| Summary: | Several vulnerabilities have been fixed;in the GNU C Library, eglibc.;;The CVE-2015-7547;vulnerability listed below is considered to have;critical impact.;;CVE-2014-8121;Robin Hack discovered that the nss_files database did not;correctly implement enumeration interleaved with name-based or;ID-based lookups. This could cause the enumeration enter an;endless loop, leading to a denial of service.;;CVE-2015-1781;Arjun Shankar discovered that the _r variants of host name;resolution functions (like gethostbyname_r), when performing DNS;name resolution, suffered from a buffer overflow if a misaligned;buffer was supplied by the applications, leading to a crash or,;potentially, arbitrary code execution. Most applications are not;affected by this vulnerability because they use aligned buffers.;;CVE-2015-7547;The Google Security Team and Red Hat discovered that the eglibc;host name resolver function, getaddrinfo, when processing;AF_UNSPEC queries (for dual A/AAAA lookups), could mismanage its;internal buffers, leading to a stack-based buffer overflow and;arbitrary code execution. This vulnerability affects most;applications which perform host name resolution using getaddrinfo,;including system services.;;Description truncated. Please see the references for more information.;;While it is only necessary to ensure that all processes are not using;the old eglibc anymore, it is recommended to reboot the machines after;applying the security upgrade. |
| Description: | Summary:
Several vulnerabilities have been fixed
in the GNU C Library, eglibc.
The CVE-2015-7547
vulnerability listed below is considered to have
critical impact.
CVE-2014-8121
Robin Hack discovered that the nss_files database did not
correctly implement enumeration interleaved with name-based or
ID-based lookups. This could cause the enumeration enter an
endless loop, leading to a denial of service.
CVE-2015-1781
Arjun Shankar discovered that the _r variants of host name
resolution functions (like gethostbyname_r), when performing DNS
name resolution, suffered from a buffer overflow if a misaligned
buffer was supplied by the applications, leading to a crash or,
potentially, arbitrary code execution. Most applications are not
affected by this vulnerability because they use aligned buffers.
CVE-2015-7547
The Google Security Team and Red Hat discovered that the eglibc
host name resolver function, getaddrinfo, when processing
AF_UNSPEC queries (for dual A/AAAA lookups), could mismanage its
internal buffers, leading to a stack-based buffer overflow and
arbitrary code execution. This vulnerability affects most
applications which perform host name resolution using getaddrinfo,
including system services.
Description truncated. Please see the references for more information.
While it is only necessary to ensure that all processes are not using
the old eglibc anymore, it is recommended to reboot the machines after
applying the security upgrade.
Affected Software/OS:
eglibc on Debian Linux
Solution:
For the oldstable distribution (wheezy),
these problems have been fixed in version 2.13-38+deb7u10.
We recommend that you upgrade your eglibc packages.
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
