Medium: glibc

2015-01-08T12:40:00
ID ALAS-2015-468
Type amazon
Reporter Amazon
Modified 2015-01-08T12:40:00

Description

Issue Overview:

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. (CVE-2014-6040 __)

It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817 __)

Affected Packages:

glibc

Issue Correction:
Run yum update glibc to update your system.

New Packages:

i686:  
    glibc-common-2.17-55.92.amzn1.i686  
    glibc-devel-2.17-55.92.amzn1.i686  
    glibc-debuginfo-2.17-55.92.amzn1.i686  
    glibc-utils-2.17-55.92.amzn1.i686  
    glibc-debuginfo-common-2.17-55.92.amzn1.i686  
    nscd-2.17-55.92.amzn1.i686  
    glibc-static-2.17-55.92.amzn1.i686  
    glibc-headers-2.17-55.92.amzn1.i686  
    glibc-2.17-55.92.amzn1.i686

src:  
    glibc-2.17-55.92.amzn1.src

x86_64:  
    glibc-2.17-55.92.amzn1.x86_64  
    glibc-utils-2.17-55.92.amzn1.x86_64  
    nscd-2.17-55.92.amzn1.x86_64  
    glibc-headers-2.17-55.92.amzn1.x86_64  
    glibc-static-2.17-55.92.amzn1.x86_64  
    glibc-debuginfo-2.17-55.92.amzn1.x86_64  
    glibc-debuginfo-common-2.17-55.92.amzn1.x86_64  
    glibc-common-2.17-55.92.amzn1.x86_64  
    glibc-devel-2.17-55.92.amzn1.x86_64