Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:14822-1

Опубликовано: 04 окт. 2021
Источник: suse-cvrf

Описание

Security update for glibc

This update for glibc fixes the following issues:

  • CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)
  • CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
glibc-2.11.3-17.110.37.1
glibc-devel-2.11.3-17.110.37.1
glibc-html-2.11.3-17.110.37.1
glibc-i18ndata-2.11.3-17.110.37.1
glibc-info-2.11.3-17.110.37.1
glibc-locale-2.11.3-17.110.37.1
glibc-profile-2.11.3-17.110.37.1
nscd-2.11.3-17.110.37.1
SUSE Linux Enterprise Server 11 SP4-LTSS
glibc-2.11.3-17.110.37.1
glibc-32bit-2.11.3-17.110.37.1
glibc-devel-2.11.3-17.110.37.1
glibc-devel-32bit-2.11.3-17.110.37.1
glibc-html-2.11.3-17.110.37.1
glibc-i18ndata-2.11.3-17.110.37.1
glibc-info-2.11.3-17.110.37.1
glibc-locale-2.11.3-17.110.37.1
glibc-locale-32bit-2.11.3-17.110.37.1
glibc-profile-2.11.3-17.110.37.1
glibc-profile-32bit-2.11.3-17.110.37.1
nscd-2.11.3-17.110.37.1

Ссылки

Описание

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-2.11.3-17.110.37.1
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-devel-2.11.3-17.110.37.1
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-html-2.11.3-17.110.37.1
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-i18ndata-2.11.3-17.110.37.1
Ссылки

Описание

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-2.11.3-17.110.37.1
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-devel-2.11.3-17.110.37.1
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-html-2.11.3-17.110.37.1
SUSE Linux Enterprise Point of Sale 11 SP3:glibc-i18ndata-2.11.3-17.110.37.1
Ссылки
Уязвимость SUSE-SU-2021:14822-1