In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

An update of the glibc package has been released.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-     free vulnerabilities. (CVE-2014-4043)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1585 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1585 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9344 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9280 advisory.

    - CVE-2019-9169: Fix buffer overread in regexec.c (#1685400).
    - CVE-2021-3326: iconv assertion failure in ISO-2022-JP-3 decoding (#1924919)
    - CVE-2019-25013:Fix buffer overrun in EUC-KR conversion module (#1912544)
    - CVE-2016-10228, CVE-2020-27618: Fix infinite loops in iconv (#1704868,

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1656 advisory.

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1585 advisory.

  - glibc: iconv program can hang when invoked with the -c option (CVE-2016-10228)

  - glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding     (CVE-2019-25013)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which     could result in an infinite loop (CVE-2020-27618)

  - glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters (CVE-2021-3326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1585 advisory.

    - CVE-2019-9169: Fix buffer overread in regexec.c (#1685400).
    - CVE-2021-3326: iconv assertion failure in ISO-2022-JP-3 decoding (#1924919)
    - CVE-2019-25013:Fix buffer overrun in EUC-KR conversion module (#1912544)
    - CVE-2016-10228, CVE-2020-27618: Fix infinite loops in iconv (#1704868,

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1585 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR     encoding (CVE-2019-25013)

    * glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer     over-read (CVE-2019-9169)

    * glibc: assertion failure in ISO-2022-JP-3 gconv module related to combining characters (CVE-2021-3326)

    * glibc: iconv program can hang when invoked with the -c option (CVE-2016-10228)

    * glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which     could result in an infinite loop (CVE-2020-27618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities:

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

  - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the     LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000408)

  - A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the     LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000409)

  - Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote     attackers to cause a denial of service or possibly have unspecified other impact. (CVE-2017-14062)

  - The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~     operator followed by a long string. (CVE-2017-15670)

  - The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer     overflow during unescaping of user names with the ~ operator. (CVE-2017-15804)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to     a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code     path that lacks an integer overflow check. (CVE-2017-17426)

  - An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S     in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping     memory check if the source memory range spans the middle of the address space, resulting in corrupt data     being produced by the copy operation. This may disclose information to context-dependent attackers, or     result in a denial of service, or, possibly, code execution. (CVE-2017-18269)

  - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer underflow and potential code execution.
    (CVE-2018-1000001)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very     long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit     architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
    (CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer, leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper. (CVE-2018-11237)

  - In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via     getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the     if_nametoindex() function. (CVE-2018-19591)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4416-1 advisory.

    Florian Weimer discovered that the GNU C Library incorrectly handled certain memory operations. A remote     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-12133)

    It was discovered that the GNU C Library incorrectly handled certain SSE2-optimized memmove operations. A     remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-18269)

    It was discovered that the GNU C Library incorrectly handled certain pathname operations. A remote     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11236)

    It was discovered that the GNU C Library incorrectly handled certain AVX-512-optimized mempcpy operations.
    A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11237)

    It was discovered that the GNU C Library incorrectly handled certain hostname loookups. A remote attacker     could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19591)

    Jakub Wilk discovered that the GNU C Library incorrectly handled certain memalign functions. A remote     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-6485)

    It was discovered that the GNU C Library incorrectly ignored the LD_PREFER_MAP_32BIT_EXEC environment     variable after security transitions. A local attacker could use this issue to bypass ASLR restrictions.
    (CVE-2019-19126)

    It was discovered that the GNU C Library incorrectly handled certain regular expressions. A remote     attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of     service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9169)

    It was discovered that the GNU C Library incorrectly handled certain bit patterns. A remote attacker could     use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10029)

    It was discovered that the GNU C Library incorrectly handled certain signal trampolines on PowerPC. A     remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2020-1751)

    It was discovered that the GNU C Library incorrectly handled tilde expansion. A remote attacker could use     this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2020-1752)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202006-04 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Stack-based buffer overflow in the clntudp_call     function in sunrpc/clnt_udp.c in the GNU C Library (aka     glibc or libc6) allows remote servers to cause a denial     of service (crash) or possibly unspecified other impact     via a flood of crafted ICMP and UDP     packets.(CVE-2016-4429)

  - Integer overflow in the strxfrm function in the GNU C     Library (aka glibc or libc6) before 2.21 allows     context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string, which triggers a stack-based buffer     overflow.(CVE-2015-8982)

  - The posix_spawn_file_actions_addopen function in glibc     before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows     context-dependent attackers to trigger use-after-free     vulnerabilities.(CVE-2014-4043)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - A buffer overflow has been discovered in the GNU C     Library (aka glibc or libc6) in the
    __mempcpy_avx512_no_vzeroupper function when particular     conditions are met. An attacker could use this     vulnerability to cause a denial of service or     potentially execute code.(CVE-2018-11237)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

  - The iconv program in the GNU C Library (aka glibc or     libc6) 2.25 and earlier, when invoked with the -c     option, enters an infinite loop when processing invalid     multi-byte input sequences, leading to a denial of     service.(CVE-2016-10228)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

Security issues fixed :

CVE-2019-9169: Fixed a heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308).

CVE-2009-5155: Fixed a denial of service in parse_reg_exp() (bsc#1127223).

Non-security issues fixed: Added cfi information for start routines in order to stop unwinding on S390 (bsc#1128574).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

Security issues fixed :

  - CVE-2019-9169: Fixed a heap-based buffer over-read via     an attempted case-insensitive regular-expression match     (bsc#1127308).

  - CVE-2009-5155: Fixed a denial of service in     parse_reg_exp() (bsc#1127223).

Non-security issues fixed :

  - Does no longer compress debug sections in crt*.o files     (bsc#1123710)

  - Fixes a concurrency problem in ldconfig (bsc#1117993)

  - Fixes a race condition in pthread_mutex_lock while     promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

This update was imported from the SUSE:SLE-15:Update update project.

This update for glibc fixes the following issues :

Security issues fixed :

CVE-2019-9169: Fixed a heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308).

CVE-2009-5155: Fixed a denial of service in parse_reg_exp() (bsc#1127223).

Non-security issues fixed: Does no longer compress debug sections in crt*.o files (bsc#1123710)

Fixes a concurrency problem in ldconfig (bsc#1117993)

Fixes a race condition in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

Security issue fixed :

CVE-2019-9169: Fixed heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the nss_files backend for the     Name Service Switch in glibc would return incorrect     data to applications or corrupt the heap (depending on     adjacent heap contents). A local attacker could     potentially use this flaw to execute arbitrary code on     the system.(CVE-2015-5277)

  - A directory traveral flaw was found in the way glibc     loaded locale files. An attacker able to make an     application use a specially crafted locale name value     (for example, specified in an LC_* environment     variable) could possibly use this flaw to execute     arbitrary code with the privileges of that     application.(CVE-2014-0475)

  - It was found that out-of-range time values passed to     the strftime() function could result in an     out-of-bounds memory access. This could lead to     application crash or, potentially, information     disclosure.(CVE-2015-8776)

  - The GNU C Library (aka glibc or libc6) before 2.27     contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related     to the processing of home directories using the ~     operator followed by a long string.(CVE-2017-15670)

  - The PTR_MANGLE implementation in the GNU C Library (aka     glibc or libc6) 2.4, 2.17, and earlier, and Embedded     GLIBC (EGLIBC) does not initialize the random value for     the pointer guard, which makes it easier for     context-dependent attackers to control execution flow     by leveraging a buffer-overflow vulnerability in an     application and using the known zero value pointer     guard to calculate a pointer address.(CVE-2013-4788)

  - An out-of-bounds read flaw was found in the way glibc's     iconv() function converted certain encoded data to     UTF-8. An attacker able to make an application call the     iconv() function with a specially crafted argument     could use this flaw to crash that     application.(CVE-2014-6040)

  - A stack overflow vulnerability was found in
    _nss_dns_getnetbyname_r. On systems with nsswitch     configured to include ''networks: dns'' with a     privileged or network-facing service that would attempt     to resolve user-provided network names, an attacker     could provide an excessively long network name,     resulting in stack corruption and code     execution.(CVE-2016-3075)

  - Integer overflow in string/strcoll_l.c in the GNU C     Library (aka glibc or libc6) 2.17 and earlier allows     context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string, which triggers a heap-based buffer     overflow.(CVE-2012-4412)

  - A heap-based buffer overflow flaw was found in glibc's     swscanf() function. An attacker able to make an     application call the swscanf() function could use this     flaw to crash that application or, potentially, execute     arbitrary code with the permissions of the user running     the application.(CVE-2015-1472)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-1914)

  - A stack overflow vulnerability was found in nan*     functions that could cause applications, which process     long strings with the nan function, to crash or,     potentially, execute arbitrary code.(CVE-2014-9761)

  - An out-of-bounds write flaw was found in the way the     glibc's readdir_r() function handled file system     entries longer than the NAME_MAX character constant. A     remote attacker could provide a specially crafted NTFS     or CIFS file system that, when processed by an     application using readdir_r(), would cause that     application to crash or, potentially, allow the     attacker to execute arbitrary code with the privileges     of the user running the application.(CVE-2013-4237)

  - It was discovered that, under certain circumstances,     glibc's getaddrinfo() function would send DNS queries     to random file descriptors. An attacker could     potentially use this flaw to send DNS queries to     unintended recipients, resulting in information     disclosure or data loss due to the application     encountering corrupted data.(CVE-2013-7423)

  - A buffer overflow flaw was found in the way glibc's     gethostbyname_r() and other related functions computed     the size of a buffer when passed a misaligned buffer as     input. An attacker able to make an application call any     of these functions with a misaligned buffer could use     this flaw to crash the application or, potentially,     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-1781)

  - The nss_dns implementation of getnetbyname in GNU C     Library (aka glibc) before 2.21, when the DNS backend     in the Name Service Switch configuration is enabled,     allows remote attackers to cause a denial of service     (infinite loop) by sending a positive answer while a     network name is being process.(CVE-2014-9402)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

Security issues fixed :

CVE-2019-9169: regex: fix read overrun (bsc#1127308, BZ #24114)

CVE-2016-10739: Fully parse IPv4 address strings (bsc#1122729, BZ #20018)

CVE-2009-5155: ERE '0|()0|\1|0' causes regexec undefined behavior (bsc#1127223, BZ #18986)

Non-security issues fixed: Enable TLE only if GLIBC_ELISION_ENABLE=yes is defined (bsc#1131994, fate#322271)

Add more checks for valid ld.so.cache file (bsc#1110661, BZ #18093)

Added cfi information for start routines in order to stop unwinding (bsc#1128574)

ja_JP locale: Add entry for the new Japanese era (bsc#1100396, fate#325570, BZ #22964)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In the GNU C Library (aka glibc or libc6) before 2.28,     parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial     of service (assertion failure and application exit) or     trigger an incorrect result by attempting a     regular-expression match.(CVE-2009-5155)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
202871	Photon OS 2.0: Glibc PHSA-2019-2.0-0140	Nessus	PhotonOS Local Security Checks	critical
202847	Photon OS 3.0: Glibc PHSA-2019-3.0-0005	Nessus	PhotonOS Local Security Checks	critical
199112	RHEL 7 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199103	RHEL 6 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199014	RHEL 5 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
184978	Rocky Linux 8 : glibc (RLSA-2021:1585)	Nessus	Rocky Linux Local Security Checks	critical
157688	AlmaLinux 8 : glibc (ALSA-2021:1585)	Nessus	Alma Linux Local Security Checks	critical
154917	Oracle Linux 8 : glibc (ELSA-2021-9344)	Nessus	Oracle Linux Local Security Checks	critical
154915	Oracle Linux 8 : glibc (ELSA-2021-9280)	Nessus	Oracle Linux Local Security Checks	critical
150980	Amazon Linux 2 : glibc (ALAS-2021-1656)	Nessus	Amazon Linux Local Security Checks	critical
150034	CentOS 8 : glibc (CESA-2021:1585)	Nessus	CentOS Local Security Checks	critical
149915	Oracle Linux 8 : glibc (ELSA-2021-1585)	Nessus	Oracle Linux Local Security Checks	critical
149664	RHEL 8 : glibc (RHSA-2021:1585)	Nessus	Red Hat Local Security Checks	critical
147282	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	critical
138166	Ubuntu 16.04 LTS / 18.04 LTS : GNU C Library vulnerabilities (USN-4416-1)	Nessus	Ubuntu Local Security Checks	critical
137441	GLSA-202006-04 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
129223	EulerOS 2.0 SP3 : glibc (EulerOS-SA-2019-2030)	Nessus	Huawei Local Security Checks	critical
128018	SUSE SLES12 Security Update : glibc (SUSE-SU-2019:1958-2)	Nessus	SuSE Local Security Checks	critical
127035	openSUSE Security Update : glibc (openSUSE-2019-1798)	Nessus	SuSE Local Security Checks	critical
126986	SUSE SLES12 Security Update : glibc (SUSE-SU-2019:1958-1)	Nessus	SuSE Local Security Checks	critical
126812	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2019:1877-1)	Nessus	SuSE Local Security Checks	critical
125984	SUSE SLES11 Security Update : glibc (SUSE-SU-2019:14084-1)	Nessus	SuSE Local Security Checks	critical
125005	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1552)	Nessus	Huawei Local Security Checks	critical
124451	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2019:1102-1)	Nessus	SuSE Local Security Checks	critical
123728	EulerOS Virtualization 2.5.3 : glibc (EulerOS-SA-2019-1260)	Nessus	Huawei Local Security Checks	critical
123609	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2019-1135)	Nessus	Huawei Local Security Checks	critical
123585	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2019-1111)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2019-9169

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical