MGASA-2023-0270 - Updated glibc packages fix security and other bugs

Publication date: 27 Sep 2023
URL: https://advisories.mageia.org/MGASA-2023-0270.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-4806,
     CVE-2023-4527

getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)

Stack read overflow with large TCP responses in no-aaaa mode
(CVE-2023-4527)

elf: Introduce to _dl_call_fini
elf: Do not run constructors for proxy objects
elf: Always call destructors in reverse constructor order [BZ #30785]
elf: Remove unused l_text_end field from struct link_map
elf: Move l_init_called_next to old place of l_text_end in link map
elf: Fix slow tls access after dlopen [BZ #19924]
intl: Treat C.UTF-8 locale like C locale [BZ# 16621]
x86: Increase non_temporal_threshold to roughly "sizeof_L3 / 4"
x86: Fix slight bug in shared_per_thread cache size calculation
x86: Use 3/4*sizeof(per-thread-L3) as low bound for NT threshold
x86: Fix incorrect scope of setting shared_per_thread [BZ #30745]

References:
- https://bugs.mageia.org/show_bug.cgi?id=32292
- https://nvd.nist.gov/vuln/detail/CVE-2023-4527
- https://nvd.nist.gov/vuln/detail/CVE-2023-4806
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4806
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4527

SRPMS:
- 9/core/glibc-2.36-49.mga9

Mageia 2023-0270: glibc security update

getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806) Stack read overflow with large TCP responses in no-aaaa mode (CVE-2023-4527)

Summary

getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
Stack read overflow with large TCP responses in no-aaaa mode (CVE-2023-4527)
elf: Introduce to _dl_call_fini elf: Do not run constructors for proxy objects elf: Always call destructors in reverse constructor order [BZ #30785] elf: Remove unused l_text_end field from struct link_map elf: Move l_init_called_next to old place of l_text_end in link map elf: Fix slow tls access after dlopen [BZ #19924] intl: Treat C.UTF-8 locale like C locale [BZ# 16621] x86: Increase non_temporal_threshold to roughly "sizeof_L3 / 4" x86: Fix slight bug in shared_per_thread cache size calculation x86: Use 3/4*sizeof(per-thread-L3) as low bound for NT threshold x86: Fix incorrect scope of setting shared_per_thread [BZ #30745]

References

- https://bugs.mageia.org/show_bug.cgi?id=32292

- https://nvd.nist.gov/vuln/detail/CVE-2023-4527

- https://nvd.nist.gov/vuln/detail/CVE-2023-4806

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4806

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4527

Resolution

MGASA-2023-0270 - Updated glibc packages fix security and other bugs

SRPMS

- 9/core/glibc-2.36-49.mga9

Severity
Publication date: 27 Sep 2023
URL: https://advisories.mageia.org/MGASA-2023-0270.html
Type: security
CVE: CVE-2023-4806, CVE-2023-4527

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo