the     first element, ignore rpath elements containing     non-isolated use of $ORIGIN when privileged (#667974,     CVE-2011-0536)

  - Fix handling of newline in addmntent (#559579,     CVE-2010-0296)

  - Don't ignore $ORIGIN in libraries (#670988)

  - Fix false assertion (#604796)

  - Fix ordering of DSO constructors and destructors     (#604796)

  - Fix typo (#531576)

  - Fix concurrency problem between dl_open and     dl_iterate_phdr (#649956)

  - Require suid bit on audit objects in privileged programs     (#645678, CVE-2010-3856)

  - Never expand $ORIGIN in privileged programs (#643819,     CVE-2010-3847)

  - Add timestamps to nscd logs (#527558)

  - Fix index wraparound handling in memusage (#531576)

  - Handle running out of buffer space with IPv6 mapping     enabled (#533367)

  - Don't deadlock in __dl_iterate_phdr while (un)loading     objects (#549813)

  - Avoid alloca in setenv for long strings (#559974)

  - Recognize POWER7 and ISA 2.06 (#563563)

  - Add support for AT_BASE_PLATFORM (#563599)

  - Restore locking in free_check (#585674)

  - Fix lookup of collation sequence value during regexp     matching (#587360)

  - Fix POWER6 memcpy/memset (#579011)

  - Fix scope handling during dl_close (#593675)

  - Enable -fasynchronous-unwind-tables throughout (#593047)

  - Fix crash when aio thread creation fails (#566712)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Switch gettimeofday from INTUSE to libc_hidden_proto     (#1099025).

  - Fix stack overflow due to large AF_INET6 requests     (CVE-2013-4458, #1111460).

  - Fix buffer overflow in readdir_r (CVE-2013-4237,     #1111460).

  - Fix memory order when reading libgcc handle (#905941).

  - Fix format specifier in malloc_info output (#1027261).

  - Fix nscd lookup for innetgr when netgroup has wildcards     (#1054846).

  - Add mmap usage to malloc_info output (#1027261).

  - Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer     (#1087833).

  - [ppc] Add VDSO IFUNC for gettimeofday (#1028285).

  - [ppc] Fix ftime gettimeofday internal call returning     bogus data (#1099025).

  - Also relocate in dependency order when doing symbol     dependency testing (#1019916).

  - Fix infinite loop in nscd when netgroup is empty     (#1085273).

  - Provide correct buffer length to netgroup queries in     nscd (#1074342).

  - Return NULL for wildcard values in getnetgrent from nscd     (#1085289).

  - Avoid overlapping addresses to stpcpy calls in nscd     (#1082379).

  - Initialize all of datahead structure in nscd (#1074353).

  - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN     (#1044628).

  - Do not fail if one of the two responses to AF_UNSPEC     fails (#845218).

  - nscd: Make SELinux checks dynamic (#1025933).

  - Fix race in free of fastbin chunk (#1027101).

  - Fix copy relocations handling of unique objects     (#1032628).

  - Fix encoding name for IDN in getaddrinfo (#981942).

  - Fix return code from getent netgroup when the netgroup     is not found (#1039988).

  - Fix handling of static TLS in dlopen'ed objects     (#995972).

  - Don't use alloca in addgetnetgrentX (#1043557).

  - Adjust pointers to triplets in netgroup query data     (#1043557).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Don't use alloca in addgetnetgrentX (#1087789).

  - Adjust pointers to triplets in netgroup query data     (#1087789).

  - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN     (#1098050).

  - Fix race in free of fastbin chunk (#1091162).

  - Revert the addition of gettimeofday vDSO function for     ppc and ppc64 until OPD VDSO function call issues are     resolved (#1026533).

  - Call gethostbyname4_r only for PF_UNSPEC (#1022022).

  - Fix integer overflows in *valloc and memalign.
    (#1008310).

  - Initialize res_hconf in nscd (#970090).

  - Update previous patch for dcigettext.c and loadmsgcat.c     (#834386).

  - Save search paths before performing relro protection     (#988931).

  - Correctly name the 240-bit slow path sytemtap probe     slowpow_p10 for slowpow (#905575).

  - Align value of stacksize in nptl-init (#663641).

  - Renamed release engineering directory from 'fedora' to     `releng' (#903754).

  - Backport GLIBC sched_getcpu and gettimeofday vDSO     functions for ppc (#929302).

  - Fall back to local DNS if resolv.conf does not define     nameservers (#928318).

  - Add systemtap probes to slowexp and slowpow (#905575).

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951213).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951213).

  - Add netgroup cache support for nscd (#629823).

  - Fix multiple nss_compat initgroups bugs (#966778).

  - Don't use simple lookup for AF_INET when AI_CANONNAME is     set (#863384).

  - Add MAP_HUGETLB and MAP_STACK support (#916986).

  - Update translation for stale file handle error     (#970776).

  - Improve performance of _SC_NPROCESSORS_ONLN (#rh952422).

  - Fix up _init in pt-initfini to accept arguments     (#663641).

  - Set reasonable limits on xdr requests to prevent memory     leaks (#848748).

  - Fix mutex locking for PI mutexes on spurious wake-ups on     pthread condvars (#552960).

  - New environment variable GLIBC_PTHREAD_STACKSIZE to set     thread stack size (#663641).

  - Improved handling of recursive calls in backtrace     (#868808).

  - The ttyname and ttyname_r functions on Linux now fall     back to searching for the tty file descriptor in     /dev/pts or /dev if /proc is not available. This allows     creation of chroots without the procfs mounted on /proc.
    (#851470)

  - Don't free rpath strings allocated during startup until     after ld.so is re-relocated. (#862094)

  - Consistantly MANGLE/DEMANGLE function pointers. Fix use     after free in dcigettext.c (#834386).

  - Change rounding mode only when necessary (#966775).

  - Backport of code to allow incremental loading of library     list (#886968).

  - Fix loading of audit libraries when TLS is in use     (#919562)

  - Fix application of SIMD FP exception mask (#929388).

New glibc packages are available for Slackware 14.1 and -current to fix security issues.

An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119).

A directory traversal flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A directory traversal flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application.

glibc was updated to fix three security issues :

  - A directory traversal in locale environment handling was     fixed (CVE-2014-0475, bnc#887022, GLIBC BZ #17137)

  - Disable gconv transliteration module loading which could     be used for code execution (CVE-2014-5119, bnc#892073,     GLIBC BZ #17187)

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, bnc#894553, BZ #17325)

USN-2306-1 fixed vulnerabilities in the GNU C Library. On Ubuntu 10.04 LTS, the fix for CVE-2013-4357 introduced a memory leak in getaddrinfo. This update fixes the problem.

We apologize for the inconvenience.

Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS. (CVE-2013-4357)

It was discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-4458)

Stephane Chazelas discovered that the GNU C Library incorrectly handled locale environment variables. An attacker could use this issue to possibly bypass certain restrictions such as the ForceCommand restrictions in OpenSSH. (CVE-2014-0475)

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C Library incorrectly handled posix_spawn_file_actions_addopen() path arguments. An attacker could use this issue to cause a denial of service.
(CVE-2014-4043).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119)

A directory traversal flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475)

Updated glibc packages that fix two security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119)

A directory traversal flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475)

Red Hat would like to thank Stephane Chazelas for reporting CVE-2014-0475.

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1110 advisory.

    [2.12-1.132.4]
    - Remove gconv transliteration loadable modules support (CVE-2014-5119,
      - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Locale names, including those obtained from environment     variables (LANG and the LC_* variables), are more     tightly checked for proper syntax. setlocale will now     fail (with EINVAL) for locale names that are overly     long, contain slashes without starting with a slash, or     contain '..' path components. (CVE-2014-0475)     Previously, some valid locale names were silently     replaced with the 'C' locale when running in AT_SECURE     mode (e.g., in a SUID program). This is no longer     necessary because of the additional checks.

  - Support for loadable gconv transliteration modules has     been removed because it did not work at all. Regular     gconv conversion modules are still supported.
    (CVE-2014-5119)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update contains one security and two non security fixes :

  - directory traversal in LC_* locale handling.
    (CVE-2014-0475). (bnc#887022)

  - nscd gets activated upon upgrade. (bnc#882028)

  - iconv command inserts a extra control code '0F'.
    (bnc#886416)

Updated glibc packages fix security issues :

Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC_* and LANG variables. Together with typical OpenSSH configurations (with suitable AcceptEnv settings in sshd_config), this could conceivably be used to bypass ForceCommand restrictions (or restricted shells), assuming the attacker has sufficient level of access to a file system location on the host to create crafted locale definitions there (CVE-2014-0475).

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where posix_spawn_file_actions_addopen fails to copy the path argument (glibc bz #17048) which can, in conjunction with many common memory management techniques from an application, lead to a use after free, or other vulnerabilities (CVE-2014-4043).

USN-2306-1 fixed vulnerabilities in the GNU C Library. On Ubuntu 10.04 LTS, the security update cause a regression in certain environments that use the Name Service Caching Daemon (nscd), such as those configured for LDAP or MySQL authentication. In these environments, the nscd daemon may need to be stopped manually for name resolution to resume working so that updates can be downloaded, including environments configured for unattended updates.

We apologize for the inconvenience.

Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS. (CVE-2013-4357)

It was discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-4458)

Stephane Chazelas discovered that the GNU C Library incorrectly handled locale environment variables. An attacker could use this issue to possibly bypass certain restrictions such as the ForceCommand restrictions in OpenSSH. (CVE-2014-0475)

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C Library incorrectly handled posix_spawn_file_actions_addopen() path arguments. An attacker could use this issue to cause a denial of service.
(CVE-2014-4043).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2306-1 advisory.

    Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function.
    An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS.
    (CVE-2013-4357)

    It was discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could     use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04     LTS. (CVE-2013-4458)

    Stephane Chazelas discovered that the GNU C Library incorrectly handled locale environment variables. An     attacker could use this issue to possibly bypass certain restrictions such as the ForceCommand     restrictions in OpenSSH. (CVE-2014-0475)

    David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C Library incorrectly handled     posix_spawn_file_actions_addopen() path arguments. An attacker could use this issue to cause a denial of     service. (CVE-2014-4043)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Stephane Chazelas discovered that the GNU C library, glibc, processed '..' path segments in locale-related environment variables, possibly allowing attackers to circumvent intended restrictions, such as ForceCommand in OpenSSH, assuming that they can supply crafted locale settings.

ID	Name	Product	Family	Severity
125005	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1552)	Nessus	Huawei Local Security Checks	critical
88822	GLSA-201602-02 : GNU C Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
83705	SUSE SLES11 Security Update : glibc (SUSE-SU-2015:0551-1)	Nessus	SuSE Local Security Checks	high
83704	SUSE SLES10 Security Update : glibc (SUSE-SU-2015:0550-1)	Nessus	SuSE Local Security Checks	high
82421	Mandriva Linux Security Advisory : glibc (MDVSA-2015:168)	Nessus	Mandriva Local Security Checks	high
82190	Debian DLA-43-1 : eglibc security update	Nessus	Debian Local Security Checks	high
81119	OracleVM 2.2 : glibc (OVMSA-2015-0024) (GHOST)	Nessus	OracleVM Local Security Checks	high
81118	OracleVM 3.2 : glibc (OVMSA-2015-0023) (GHOST)	Nessus	OracleVM Local Security Checks	high
79548	OracleVM 3.3 : glibc (OVMSA-2014-0033)	Nessus	OracleVM Local Security Checks	high
79539	OracleVM 3.3 : glibc (OVMSA-2014-0017)	Nessus	OracleVM Local Security Checks	high
78656	Slackware 14.1 / current : glibc (SSA:2014-296-01)	Nessus	Slackware Local Security Checks	high
78583	Fedora 19 : glibc-2.17-21.fc19 (2014-9830)	Nessus	Fedora Local Security Checks	high
78343	Amazon Linux AMI : glibc (ALAS-2014-400)	Nessus	Amazon Linux Local Security Checks	medium
77659	openSUSE Security Update : glibc (openSUSE-SU-2014:1115-1)	Nessus	SuSE Local Security Checks	high
77568	Ubuntu 10.04 LTS : eglibc regression (USN-2306-3)	Nessus	Ubuntu Local Security Checks	high
77465	Scientific Linux Security Update : glibc on SL5.x, SL6.x i386/x86_64 (20140829)	Nessus	Scientific Linux Local Security Checks	high
77464	RHEL 5 / 6 / 7 : glibc (RHSA-2014:1110)	Nessus	Red Hat Local Security Checks	high
77463	Oracle Linux 5 / 6 / 7 : glibc (ELSA-2014-1110)	Nessus	Oracle Linux Local Security Checks	critical
77439	CentOS 5 / 6 / 7 : glibc (CESA-2014:1110)	Nessus	CentOS Local Security Checks	high
77430	Fedora 20 : glibc-2.18-14.fc20 (2014-9824)	Nessus	Fedora Local Security Checks	high
77229	SuSE 11.3 Security Update : glibc (SAT Patch Number 9587)	Nessus	SuSE Local Security Checks	medium
77040	Mandriva Linux Security Advisory : glibc (MDVSA-2014:152)	Nessus	Mandriva Local Security Checks	high
77019	Ubuntu 10.04 LTS : eglibc regression (USN-2306-2)	Nessus	Ubuntu Local Security Checks	high
76999	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2306-1)	Nessus	Ubuntu Local Security Checks	high
76465	Debian DSA-2976-1 : eglibc - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-0475

critical

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

critical

high

high

medium

high

high

high

medium