{"title": "CVE-2014-6040", "reporter": "NVD", "enchantments": {"score": {"vector": "NONE", "value": 5.0}, "vulnersScore": 5.0}, "published": "2014-12-05T11:59:09", "cvelist": ["CVE-2014-6040"], "viewCount": 14, "objectVersion": "1.2", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6040", "bulletinFamily": "NVD", "hashmap": [{"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "a4757f7c3d9481dcf75a8dfb9f9fbc6c", "key": "cpe"}, {"hash": "951f13cba60fa968dbf7206f94fab6ab", "key": "cvelist"}, {"hash": "84813b1457b92d6ba1174abffbb83a2f", "key": "cvss"}, {"hash": "b4177d33fbb4c09abd97356b1c40c24f", "key": "description"}, {"hash": "f223d3221a87ef321ab922a8ff624285", "key": "href"}, {"hash": "1b9f26f75ad77fde15324769ccc594e6", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "f0b8a51791d225498f69712fa17a68a3", "key": "published"}, {"hash": "b94ccac98c321e68038144ccb064cadd", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "385846c36ff0327b15a4024c7db3aef4", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}], "history": [{"bulletin": {"reporter": "NVD", "published": "2014-12-05T11:59:09", "cvelist": ["CVE-2014-6040"], "title": "CVE-2014-6040", "objectVersion": "1.2", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6040", "bulletinFamily": "NVD", "id": "CVE-2014-6040", "history": [], "scanner": [], "cpe": ["cpe:/a:gnu:glibc:2.12.1", "cpe:/a:gnu:glibc:2.1.3", "cpe:/a:gnu:glibc:2.17", "cpe:/a:gnu:glibc:2.12.2", "cpe:/a:gnu:glibc:2.1.1", "cpe:/a:gnu:glibc:2.19", "cpe:/a:gnu:glibc:2.11.3", "cpe:/a:gnu:glibc:2.0.3", "cpe:/a:gnu:glibc:2.15", "cpe:/a:gnu:glibc:2.16", "cpe:/a:gnu:glibc:2.1.2", "cpe:/a:gnu:glibc:2.1.1.6", "cpe:/a:gnu:glibc:2.12", "cpe:/a:gnu:glibc:2.11", "cpe:/a:gnu:glibc:2.14", "cpe:/a:gnu:glibc:2.0", "cpe:/a:gnu:glibc:2.11.1", "cpe:/a:gnu:glibc:2.13", "cpe:/a:gnu:glibc:2.18", "cpe:/a:gnu:glibc:2.0.2", "cpe:/a:gnu:glibc:2.10.1", "cpe:/a:gnu:glibc:2.0.4", "cpe:/a:gnu:glibc:2.1", "cpe:/a:gnu:glibc:2.0.6", "cpe:/a:gnu:glibc:2.0.5", "cpe:/a:gnu:glibc:2.11.2", "cpe:/a:gnu:glibc:2.0.1", "cpe:/a:gnu:glibc:2.1.9", "cpe:/a:gnu:glibc:2.14.1"], "modified": "2016-06-10T17:18:35", "hash": "a4424f4cb3df1fea9b2520d5ce6c782ffd09ef5bc5f7a9ff08ea9a39c8328f6f", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "viewCount": 0, "edition": 1, "assessment": {"name": "", "href": "", "system": ""}, "references": ["http://ubuntu.com/usn/usn-2432-1", "http://www.securityfocus.com/bid/69472", "https://security.gentoo.org/glsa/201602-02", "http://www.openwall.com/lists/oss-security/2014/08/29/3", "http://www.debian.org/security/2015/dsa-3142", "http://www.openwall.com/lists/oss-security/2014/09/02/1", "http://www.mandriva.com/security/advisories?name=MDVSA-2014:175", "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=41488498b6", "https://sourceware.org/bugzilla/show_bug.cgi?id=17325"], "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "385846c36ff0327b15a4024c7db3aef4", "key": "title"}, {"hash": "9ca04bb93f9308d6f1f03e6e3ba5096e", "key": "references"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "f0b8a51791d225498f69712fa17a68a3", "key": "published"}, {"hash": "b4177d33fbb4c09abd97356b1c40c24f", "key": "description"}, {"hash": "de93cc9a7ab738b4fa317e497f955e4d", "key": "modified"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "f223d3221a87ef321ab922a8ff624285", "key": "href"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84813b1457b92d6ba1174abffbb83a2f", "key": "cvss"}, {"hash": "a4757f7c3d9481dcf75a8dfb9f9fbc6c", "key": "cpe"}, {"hash": "951f13cba60fa968dbf7206f94fab6ab", "key": "cvelist"}], "lastseen": "2016-09-03T20:59:38", "description": "GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of \"0xffff\" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8."}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T20:59:38"}], "scanner": [], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "modified": "2017-01-02T21:59:06", "hash": "d41d8dce9ad3723bf99aebbe45dd404d63115cf95c075d0049c66e53e1198e39", "cpe": ["cpe:/a:gnu:glibc:2.12.1", "cpe:/a:gnu:glibc:2.1.3", "cpe:/a:gnu:glibc:2.17", "cpe:/a:gnu:glibc:2.12.2", "cpe:/a:gnu:glibc:2.1.1", "cpe:/a:gnu:glibc:2.19", "cpe:/a:gnu:glibc:2.11.3", "cpe:/a:gnu:glibc:2.0.3", "cpe:/a:gnu:glibc:2.15", "cpe:/a:gnu:glibc:2.16", "cpe:/a:gnu:glibc:2.1.2", "cpe:/a:gnu:glibc:2.1.1.6", "cpe:/a:gnu:glibc:2.12", "cpe:/a:gnu:glibc:2.11", "cpe:/a:gnu:glibc:2.14", "cpe:/a:gnu:glibc:2.0", "cpe:/a:gnu:glibc:2.11.1", "cpe:/a:gnu:glibc:2.13", "cpe:/a:gnu:glibc:2.18", "cpe:/a:gnu:glibc:2.0.2", "cpe:/a:gnu:glibc:2.10.1", "cpe:/a:gnu:glibc:2.0.4", "cpe:/a:gnu:glibc:2.1", "cpe:/a:gnu:glibc:2.0.6", "cpe:/a:gnu:glibc:2.0.5", "cpe:/a:gnu:glibc:2.11.2", "cpe:/a:gnu:glibc:2.0.1", "cpe:/a:gnu:glibc:2.1.9", "cpe:/a:gnu:glibc:2.14.1"], "edition": 2, "description": "GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of \"0xffff\" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.", "references": ["http://ubuntu.com/usn/usn-2432-1", "http://www.securityfocus.com/bid/69472", "http://secunia.com/advisories/62146", "https://security.gentoo.org/glsa/201602-02", "http://www.openwall.com/lists/oss-security/2014/08/29/3", "http://linux.oracle.com/errata/ELSA-2015-0016.html", "http://www.debian.org/security/2015/dsa-3142", "http://secunia.com/advisories/62100", "http://www.openwall.com/lists/oss-security/2014/09/02/1", "http://www.mandriva.com/security/advisories?name=MDVSA-2014:175", "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=41488498b6", "https://sourceware.org/bugzilla/show_bug.cgi?id=17325"], "id": "CVE-2014-6040", "lastseen": "2017-04-18T15:55:14", "assessment": {"name": "", "href": "", "system": ""}}

{"f5": [{"lastseen": "2016-09-26T17:23:20", "references": ["https://support.f5.com/kb/en-us/solutions/public/10000/300/sol10322.html", "https://support.f5.com/kb/en-us/solutions/public/9000/900/sol9970.html", "https://support.f5.com/kb/en-us/solutions/public/4000/900/sol4918.html", "https://support.f5.com/kb/en-us/solutions/public/6000/600/sol6664.html", "https://support.f5.com/kb/en-us/solutions/public/9000/500/sol9502.html", "https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13123", "https://support.f5.com/kb/en-us/solutions/public/12000/700/sol12766.html", "https://support.f5.com/kb/en-us/solutions/public/10000/900/sol10942.html", "https://support.f5.com/kb/en-us/solutions/public/10000/000/sol10025.html", "https://support.f5.com/kb/en-us/solutions/public/0000/100/sol167.html", "https://support.f5.com/kb/en-us/solutions/public/3000/400/sol3430.html", "https://support.f5.com/kb/en-us/solutions/public/9000/900/sol9957.html"], "edition": 1, "description": "Recommended Action\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\nF5 responds to vulnerabilities in accordance with the Severity values published in the previous table. The Severity values and other security vulnerability parameters are defined in SOL4602: Overview of the F5 security vulnerability response policy.\n\nTo mitigate this vulnerability, you should permit access to F5 products only over a secure network, and limit login access to trusted users. For additional information, refer to SOL13092: Overview of securing access to the BIG-IP system.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n * SOL13123: Managing BIG-IP product hotfixes (11.x)\n * SOL10025: Managing BIG-IP product hotfixes (10.x)\n * SOL9502: BIG-IP hotfix matrix\n * SOL10322: FirePass hotfix matrix\n * SOL12766: ARX hotfix matrix\n * SOL3430: Installing FirePass hotfixes\n * SOL6664: Obtaining and installing OPSWAT hotfixes\n * SOL10942: Installing OPSWAT hotfixes on BIG-IP APM systems\n", "reporter": "f5", "published": "2015-04-14T00:00:00", "title": "SOL16435 - GNU C Library vulnerability CVE-2014-6040", "type": "f5", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "BIG-IP PSM", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IP Link Controller", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IQ Device", "version": "4.5.0", "operator": "le"}, {"name": "BIG-IP GTM", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IP PEM", "version": "11.6.0", "operator": "le"}, {"name": "Enterprise Manager", "version": "3.1.1", "operator": "le"}, {"name": "BIG-IP APM", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IP Analytics", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IP WebAccelerator", "version": "11.3.0", "operator": "le"}, {"name": "BIG-IP ASM", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IP Edge Gateway\n", "version": "11.3.0", "operator": "le"}, {"name": "BIG-IP LTM", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IP PSM", "version": "11.4.1", "operator": "le"}, {"name": "Enterprise Manager", "version": "2.3.0", "operator": "le"}, {"name": "BIG-IP LTM", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IP AAM", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IP ASM", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IP WebAccelerator", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IP Link Controller", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IP AFM", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IQ Cloud", "version": "4.5.0", "operator": "le"}, {"name": "BIG-IP APM", "version": "11.6.0", "operator": "le"}, {"name": "BIG-IP WOM", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IQ Security", "version": "4.5.0", "operator": "le"}, {"name": "BIG-IP GTM", "version": "10.2.4", "operator": "le"}, {"name": "BIG-IQ ADC", "version": "4.5.0", "operator": "le"}, {"name": "Traffix SDC", "version": "4.1.0", "operator": "le"}, {"name": "BIG-IP WOM", "version": "11.3.0", "operator": "le"}, {"name": "ARX", "version": "6.4.0", "operator": "le"}, {"name": "Traffix SDC", "version": "3.5.1", "operator": "le"}, {"name": "BIG-IP Edge Gateway\n", "version": "10.2.4", "operator": "le"}], "cvelist": ["CVE-2014-6040"], "modified": "2015-09-16T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/16000/400/sol16435.html", "id": "SOL16435", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-09-01T23:43:58", "references": ["http://www.nessus.org/u?c1c3c86a"], "pluginID": "85963", "description": "GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of '0xffff' to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.", "edition": 6, "reporter": "Tenable", "published": "2015-09-17T00:00:00", "title": "F5 Networks BIG-IP : GNU C Library vulnerability (SOL16435)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "F5 Networks Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040"], "modified": "2018-07-10T00:00:00", "cpe": ["cpe:/a:f5:big-ip_global_traffic_manager", "cpe:/a:f5:big-ip_link_controller", "cpe:/a:f5:big-ip_advanced_firewall_manager", "cpe:/a:f5:big-ip_policy_enforcement_manager", "cpe:/a:f5:big-ip_application_security_manager", "cpe:/a:f5:big-ip_application_acceleration_manager", "cpe:/h:f5:big-ip_protocol_security_manager", "cpe:/a:f5:big-ip_local_traffic_manager", "cpe:/a:f5:big-ip_wan_optimization_manager", "cpe:/h:f5:big-ip", "cpe:/a:f5:big-ip_application_visibility_and_reporting", "cpe:/a:f5:big-ip_webaccelerator", "cpe:/a:f5:big-ip_access_policy_manager"], "id": "F5_BIGIP_SOL16435.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=85963", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from F5 Networks BIG-IP Solution SOL16435.\n#\n# The text description of this plugin is (C) F5 Networks.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85963);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2018/07/10 14:27:32\");\n\n script_cve_id(\"CVE-2014-6040\");\n script_bugtraq_id(69472);\n\n script_name(english:\"F5 Networks BIG-IP : GNU C Library vulnerability (SOL16435)\");\n script_summary(english:\"Checks the BIG-IP version.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote device is missing a vendor-supplied security patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"GNU C Library (aka glibc) before 2.20 allows context-dependent\nattackers to cause a denial of service (out-of-bounds read and crash)\nvia a multibyte character value of '0xffff' to the iconv function when\nconverting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5)\nIBM1364 encoded data to UTF-8.\"\n );\n # http://support.f5.com/kb/en-us/solutions/public/16000/400/sol16435.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c1c3c86a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade to one of the non-vulnerable versions listed in the F5\nSolution SOL16435.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_access_policy_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_advanced_firewall_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_acceleration_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_security_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_visibility_and_reporting\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_global_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_link_controller\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_local_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_policy_enforcement_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_wan_optimization_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_webaccelerator\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip_protocol_security_manager\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/04/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/09/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"F5 Networks Local Security Checks\");\n\n script_dependencies(\"f5_bigip_detect.nbin\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/BIG-IP/hotfix\", \"Host/BIG-IP/modules\", \"Host/BIG-IP/version\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\n\ninclude(\"f5_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nversion = get_kb_item(\"Host/BIG-IP/version\");\nif ( ! version ) audit(AUDIT_OS_NOT, \"F5 Networks BIG-IP\");\nif ( isnull(get_kb_item(\"Host/BIG-IP/hotfix\")) ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/hotfix\");\nif ( ! get_kb_item(\"Host/BIG-IP/modules\") ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/modules\");\n\nsol = \"SOL16435\";\nvmatrix = make_array();\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\n# AFM\nvmatrix[\"AFM\"] = make_array();\nvmatrix[\"AFM\"][\"affected\" ] = make_list(\"11.3.0-11.6.0\");\nvmatrix[\"AFM\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# AM\nvmatrix[\"AM\"] = make_array();\nvmatrix[\"AM\"][\"affected\" ] = make_list(\"11.4.0-11.6.0\");\nvmatrix[\"AM\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# APM\nvmatrix[\"APM\"] = make_array();\nvmatrix[\"APM\"][\"affected\" ] = make_list(\"11.0.0-11.6.0\",\"10.1.0-10.2.4\");\nvmatrix[\"APM\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# ASM\nvmatrix[\"ASM\"] = make_array();\nvmatrix[\"ASM\"][\"affected\" ] = make_list(\"11.0.0-11.6.0\",\"10.1.0-10.2.4\");\nvmatrix[\"ASM\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# AVR\nvmatrix[\"AVR\"] = make_array();\nvmatrix[\"AVR\"][\"affected\" ] = make_list(\"11.0.0-11.6.0\");\nvmatrix[\"AVR\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# LC\nvmatrix[\"LC\"] = make_array();\nvmatrix[\"LC\"][\"affected\" ] = make_list(\"11.0.0-11.6.0\",\"10.1.0-10.2.4\");\nvmatrix[\"LC\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# LTM\nvmatrix[\"LTM\"] = make_array();\nvmatrix[\"LTM\"][\"affected\" ] = make_list(\"11.0.0-11.6.0\",\"10.1.0-10.2.4\");\nvmatrix[\"LTM\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n# PEM\nvmatrix[\"PEM\"] = make_array();\nvmatrix[\"PEM\"][\"affected\" ] = make_list(\"11.3.0-11.6.0\");\nvmatrix[\"PEM\"][\"unaffected\"] = make_list(\"12.0.0\");\n\n\nif (bigip_is_affected(vmatrix:vmatrix, sol:sol))\n{\n if (report_verbosity > 0) security_warning(port:0, extra:bigip_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = bigip_get_tested_modules();\n audit_extra = \"For BIG-IP module(s) \" + tested + \",\";\n if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);\n else audit(AUDIT_HOST_NOT, \"running any of the affected modules\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:10:58", "references": ["http://www.nessus.org/u?2033fa93"], "pluginID": "80439", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - Fix recursive dlopen (#1173469).\n\n - Fix typo in res_send and res_query (#rh1172023).\n\n - Fix crashes on invalid input in IBM gconv modules (CVE-2014-6040, #1139571).\n\n - Fix wordexp to honour WRDE_NOCMD (CVE-2014-7817, #1170121).", "edition": 7, "reporter": "Tenable", "published": "2015-01-09T00:00:00", "title": "OracleVM 3.3 : glibc (OVMSA-2015-0003)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "naslFamily": "OracleVM Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2018-07-24T00:00:00", "cpe": ["cpe:/o:oracle:vm_server:3.3", "p-cpe:/a:oracle:vm:glibc", "p-cpe:/a:oracle:vm:glibc-common", "p-cpe:/a:oracle:vm:nscd"], "id": "ORACLEVM_OVMSA-2015-0003.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=80439", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2015-0003.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(80439);\n script_version(\"1.8\");\n script_cvs_date(\"Date: 2018/07/24 18:56:11\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_bugtraq_id(69472, 71216);\n\n script_name(english:\"OracleVM 3.3 : glibc (OVMSA-2015-0003)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - Fix recursive dlopen (#1173469).\n\n - Fix typo in res_send and res_query (#rh1172023).\n\n - Fix crashes on invalid input in IBM gconv modules\n (CVE-2014-6040, #1139571).\n\n - Fix wordexp to honour WRDE_NOCMD (CVE-2014-7817,\n #1170121).\"\n );\n # https://oss.oracle.com/pipermail/oraclevm-errata/2015-January/000255.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2033fa93\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected glibc / glibc-common / nscd packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! ereg(pattern:\"^OVS\" + \"3\\.3\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.3\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.3\", reference:\"glibc-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"OVS3.3\", reference:\"glibc-common-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"OVS3.3\", reference:\"nscd-2.12-1.149.el6_6.4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"glibc / glibc-common / nscd\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:42:09", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1135841", "http://www.nessus.org/u?c564838b", "https://bugzilla.redhat.com/show_bug.cgi?id=1157689"], "pluginID": "81616", "description": "- Fix CVE-2014-6040: crash in code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364)\n\n - Fix CVE-2014-7817: command execution in wordexp() with WRDE_NOCMD specified\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 4, "reporter": "Tenable", "published": "2015-03-05T00:00:00", "title": "Fedora 20 : glibc-2.18-19.fc20 (2015-2845)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2016-02-28T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:glibc", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2015-2845.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=81616", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-2845.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81616);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2016/02/28 05:39:56 $\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_bugtraq_id(69472, 71216);\n script_xref(name:\"FEDORA\", value:\"2015-2845\");\n\n script_name(english:\"Fedora 20 : glibc-2.18-19.fc20 (2015-2845)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fix CVE-2014-6040: crash in code page decoding functions\n (IBM933, IBM935, IBM937, IBM939, IBM1364)\n\n - Fix CVE-2014-7817: command execution in wordexp() with\n WRDE_NOCMD specified\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1135841\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1157689\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-March/150631.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c564838b\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected glibc package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"glibc-2.18-19.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"glibc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:51:16", "references": ["http://www.nessus.org/u?ef60f244"], "pluginID": "82250", "description": "An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)\n\nThis update also fixes the following bugs :\n\n - Due to problems with buffer extension and reallocation, the nscd daemon terminated unexpectedly with a segmentation fault when processing long netgroup entries. With this update, the handling of long netgroup entries has been corrected and nscd no longer crashes in the described scenario.\n\n - If a file opened in append mode was truncated with the ftruncate() function, a subsequent ftell() call could incorrectly modify the file offset. This update ensures that ftell() modifies the stream state only when it is in append mode and the buffer for the stream is not empty.\n\n - A defect in the C library headers caused builds with older compilers to generate incorrect code for the btowc() function in the older compatibility C++ standard library. Applications calling btowc() in the compatibility C++ standard library became unresponsive.\n With this update, the C library headers have been corrected, and the compatibility C++ standard library shipped with Scientific Linux has been rebuilt.\n Applications that rely on the compatibility C++ standard library no longer hang when calling btowc().\n\n - Previously, when using netgroups and the nscd daemon was set up to cache netgroup information, the sudo utility denied access to valid users. The bug in nscd has been fixed, and sudo now works in netgroups as expected.", "edition": 4, "reporter": "Tenable", "published": "2015-03-26T00:00:00", "title": "Scientific Linux Security Update : glibc on SL7.x x86_64", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Scientific Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2015-03-26T00:00:00", "cpe": ["x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20150305_GLIBC_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=82250", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(82250);\n script_version(\"$Revision: 1.1 $\");\n script_cvs_date(\"$Date: 2015/03/26 13:38:48 $\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-8121\");\n\n script_name(english:\"Scientific Linux Security Update : glibc on SL7.x x86_64\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did\nnot isolate iteration over an entire database from key-based look-up\nAPI calls. An application performing look-ups on a database while\niterating over it could enter an infinite loop, leading to a denial of\nservice. (CVE-2014-8121)\n\nThis update also fixes the following bugs :\n\n - Due to problems with buffer extension and reallocation,\n the nscd daemon terminated unexpectedly with a\n segmentation fault when processing long netgroup\n entries. With this update, the handling of long netgroup\n entries has been corrected and nscd no longer crashes in\n the described scenario.\n\n - If a file opened in append mode was truncated with the\n ftruncate() function, a subsequent ftell() call could\n incorrectly modify the file offset. This update ensures\n that ftell() modifies the stream state only when it is\n in append mode and the buffer for the stream is not\n empty.\n\n - A defect in the C library headers caused builds with\n older compilers to generate incorrect code for the\n btowc() function in the older compatibility C++ standard\n library. Applications calling btowc() in the\n compatibility C++ standard library became unresponsive.\n With this update, the C library headers have been\n corrected, and the compatibility C++ standard library\n shipped with Scientific Linux has been rebuilt.\n Applications that rely on the compatibility C++ standard\n library no longer hang when calling btowc().\n\n - Previously, when using netgroups and the nscd daemon was\n set up to cache netgroup information, the sudo utility\n denied access to valid users. The bug in nscd has been\n fixed, and sudo now works in netgroups as expected.\"\n );\n # http://listserv.fnal.gov/scripts/wa.exe?A2=ind1503&L=scientific-linux-errata&T=0&P=2889\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ef60f244\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/03/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-common-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-debuginfo-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-debuginfo-common-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-devel-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-headers-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-static-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"glibc-utils-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"nscd-2.17-78.el7\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:05:34", "references": ["http://www.nessus.org/u?1e0b853f"], "pluginID": "80400", "description": "Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat Developer Experience Team.\n\nThis update also fixes the following bugs :\n\n* Previously, when an address lookup using the getaddrinfo() function for the AF_UNSPEC value was performed on a defective DNS server, the server in some cases responded with a valid response for the A record, but a referral response for the AAAA record, which resulted in a lookup failure. A prior update was implemented for getaddrinfo() to return the valid response, but it contained a typographical error, due to which the lookup could under some circumstances still fail. This error has been corrected and getaddrinfo() now returns a valid response in the described circumstances. (BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive calls to dlopen() to terminate unexpectedly or to abort with a library assertion. This error has been fixed and recursive calls to dlopen() no longer crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.", "edition": 5, "reporter": "Tenable", "published": "2015-01-08T00:00:00", "title": "CentOS 6 : glibc (CESA-2015:0016)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "CentOS Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2018-07-02T00:00:00", "cpe": ["p-cpe:/a:centos:centos:glibc-common", "cpe:/o:centos:centos:6", "p-cpe:/a:centos:centos:nscd", "p-cpe:/a:centos:centos:glibc-utils", "p-cpe:/a:centos:centos:glibc-devel", "p-cpe:/a:centos:centos:glibc-static", "p-cpe:/a:centos:centos:glibc-headers", "p-cpe:/a:centos:centos:glibc"], "id": "CENTOS_RHSA-2015-0016.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=80400", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:0016 and \n# CentOS Errata and Security Advisory 2015:0016 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(80400);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2018/07/02 18:48:53\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_bugtraq_id(69472, 71216);\n script_xref(name:\"RHSA\", value:\"2015:0016\");\n\n script_name(english:\"CentOS 6 : glibc (CESA-2015:0016)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated glibc packages that fix two security issues and two bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX\nthread libraries (libpthread), standard math libraries (libm), and the\nName Server Caching Daemon (nscd) used by multiple programs on the\nsystem. Without these libraries, the Linux system cannot function\ncorrectly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command\nsubstitution even when the WRDE_NOCMD flag was specified. An attacker\nable to provide specially crafted input to an application using the\nwordexp() function, and not sanitizing the input correctly, could\npotentially use this flaw to execute arbitrary commands with the\ncredentials of the user running that application. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs :\n\n* Previously, when an address lookup using the getaddrinfo() function\nfor the AF_UNSPEC value was performed on a defective DNS server, the\nserver in some cases responded with a valid response for the A record,\nbut a referral response for the AAAA record, which resulted in a\nlookup failure. A prior update was implemented for getaddrinfo() to\nreturn the valid response, but it contained a typographical error, due\nto which the lookup could under some circumstances still fail. This\nerror has been corrected and getaddrinfo() now returns a valid\nresponse in the described circumstances. (BZ#1172023)\n\n* An error in the dlopen() library function previously caused\nrecursive calls to dlopen() to terminate unexpectedly or to abort with\na library assertion. This error has been fixed and recursive calls to\ndlopen() no longer crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues.\"\n );\n # http://lists.centos.org/pipermail/centos-announce/2015-January/020863.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1e0b853f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected glibc packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/CentOS/release\")) audit(AUDIT_OS_NOT, \"CentOS\");\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-6\", reference:\"glibc-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"glibc-common-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"glibc-devel-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"glibc-headers-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"glibc-static-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"glibc-utils-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", reference:\"nscd-2.12-1.149.el6_6.4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:51:00", "references": ["https://alas.aws.amazon.com/ALAS-2015-468.html"], "pluginID": "80419", "description": "An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)", "edition": 5, "reporter": "Tenable", "published": "2015-01-09T00:00:00", "title": "Amazon Linux AMI : glibc (ALAS-2015-468)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Amazon Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2018-04-18T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:glibc-debuginfo", "p-cpe:/a:amazon:linux:glibc-devel", "p-cpe:/a:amazon:linux:glibc-utils", "p-cpe:/a:amazon:linux:nscd", "p-cpe:/a:amazon:linux:glibc", "p-cpe:/a:amazon:linux:glibc-common", "p-cpe:/a:amazon:linux:glibc-debuginfo-common", "p-cpe:/a:amazon:linux:glibc-static", "cpe:/o:amazon:linux", "p-cpe:/a:amazon:linux:glibc-headers"], "id": "ALA_ALAS-2015-468.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=80419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2015-468.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(80419);\n script_version(\"1.6\");\n script_cvs_date(\"Date: 2018/04/18 15:09:35\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_xref(name:\"ALAS\", value:\"2015-468\");\n script_xref(name:\"RHSA\", value:\"2015:0016\");\n\n script_name(english:\"Amazon Linux AMI : glibc (ALAS-2015-468)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command\nsubstitution even when the WRDE_NOCMD flag was specified. An attacker\nable to provide specially crafted input to an application using the\nwordexp() function, and not sanitizing the input correctly, could\npotentially use this flaw to execute arbitrary commands with the\ncredentials of the user running that application. (CVE-2014-7817)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2015-468.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update glibc' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-debuginfo-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:glibc-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"glibc-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-common-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-debuginfo-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-debuginfo-common-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-devel-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-headers-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-static-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"glibc-utils-2.17-55.92.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"nscd-2.17-55.92.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"glibc / glibc-common / glibc-debuginfo / glibc-debuginfo-common / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:44:25", "references": ["https://oss.oracle.com/pipermail/el-errata/2015-January/004773.html"], "pluginID": "80407", "description": "From Red Hat Security Advisory 2015:0016 :\n\nUpdated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat Developer Experience Team.\n\nThis update also fixes the following bugs :\n\n* Previously, when an address lookup using the getaddrinfo() function for the AF_UNSPEC value was performed on a defective DNS server, the server in some cases responded with a valid response for the A record, but a referral response for the AAAA record, which resulted in a lookup failure. A prior update was implemented for getaddrinfo() to return the valid response, but it contained a typographical error, due to which the lookup could under some circumstances still fail. This error has been corrected and getaddrinfo() now returns a valid response in the described circumstances. (BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive calls to dlopen() to terminate unexpectedly or to abort with a library assertion. This error has been fixed and recursive calls to dlopen() no longer crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.", "edition": 5, "reporter": "Tenable", "published": "2015-01-08T00:00:00", "title": "Oracle Linux 6 : glibc (ELSA-2015-0016)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Oracle Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2018-07-18T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "p-cpe:/a:oracle:linux:nscd", "p-cpe:/a:oracle:linux:glibc-devel", "p-cpe:/a:oracle:linux:glibc-utils", "p-cpe:/a:oracle:linux:glibc-static", "p-cpe:/a:oracle:linux:glibc-headers", "p-cpe:/a:oracle:linux:glibc-common", "p-cpe:/a:oracle:linux:glibc"], "id": "ORACLELINUX_ELSA-2015-0016.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=80407", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2015:0016 and \n# Oracle Linux Security Advisory ELSA-2015-0016 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(80407);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2018/07/18 17:43:57\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_bugtraq_id(69472, 71216);\n script_xref(name:\"RHSA\", value:\"2015:0016\");\n\n script_name(english:\"Oracle Linux 6 : glibc (ELSA-2015-0016)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2015:0016 :\n\nUpdated glibc packages that fix two security issues and two bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX\nthread libraries (libpthread), standard math libraries (libm), and the\nName Server Caching Daemon (nscd) used by multiple programs on the\nsystem. Without these libraries, the Linux system cannot function\ncorrectly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command\nsubstitution even when the WRDE_NOCMD flag was specified. An attacker\nable to provide specially crafted input to an application using the\nwordexp() function, and not sanitizing the input correctly, could\npotentially use this flaw to execute arbitrary commands with the\ncredentials of the user running that application. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs :\n\n* Previously, when an address lookup using the getaddrinfo() function\nfor the AF_UNSPEC value was performed on a defective DNS server, the\nserver in some cases responded with a valid response for the A record,\nbut a referral response for the AAAA record, which resulted in a\nlookup failure. A prior update was implemented for getaddrinfo() to\nreturn the valid response, but it contained a typographical error, due\nto which the lookup could under some circumstances still fail. This\nerror has been corrected and getaddrinfo() now returns a valid\nresponse in the described circumstances. (BZ#1172023)\n\n* An error in the dlopen() library function previously caused\nrecursive calls to dlopen() to terminate unexpectedly or to abort with\na library assertion. This error has been fixed and recursive calls to\ndlopen() no longer crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2015-January/004773.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected glibc packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !eregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = eregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", reference:\"glibc-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"glibc-common-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"glibc-devel-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"glibc-headers-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"glibc-static-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"glibc-utils-2.12-1.149.el6_6.4\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"nscd-2.12-1.149.el6_6.4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"glibc / glibc-common / glibc-devel / glibc-headers / glibc-static / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:50:52", "references": ["https://oss.oracle.com/pipermail/el-errata/2015-March/004874.html"], "pluginID": "81722", "description": "From Red Hat Security Advisory 2015:0327 :\n\nUpdated glibc packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)\n\nThis update also fixes the following bugs :\n\n* Due to problems with buffer extension and reallocation, the nscd daemon terminated unexpectedly with a segmentation fault when processing long netgroup entries. With this update, the handling of long netgroup entries has been corrected and nscd no longer crashes in the described scenario. (BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate() function, a subsequent ftell() call could incorrectly modify the file offset. This update ensures that ftell() modifies the stream state only when it is in append mode and the buffer for the stream is not empty. (BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers to generate incorrect code for the btowc() function in the older compatibility C++ standard library. Applications calling btowc() in the compatibility C++ standard library became unresponsive. With this update, the C library headers have been corrected, and the compatibility C++ standard library shipped with Red Hat Enterprise Linux has been rebuilt. Applications that rely on the compatibility C++ standard library no longer hang when calling btowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to cache netgroup information, the sudo utility denied access to valid users. The bug in nscd has been fixed, and sudo now works in netgroups as expected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which fix these issues.", "edition": 5, "reporter": "Tenable", "published": "2015-03-10T00:00:00", "title": "Oracle Linux 7 : glibc (ELSA-2015-0327)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Oracle Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2018-07-18T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:nscd", "p-cpe:/a:oracle:linux:glibc-devel", "p-cpe:/a:oracle:linux:glibc-utils", "p-cpe:/a:oracle:linux:glibc-static", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:glibc-headers", "p-cpe:/a:oracle:linux:glibc-common", "p-cpe:/a:oracle:linux:glibc"], "id": "ORACLELINUX_ELSA-2015-0327.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=81722", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2015:0327 and \n# Oracle Linux Security Advisory ELSA-2015-0327 respectively.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81722);\n script_version(\"1.27\");\n script_cvs_date(\"Date: 2018/07/18 17:43:57\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-8121\");\n script_bugtraq_id(68505, 68983, 69472, 71216, 72325, 73038);\n script_xref(name:\"RHSA\", value:\"2015:0327\");\n\n script_name(english:\"Oracle Linux 7 : glibc (ELSA-2015-0327)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2015:0327 :\n\nUpdated glibc packages that fix two security issues and several bugs\nare now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX\nthread libraries (libpthread), standard math libraries (libm), and the\nName Server Caching Daemon (nscd) used by multiple programs on the\nsystem. Without these libraries, the Linux system cannot function\ncorrectly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did\nnot isolate iteration over an entire database from key-based look-up\nAPI calls. An application performing look-ups on a database while\niterating over it could enter an infinite loop, leading to a denial of\nservice. (CVE-2014-8121)\n\nThis update also fixes the following bugs :\n\n* Due to problems with buffer extension and reallocation, the nscd\ndaemon terminated unexpectedly with a segmentation fault when\nprocessing long netgroup entries. With this update, the handling of\nlong netgroup entries has been corrected and nscd no longer crashes in\nthe described scenario. (BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate()\nfunction, a subsequent ftell() call could incorrectly modify the file\noffset. This update ensures that ftell() modifies the stream state\nonly when it is in append mode and the buffer for the stream is not\nempty. (BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers\nto generate incorrect code for the btowc() function in the older\ncompatibility C++ standard library. Applications calling btowc() in\nthe compatibility C++ standard library became unresponsive. With this\nupdate, the C library headers have been corrected, and the\ncompatibility C++ standard library shipped with Red Hat Enterprise\nLinux has been rebuilt. Applications that rely on the compatibility\nC++ standard library no longer hang when calling btowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to\ncache netgroup information, the sudo utility denied access to valid\nusers. The bug in nscd has been fixed, and sudo now works in netgroups\nas expected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which\nfix these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2015-March/004874.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected glibc packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Exim GHOST (glibc gethostbyname) Buffer Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:glibc-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !eregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = eregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"glibc-2.17-78.0.1.el7\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"glibc-common-2.17-78.0.1.el7\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"glibc-devel-2.17-78.0.1.el7\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"glibc-headers-2.17-78.0.1.el7\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"glibc-static-2.17-78.0.1.el7\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"glibc-utils-2.17-78.0.1.el7\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"nscd-2.17-78.0.1.el7\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"glibc / glibc-common / glibc-devel / glibc-headers / glibc-static / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:57:04", "references": ["http://www.nessus.org/u?fe58049f"], "pluginID": "81889", "description": "Updated glibc packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)\n\nThis update also fixes the following bugs :\n\n* Due to problems with buffer extension and reallocation, the nscd daemon terminated unexpectedly with a segmentation fault when processing long netgroup entries. With this update, the handling of long netgroup entries has been corrected and nscd no longer crashes in the described scenario. (BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate() function, a subsequent ftell() call could incorrectly modify the file offset. This update ensures that ftell() modifies the stream state only when it is in append mode and the buffer for the stream is not empty. (BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers to generate incorrect code for the btowc() function in the older compatibility C++ standard library. Applications calling btowc() in the compatibility C++ standard library became unresponsive. With this update, the C library headers have been corrected, and the compatibility C++ standard library shipped with Red Hat Enterprise Linux has been rebuilt. Applications that rely on the compatibility C++ standard library no longer hang when calling btowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to cache netgroup information, the sudo utility denied access to valid users. The bug in nscd has been fixed, and sudo now works in netgroups as expected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which fix these issues.", "edition": 5, "reporter": "Tenable", "published": "2015-03-18T00:00:00", "title": "CentOS 7 : glibc (CESA-2015:0327)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "CentOS Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2018-07-02T00:00:00", "cpe": ["p-cpe:/a:centos:centos:glibc-common", "p-cpe:/a:centos:centos:nscd", "cpe:/o:centos:centos:7", "p-cpe:/a:centos:centos:glibc-utils", "p-cpe:/a:centos:centos:glibc-devel", "p-cpe:/a:centos:centos:glibc-static", "p-cpe:/a:centos:centos:glibc-headers", "p-cpe:/a:centos:centos:glibc"], "id": "CENTOS_RHSA-2015-0327.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=81889", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:0327 and \n# CentOS Errata and Security Advisory 2015:0327 respectively.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81889);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/07/02 18:48:53\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-8121\");\n script_bugtraq_id(73038);\n script_xref(name:\"RHSA\", value:\"2015:0327\");\n\n script_name(english:\"CentOS 7 : glibc (CESA-2015:0327)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated glibc packages that fix two security issues and several bugs\nare now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX\nthread libraries (libpthread), standard math libraries (libm), and the\nName Server Caching Daemon (nscd) used by multiple programs on the\nsystem. Without these libraries, the Linux system cannot function\ncorrectly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did\nnot isolate iteration over an entire database from key-based look-up\nAPI calls. An application performing look-ups on a database while\niterating over it could enter an infinite loop, leading to a denial of\nservice. (CVE-2014-8121)\n\nThis update also fixes the following bugs :\n\n* Due to problems with buffer extension and reallocation, the nscd\ndaemon terminated unexpectedly with a segmentation fault when\nprocessing long netgroup entries. With this update, the handling of\nlong netgroup entries has been corrected and nscd no longer crashes in\nthe described scenario. (BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate()\nfunction, a subsequent ftell() call could incorrectly modify the file\noffset. This update ensures that ftell() modifies the stream state\nonly when it is in append mode and the buffer for the stream is not\nempty. (BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers\nto generate incorrect code for the btowc() function in the older\ncompatibility C++ standard library. Applications calling btowc() in\nthe compatibility C++ standard library became unresponsive. With this\nupdate, the C library headers have been corrected, and the\ncompatibility C++ standard library shipped with Red Hat Enterprise\nLinux has been rebuilt. Applications that rely on the compatibility\nC++ standard library no longer hang when calling btowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to\ncache netgroup information, the sudo utility denied access to valid\nusers. The bug in nscd has been fixed, and sudo now works in netgroups\nas expected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which\nfix these issues.\"\n );\n # http://lists.centos.org/pipermail/centos-cr-announce/2015-March/001556.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fe58049f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected glibc packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:glibc-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/03/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/CentOS/release\")) audit(AUDIT_OS_NOT, \"CentOS\");\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"glibc-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"glibc-common-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"glibc-devel-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"glibc-headers-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"glibc-static-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"glibc-utils-2.17-78.el7\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"nscd-2.17-78.el7\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-09T16:01:29", "references": ["http://rhn.redhat.com/errata/RHSA-2015-0016.html", "https://www.redhat.com/security/data/cve/CVE-2014-6040.html", "https://www.redhat.com/security/data/cve/CVE-2014-7817.html"], "pluginID": "80408", "description": "Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat Developer Experience Team.\n\nThis update also fixes the following bugs :\n\n* Previously, when an address lookup using the getaddrinfo() function for the AF_UNSPEC value was performed on a defective DNS server, the server in some cases responded with a valid response for the A record, but a referral response for the AAAA record, which resulted in a lookup failure. A prior update was implemented for getaddrinfo() to return the valid response, but it contained a typographical error, due to which the lookup could under some circumstances still fail. This error has been corrected and getaddrinfo() now returns a valid response in the described circumstances. (BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive calls to dlopen() to terminate unexpectedly or to abort with a library assertion. This error has been fixed and recursive calls to dlopen() no longer crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.", "edition": 7, "reporter": "Tenable", "published": "2015-01-08T00:00:00", "title": "RHEL 6 : glibc (RHSA-2015:0016)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Red Hat Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2018-09-07T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:glibc-static", "p-cpe:/a:redhat:enterprise_linux:glibc-utils", "p-cpe:/a:redhat:enterprise_linux:glibc", "p-cpe:/a:redhat:enterprise_linux:glibc-common", "p-cpe:/a:redhat:enterprise_linux:glibc-devel", "cpe:/o:redhat:enterprise_linux:6.6", "p-cpe:/a:redhat:enterprise_linux:nscd", "p-cpe:/a:redhat:enterprise_linux:glibc-headers", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:glibc-debuginfo", "p-cpe:/a:redhat:enterprise_linux:glibc-debuginfo-common"], "id": "REDHAT-RHSA-2015-0016.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=80408", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:0016. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(80408);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2018/09/07 17:03:12\");\n\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_bugtraq_id(69472, 71216);\n script_xref(name:\"RHSA\", value:\"2015:0016\");\n\n script_name(english:\"RHEL 6 : glibc (RHSA-2015:0016)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated glibc packages that fix two security issues and two bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe glibc packages provide the standard C libraries (libc), POSIX\nthread libraries (libpthread), standard math libraries (libm), and the\nName Server Caching Daemon (nscd) used by multiple programs on the\nsystem. Without these libraries, the Linux system cannot function\ncorrectly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv()\nfunction converted certain encoded data to UTF-8. An attacker able to\nmake an application call the iconv() function with a specially crafted\nargument could use this flaw to crash that application.\n(CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command\nsubstitution even when the WRDE_NOCMD flag was specified. An attacker\nable to provide specially crafted input to an application using the\nwordexp() function, and not sanitizing the input correctly, could\npotentially use this flaw to execute arbitrary commands with the\ncredentials of the user running that application. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs :\n\n* Previously, when an address lookup using the getaddrinfo() function\nfor the AF_UNSPEC value was performed on a defective DNS server, the\nserver in some cases responded with a valid response for the A record,\nbut a referral response for the AAAA record, which resulted in a\nlookup failure. A prior update was implemented for getaddrinfo() to\nreturn the valid response, but it contained a typographical error, due\nto which the lookup could under some circumstances still fail. This\nerror has been corrected and getaddrinfo() now returns a valid\nresponse in the described circumstances. (BZ#1172023)\n\n* An error in the dlopen() library function previously caused\nrecursive calls to dlopen() to terminate unexpectedly or to abort with\na library assertion. This error has been fixed and recursive calls to\ndlopen() no longer crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://rhn.redhat.com/errata/RHSA-2015-0016.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.redhat.com/security/data/cve/CVE-2014-7817.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.redhat.com/security/data/cve/CVE-2014-6040.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-debuginfo-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-static\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:glibc-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:nscd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:0016\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", reference:\"glibc-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"glibc-common-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"glibc-common-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"glibc-common-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"glibc-debuginfo-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"glibc-debuginfo-common-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"glibc-devel-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"glibc-headers-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"glibc-headers-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"glibc-headers-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", reference:\"glibc-static-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"glibc-utils-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"glibc-utils-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"glibc-utils-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"nscd-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"nscd-2.12-1.149.el6_6.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"nscd-2.12-1.149.el6_6.4\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"glibc / glibc-common / glibc-debuginfo / glibc-debuginfo-common / etc\");\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "openvas": [{"lastseen": "2018-09-01T23:50:47", "references": ["http://linux.oracle.com/errata/ELSA-2015-0016.html"], "pluginID": "1361412562310123206", "description": "Oracle Linux Local Security Checks ELSA-2015-0016", "edition": 5, "reporter": "Eero Volotinen", "published": "2015-10-06T00:00:00", "title": "Oracle Linux Local Check: ELSA-2015-0016", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Oracle Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:1361412562310123206", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123206", "sourceData": "# OpenVAS Vulnerability Test \n# Description: Oracle Linux Local Check \n# $Id: ELSA-2015-0016.nasl 6560 2017-07-06 11:58:38Z cfischer $\n \n# Authors: \n# Eero Volotinen <eero.volotinen@solinor.com> \n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\nif(description)\n {\nscript_oid(\"1.3.6.1.4.1.25623.1.0.123206\");\nscript_version(\"$Revision: 6560 $\");\nscript_tag(name:\"creation_date\", value:\"2015-10-06 14:00:43 +0300 (Tue, 06 Oct 2015)\");\nscript_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 13:58:38 +0200 (Thu, 06 Jul 2017) $\");\nscript_name(\"Oracle Linux Local Check: ELSA-2015-0016\");\nscript_tag(name: \"insight\", value: \"ELSA-2015-0016 - glibc security and bug fix update - [2.12-1.149.4]- Fix recursive dlopen() (#1173469).[2.12-1.149.3]- Fix typo in res_send and res_query (#rh1172023).[2.12-1.149.2]- Fix crashes on invalid input in IBM gconv modules (CVE-2014-6040, #1139571).[2.12-1.149.1]- Fix wordexp() to honour WRDE_NOCMD (CVE-2014-7817, #1170121).\"); \nscript_tag(name : \"solution\", value : \"update software\");\nscript_tag(name : \"solution_type\", value : \"VendorFix\");\nscript_tag(name : \"summary\", value : \"Oracle Linux Local Security Checks ELSA-2015-0016\");\nscript_xref(name : \"URL\" , value : \"http://linux.oracle.com/errata/ELSA-2015-0016.html\");\nscript_cve_id(\"CVE-2014-7817\",\"CVE-2014-6040\");\nscript_tag(name:\"cvss_base\", value:\"5.0\");\nscript_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\nscript_tag(name:\"qod_type\", value:\"package\");\nscript_dependencies(\"gather-package-list.nasl\");\nscript_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\");\nscript_category(ACT_GATHER_INFO);\nscript_copyright(\"Eero Volotinen\");\nscript_family(\"Oracle Linux Local Security Checks\");\nexit(0);\n}\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\nrelease = get_kb_item(\"ssh/login/release\");\nres = \"\";\nif(release == NULL)\n{\n exit(0);\n}\nif(release == \"OracleLinux6\")\n{\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n if ((res = isrpmvuln(pkg:\"glibc-common\", rpm:\"glibc-common~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n if ((res = isrpmvuln(pkg:\"glibc-headers\", rpm:\"glibc-headers~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n if ((res = isrpmvuln(pkg:\"glibc-static\", rpm:\"glibc-static~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n if ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.12~1.149.el6_6.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0); \n }\n\n}\nif (__pkg_match) exit(99); #Not vulnerable\n exit(0);\n\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:50:38", "references": ["https://alas.aws.amazon.com/ALAS-2015-468.html"], "pluginID": "1361412562310120455", "description": "Amazon Linux Local Security Checks", "edition": 5, "reporter": "Eero Volotinen", "published": "2015-09-08T00:00:00", "title": "Amazon Linux Local Check: ALAS-2015-468", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Amazon Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:1361412562310120455", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120455", "sourceData": "# OpenVAS Vulnerability Test \n# Description: Amazon Linux security check \n# $Id: alas-2015-468.nasl 6575 2017-07-06 13:42:08Z cfischer $\n \n# Authors: \n# Eero Volotinen <eero.volotinen@iki.fi> \n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://ping-viini.org \n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\nif(description)\n {\nscript_oid(\"1.3.6.1.4.1.25623.1.0.120455\");\nscript_version(\"$Revision: 6575 $\");\nscript_tag(name:\"creation_date\", value:\"2015-09-08 13:26:45 +0200 (Tue, 08 Sep 2015)\");\nscript_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:42:08 +0200 (Thu, 06 Jul 2017) $\");\nscript_name(\"Amazon Linux Local Check: ALAS-2015-468\");\nscript_tag(name: \"insight\", value: \"An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. (CVE-2014-6040 )It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817 )\"); \nscript_tag(name : \"solution\", value : \"Run yum update glibc to update your system.\");\nscript_tag(name : \"solution_type\", value : \"VendorFix\");\nscript_xref(name : \"URL\" , value : \"https://alas.aws.amazon.com/ALAS-2015-468.html\");\nscript_cve_id(\"CVE-2014-7817\", \"CVE-2014-6040\");\nscript_tag(name:\"cvss_base\", value:\"5.0\");\nscript_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\nscript_tag(name:\"qod_type\", value:\"package\");\nscript_dependencies(\"gather-package-list.nasl\");\nscript_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\nscript_category(ACT_GATHER_INFO);\nscript_tag(name:\"summary\", value:\"Amazon Linux Local Security Checks\");\nscript_copyright(\"Eero Volotinen\");\nscript_family(\"Amazon Linux Local Security Checks\");\nexit(0);\n}\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\nrelease = get_kb_item(\"ssh/login/release\");\nres = \"\";\nif(release == NULL)\n{\n exit(0);\n}\nif(release == \"AMAZON\")\n{\nif ((res = isrpmvuln(pkg:\"glibc-common\", rpm:\"glibc-common~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-debuginfo\", rpm:\"glibc-debuginfo~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-debuginfo-common\", rpm:\"glibc-debuginfo-common~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-static\", rpm:\"glibc-static~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-headers\", rpm:\"glibc-headers~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.17~55.92.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99); #Not vulnerable\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:52:05", "references": ["https://alas.aws.amazon.com/ALAS-2015-495.html"], "pluginID": "1361412562310120169", "description": "Amazon Linux Local Security Checks", "edition": 4, "reporter": "Eero Volotinen", "published": "2015-09-08T00:00:00", "title": "Amazon Linux Local Check: ALAS-2015-495", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "naslFamily": "Amazon Linux Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:1361412562310120169", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120169", "sourceData": "# OpenVAS Vulnerability Test \n# Description: Amazon Linux security check \n# $Id: alas-2015-495.nasl 6575 2017-07-06 13:42:08Z cfischer $\n \n# Authors: \n# Eero Volotinen <eero.volotinen@iki.fi> \n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://ping-viini.org \n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\nif(description)\n {\nscript_oid(\"1.3.6.1.4.1.25623.1.0.120169\");\nscript_version(\"$Revision: 6575 $\");\nscript_tag(name:\"creation_date\", value:\"2015-09-08 13:19:06 +0200 (Tue, 08 Sep 2015)\");\nscript_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:42:08 +0200 (Thu, 06 Jul 2017) $\");\nscript_name(\"Amazon Linux Local Check: ALAS-2015-495\");\nscript_tag(name: \"insight\", value: \"An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. (CVE-2014-6040 )It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121 )\"); \nscript_tag(name : \"solution\", value : \"Run yum update glibc to update your system.\");\nscript_tag(name : \"solution_type\", value : \"VendorFix\");\nscript_xref(name : \"URL\" , value : \"https://alas.aws.amazon.com/ALAS-2015-495.html\");\nscript_cve_id(\"CVE-2014-6040\", \"CVE-2014-8121\");\nscript_tag(name:\"cvss_base\", value:\"5.0\");\nscript_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\nscript_tag(name:\"qod_type\", value:\"package\");\nscript_dependencies(\"gather-package-list.nasl\");\nscript_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\nscript_category(ACT_GATHER_INFO);\nscript_tag(name:\"summary\", value:\"Amazon Linux Local Security Checks\");\nscript_copyright(\"Eero Volotinen\");\nscript_family(\"Amazon Linux Local Security Checks\");\nexit(0);\n}\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\nrelease = get_kb_item(\"ssh/login/release\");\nres = \"\";\nif(release == NULL)\n{\n exit(0);\n}\nif(release == \"AMAZON\")\n{\nif ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-common\", rpm:\"glibc-common~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-static\", rpm:\"glibc-static~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-headers\", rpm:\"glibc-headers~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-debuginfo-common\", rpm:\"glibc-debuginfo-common~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-debuginfo\", rpm:\"glibc-debuginfo~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.17~55.139.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99); #Not vulnerable\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:49:31", "references": ["https://www.redhat.com/archives/rhsa-announce/2015-March/msg00021.html", "2015:0327-01"], "pluginID": "1361412562310871331", "description": "Check the version of glibc", "edition": 5, "reporter": "Copyright (C) 2015 Greenbone Networks GmbH", "published": "2015-03-06T00:00:00", "title": "RedHat Update for glibc RHSA-2015:0327-01", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Red Hat Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2017-07-12T00:00:00", "id": "OPENVAS:1361412562310871331", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871331", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for glibc RHSA-2015:0327-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871331\");\n script_version(\"$Revision: 6689 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:50:06 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-03-06 06:50:44 +0100 (Fri, 06 Mar 2015)\");\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-8121\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for glibc RHSA-2015:0327-01\");\n script_tag(name: \"summary\", value: \"Check the version of glibc\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"The glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did not\nisolate iteration over an entire database from key-based look-up API calls.\nAn application performing look-ups on a database while iterating over it\ncould enter an infinite loop, leading to a denial of service.\n(CVE-2014-8121)\n\nThis update also fixes the following bugs:\n\n* Due to problems with buffer extension and reallocation, the nscd daemon\nterminated unexpectedly with a segmentation fault when processing long\nnetgroup entries. With this update, the handling of long netgroup entries\nhas been corrected and nscd no longer crashes in the described scenario.\n(BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate()\nfunction, a subsequent ftell() call could incorrectly modify the file\noffset. This update ensures that ftell() modifies the stream state only\nwhen it is in append mode and the buffer for the stream is not empty.\n(BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers to\ngenerate incorrect code for the btowc() function in the older compatibility\nC++ standard library. Applications calling btowc() in the compatibility C++\nstandard library became unresponsive. With this update, the C library\nheaders have been corrected, and the compatibility C++ standard library\nshipped with Red Hat Enterprise Linux has been rebuilt. Applications that\nrely on the compatibility C++ standard library no longer hang when calling\nbtowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to cache\nnetgroup information, the sudo utility denied access to valid users. The\nbug in nscd has been fixed, and sudo now works in netgroups as\nexpected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which fix\nthese issues.\n\");\n script_tag(name: \"affected\", value: \"glibc on Red Hat Enterprise Linux Server (v. 7)\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"RHSA\", value: \"2015:0327-01\");\n script_xref(name: \"URL\" , value: \"https://www.redhat.com/archives/rhsa-announce/2015-March/msg00021.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-common\", rpm:\"glibc-common~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo\", rpm:\"glibc-debuginfo~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo-common\", rpm:\"glibc-debuginfo-common~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-headers\", rpm:\"glibc-headers~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.17~78.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:52:55", "references": ["2015:0016-01", "https://www.redhat.com/archives/rhsa-announce/2015-January/msg00005.html"], "pluginID": "1361412562310871301", "description": "Check the version of glibc", "edition": 4, "reporter": "Copyright (C) 2015 Greenbone Networks GmbH", "published": "2015-01-23T00:00:00", "title": "RedHat Update for glibc RHSA-2015:0016-01", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Red Hat Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2017-07-12T00:00:00", "id": "OPENVAS:1361412562310871301", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871301", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for glibc RHSA-2015:0016-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871301\");\n script_version(\"$Revision: 6689 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:50:06 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-23 12:55:28 +0100 (Fri, 23 Jan 2015)\");\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"RedHat Update for glibc RHSA-2015:0016-01\");\n script_tag(name: \"summary\", value: \"Check the version of glibc\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"The glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution\neven when the WRDE_NOCMD flag was specified. An attacker able to provide\nspecially crafted input to an application using the wordexp() function, and\nnot sanitizing the input correctly, could potentially use this flaw to\nexecute arbitrary commands with the credentials of the user running that\napplication. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs:\n\n* Previously, when an address lookup using the getaddrinfo() function for\nthe AF_UNSPEC value was performed on a defective DNS server, the server in\nsome cases responded with a valid response for the A record, but a referral\nresponse for the AAAA record, which resulted in a lookup failure. A prior\nupdate was implemented for getaddrinfo() to return the valid response, but\nit contained a typographical error, due to which the lookup could under\nsome circumstances still fail. This error has been corrected and\ngetaddrinfo() now returns a valid response in the described circumstances.\n(BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive\ncalls to dlopen() to terminate unexpectedly or to abort with a library\nassertion. This error has been fixed and recursive calls to dlopen() no\nlonger crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.\n\");\n script_tag(name: \"affected\", value: \"glibc on Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Workstation (v. 6)\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"RHSA\", value: \"2015:0016-01\");\n script_xref(name: \"URL\" , value: \"https://www.redhat.com/archives/rhsa-announce/2015-January/msg00005.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-common\", rpm:\"glibc-common~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo\", rpm:\"glibc-debuginfo~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo-common\", rpm:\"glibc-debuginfo-common~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-headers\", rpm:\"glibc-headers~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.12~1.149.el6_6.4\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:50:49", "references": ["2015:0016", "http://lists.centos.org/pipermail/centos-announce/2015-January/020863.html"], "pluginID": "1361412562310882090", "description": "Check the version of glibc", "edition": 5, "reporter": "Copyright (C) 2015 Greenbone Networks GmbH", "published": "2015-01-23T00:00:00", "title": "CentOS Update for glibc CESA-2015:0016 centos6 ", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "CentOS Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:1361412562310882090", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882090", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for glibc CESA-2015:0016 centos6 \n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882090\");\n script_version(\"$Revision: 6657 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:50:44 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-23 12:56:20 +0100 (Fri, 23 Jan 2015)\");\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"CentOS Update for glibc CESA-2015:0016 centos6 \");\n script_tag(name: \"summary\", value: \"Check the version of glibc\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"The glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution\neven when the WRDE_NOCMD flag was specified. An attacker able to provide\nspecially crafted input to an application using the wordexp() function, and\nnot sanitizing the input correctly, could potentially use this flaw to\nexecute arbitrary commands with the credentials of the user running that\napplication. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs:\n\n* Previously, when an address lookup using the getaddrinfo() function for\nthe AF_UNSPEC value was performed on a defective DNS server, the server in\nsome cases responded with a valid response for the A record, but a referral\nresponse for the AAAA record, which resulted in a lookup failure. A prior\nupdate was implemented for getaddrinfo() to return the valid response, but\nit contained a typographical error, due to which the lookup could under\nsome circumstances still fail. This error has been corrected and\ngetaddrinfo() now returns a valid response in the described circumstances.\n(BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive\ncalls to dlopen() to terminate unexpectedly or to abort with a library\nassertion. This error has been fixed and recursive calls to dlopen() no\nlonger crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.\n\");\n script_tag(name: \"affected\", value: \"glibc on CentOS 6\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"CESA\", value: \"2015:0016\");\n script_xref(name: \"URL\" , value: \"http://lists.centos.org/pipermail/centos-announce/2015-January/020863.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-common\", rpm:\"glibc-common~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-headers\", rpm:\"glibc-headers~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-static\", rpm:\"glibc-static~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.12~1.149.el6_6.4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:53:50", "references": ["2014:1115_1"], "pluginID": "1361412562310850610", "description": "Check for the Version of glibc", "edition": 6, "reporter": "Copyright (C) 2014 Greenbone Networks GmbH", "published": "2014-09-12T00:00:00", "title": "SuSE Update for glibc openSUSE-SU-2014:1115-1 (glibc)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "SuSE Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5119", "CVE-2014-6040", "CVE-2014-0475"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310850610", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310850610", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2014_1115_1.nasl 9373 2018-04-06 08:57:18Z cfischer $\n#\n# SuSE Update for glibc openSUSE-SU-2014:1115-1 (glibc)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.850610\");\n script_version(\"$Revision: 9373 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:57:18 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2014-09-12 05:56:57 +0200 (Fri, 12 Sep 2014)\");\n script_cve_id(\"CVE-2014-0475\", \"CVE-2014-5119\", \"CVE-2014-6040\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"SuSE Update for glibc openSUSE-SU-2014:1115-1 (glibc)\");\n script_tag(name: \"insight\", value: \"glibc was updated to fix three security\nissues:\n\n - A directory traversal in locale environment handling was fixed\n (CVE-2014-0475, bnc#887022, GLIBC BZ #17137)\n\n - Disable gconv transliteration module loading which could be used for\n code execution (CVE-2014-5119, bnc#892073, GLIBC BZ #17187)\n\n - Fix crashes on invalid input in IBM gconv modules (CVE-2014-6040,\n bnc#894553, BZ #17325)\");\n script_tag(name: \"affected\", value: \"glibc on openSUSE 13.1, openSUSE 12.3\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name: \"openSUSE-SU\", value: \"2014:1115_1\");\n script_tag(name:\"summary\", value:\"Check for the Version of glibc\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"openSUSE12.3\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo\", rpm:\"glibc-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debugsource\", rpm:\"glibc-debugsource~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-debuginfo\", rpm:\"glibc-devel-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-static\", rpm:\"glibc-devel-static~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-extra\", rpm:\"glibc-extra~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-extra-debuginfo\", rpm:\"glibc-extra-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale\", rpm:\"glibc-locale~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-debuginfo\", rpm:\"glibc-locale-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-profile\", rpm:\"glibc-profile~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd-debuginfo\", rpm:\"nscd-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-debuginfo\", rpm:\"glibc-utils-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-debugsource\", rpm:\"glibc-utils-debugsource~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-obsolete\", rpm:\"glibc-obsolete~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-obsolete-debuginfo\", rpm:\"glibc-obsolete-debuginfo~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-32bit\", rpm:\"glibc-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo-32bit\", rpm:\"glibc-debuginfo-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-32bit\", rpm:\"glibc-devel-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-debuginfo-32bit\", rpm:\"glibc-devel-debuginfo-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-static-32bit\", rpm:\"glibc-devel-static-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-32bit\", rpm:\"glibc-locale-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-debuginfo-32bit\", rpm:\"glibc-locale-debuginfo-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-profile-32bit\", rpm:\"glibc-profile-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-32bit\", rpm:\"glibc-utils-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-debuginfo-32bit\", rpm:\"glibc-utils-debuginfo-32bit~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-html\", rpm:\"glibc-html~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-i18ndata\", rpm:\"glibc-i18ndata~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-info\", rpm:\"glibc-info~2.17~4.13.1\", rls:\"openSUSE12.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"openSUSE13.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo\", rpm:\"glibc-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debugsource\", rpm:\"glibc-debugsource~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-debuginfo\", rpm:\"glibc-devel-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-static\", rpm:\"glibc-devel-static~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-extra\", rpm:\"glibc-extra~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-extra-debuginfo\", rpm:\"glibc-extra-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale\", rpm:\"glibc-locale~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-debuginfo\", rpm:\"glibc-locale-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-profile\", rpm:\"glibc-profile~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd-debuginfo\", rpm:\"nscd-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils\", rpm:\"glibc-utils~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-debuginfo\", rpm:\"glibc-utils-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-debugsource\", rpm:\"glibc-utils-debugsource~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-obsolete\", rpm:\"glibc-obsolete~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-obsolete-debuginfo\", rpm:\"glibc-obsolete-debuginfo~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-32bit\", rpm:\"glibc-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-debuginfo-32bit\", rpm:\"glibc-debuginfo-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-32bit\", rpm:\"glibc-devel-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-debuginfo-32bit\", rpm:\"glibc-devel-debuginfo-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-static-32bit\", rpm:\"glibc-devel-static-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-32bit\", rpm:\"glibc-locale-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-debuginfo-32bit\", rpm:\"glibc-locale-debuginfo-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-profile-32bit\", rpm:\"glibc-profile-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-32bit\", rpm:\"glibc-utils-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-utils-debuginfo-32bit\", rpm:\"glibc-utils-debuginfo-32bit~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-html\", rpm:\"glibc-html~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-i18ndata\", rpm:\"glibc-i18ndata~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-info\", rpm:\"glibc-info~2.18~4.21.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:50:18", "references": ["https://lists.fedoraproject.org/pipermail/package-announce/2015-March/150631.html", "2015-2845"], "pluginID": "1361412562310869060", "description": "Check the version of glibc", "edition": 5, "reporter": "Copyright (C) 2015 Greenbone Networks GmbH", "published": "2015-03-05T00:00:00", "title": "Fedora Update for glibc FEDORA-2015-2845", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5119", "CVE-2014-6040", "CVE-2014-7817", "CVE-2014-0475"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:1361412562310869060", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869060", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for glibc FEDORA-2015-2845\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869060\");\n script_version(\"$Revision: 6630 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:34:32 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-03-05 05:43:08 +0100 (Thu, 05 Mar 2015)\");\n script_cve_id(\"CVE-2014-6040\", \"CVE-2014-7817\", \"CVE-2014-5119\", \"CVE-2014-0475\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for glibc FEDORA-2015-2845\");\n script_tag(name: \"summary\", value: \"Check the version of glibc\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"The glibc package contains standard libraries which are used by\nmultiple programs on the system. In order to save disk space and\nmemory, as well as to make upgrading easier, common system code is\nkept in one place and shared between programs. This particular package\ncontains the most important sets of shared libraries: the standard C\nlibrary and the standard math library. Without these two libraries, a\nLinux system will not function.\n\");\n script_tag(name: \"affected\", value: \"glibc on Fedora 20\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"FEDORA\", value: \"2015-2845\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2015-March/150631.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.18~19.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:50:46", "references": ["2014:1129_1"], "pluginID": "1361412562310851101", "description": "Check the version of glibc", "edition": 6, "reporter": "Copyright (C) 2015 Greenbone Networks GmbH", "published": "2015-10-16T00:00:00", "title": "SuSE Update for glibc SUSE-SU-2014:1129-1 (glibc)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "SuSE Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5119", "CVE-2014-6040", "CVE-2013-4357", "CVE-2012-6656"], "modified": "2017-12-08T00:00:00", "id": "OPENVAS:1361412562310851101", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851101", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2014_1129_1.nasl 8046 2017-12-08 08:48:56Z santu $\n#\n# SuSE Update for glibc SUSE-SU-2014:1129-1 (glibc)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851101\");\n script_version(\"$Revision: 8046 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-08 09:48:56 +0100 (Fri, 08 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 20:03:09 +0200 (Fri, 16 Oct 2015)\");\n script_cve_id(\"CVE-2012-6656\", \"CVE-2013-4357\", \"CVE-2014-5119\", \"CVE-2014-6040\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for glibc SUSE-SU-2014:1129-1 (glibc)\");\n script_tag(name: \"summary\", value: \"Check the version of glibc\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"\n This glibc update fixes a critical privilege escalation problem and two\n additional issues:\n\n * bnc#892073: An off-by-one error leading to a heap-based buffer\n overflow was found in __gconv_translit_find(). An exploit that\n targets the problem is publicly available. (CVE-2014-5119)\n * bnc#836746: Avoid race between {, __de}allocate_stack and\n __reclaim_stacks during fork.\n * bnc#844309: Fixed various overflows, reading large /etc/hosts or\n long names. (CVE-2013-4357)\n * bnc#894553, bnc#894556: Fixed various crashes on invalid input in\n IBM gconv modules. (CVE-2014-6040, CVE-2012-6656)\n\n Security Issues:\n\n * CVE-2012-6656\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6656 \n * CVE-2013-4357\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4357 \n * CVE-2014-5119\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119 \n * CVE-2014-6040\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6040\");\n script_tag(name: \"affected\", value: \"glibc on SUSE Linux Enterprise Server 11 SP2 LTSS\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"SUSE-SU\", value: \"2014:1129_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"SLES11.0SP2\")\n{\n\n if ((res = isrpmvuln(pkg:\"glibc\", rpm:\"glibc~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel\", rpm:\"glibc-devel~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-html\", rpm:\"glibc-html~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-i18ndata\", rpm:\"glibc-i18ndata~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-info\", rpm:\"glibc-info~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale\", rpm:\"glibc-locale~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-profile\", rpm:\"glibc-profile~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"nscd\", rpm:\"nscd~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-32bit\", rpm:\"glibc-32bit~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-devel-32bit\", rpm:\"glibc-devel-32bit~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-locale-32bit\", rpm:\"glibc-locale-32bit~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"glibc-profile-32bit\", rpm:\"glibc-profile-32bit~2.11.3~17.45.53.1\", rls:\"SLES11.0SP2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:52:17", "references": ["http://www.debian.org/security/2015/dsa-3142.html"], "pluginID": "1361412562310703142", "description": "Several vulnerabilities have been\nfixed in eglibc, Debian", "edition": 3, "reporter": "Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net", "published": "2015-01-27T00:00:00", "title": "Debian Security Advisory DSA 3142-1 (eglibc - security update)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0235", "CVE-2014-6040", "CVE-2014-7817", "CVE-2012-6656"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310703142", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703142", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3142.nasl 9355 2018-04-06 07:16:07Z cfischer $\n# Auto-generated from advisory DSA 3142-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703142\");\n script_version(\"$Revision: 9355 $\");\n script_cve_id(\"CVE-2012-6656\", \"CVE-2014-6040\", \"CVE-2014-7817\", \"CVE-2015-0235\");\n script_name(\"Debian Security Advisory DSA 3142-1 (eglibc - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2018-04-06 09:16:07 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name: \"creation_date\", value: \"2015-01-27 00:00:00 +0100 (Tue, 27 Jan 2015)\");\n script_tag(name: \"cvss_base\", value: \"10.0\");\n script_tag(name: \"cvss_base_vector\", value: \"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2015/dsa-3142.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"eglibc on Debian Linux\");\n script_tag(name: \"solution\", value: \"For the stable distribution (wheezy),\nthese problems have been fixed in version 2.13-38+deb7u7.\n\nFor the upcoming stable distribution (jessie) and the unstable\ndistribution (sid), the\nCVE-2015-0235\n\nissue has been fixed in version 2.18-1 of the glibc package.\n\nWe recommend that you upgrade your eglibc packages.\");\n script_tag(name: \"summary\", value: \"Several vulnerabilities have been\nfixed in eglibc, Debian's version of the GNU C library:\n\nCVE-2015-0235\nQualys discovered that the gethostbyname and gethostbyname2\nfunctions were subject to a buffer overflow if provided with a\ncrafted IP address argument. This could be used by an attacker to\nexecute arbitrary code in processes which called the affected\nfunctions.\n\nThe original glibc bug was reported by Peter Klotz.\n\nCVE-2014-7817\nTim Waugh of Red Hat discovered that the WRDE_NOCMD option of the\nwordexp function did not suppress command execution in all cases.\nThis allows a context-dependent attacker to execute shell\ncommands.\n\nCVE-2012-6656 CVE-2014-6040\nThe charset conversion code for certain IBM multi-byte code pages\ncould perform an out-of-bounds array access, causing the process\nto crash. In some scenarios, this allows a remote attacker to\ncause a persistent denial of service.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"eglibc-source\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"glibc-doc\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc-bin\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc-dev-bin\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-dbg\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-dev\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-dev-i386\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-i386\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-i686\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-pic\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-prof\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc0.1-udeb\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-amd64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dbg\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-amd64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-i386\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-mips64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-mipsn32\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-ppc64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-s390\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-s390x\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-dev-sparc64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-i386\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-i686\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-loongson2f\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-mips64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-mipsn32\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-pic\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-ppc64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-prof\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-s390\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-s390x\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-sparc64\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-udeb\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6-xen\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6.1\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6.1-dbg\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6.1-dev\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6.1-pic\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6.1-prof\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libc6.1-udeb\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libnss-dns-udeb\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libnss-files-udeb\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"locales\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"locales-all\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"multiarch-support\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"nscd\", ver:\"2.13-38+deb7u7\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "centos": [{"lastseen": "2017-10-03T18:24:50", "references": ["https://rhn.redhat.com/errata/RHSA-2015-0016.html"], "affectedPackage": [{"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-common", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "nscd", "packageFilename": "nscd-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "nscd", "packageFilename": "nscd-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "any", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.src.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-common", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}], "description": "**CentOS Errata and Security Advisory** CESA-2015:0016\n\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution\neven when the WRDE_NOCMD flag was specified. An attacker able to provide\nspecially crafted input to an application using the wordexp() function, and\nnot sanitizing the input correctly, could potentially use this flaw to\nexecute arbitrary commands with the credentials of the user running that\napplication. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs:\n\n* Previously, when an address lookup using the getaddrinfo() function for\nthe AF_UNSPEC value was performed on a defective DNS server, the server in\nsome cases responded with a valid response for the A record, but a referral\nresponse for the AAAA record, which resulted in a lookup failure. A prior\nupdate was implemented for getaddrinfo() to return the valid response, but\nit contained a typographical error, due to which the lookup could under\nsome circumstances still fail. This error has been corrected and\ngetaddrinfo() now returns a valid response in the described circumstances.\n(BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive\ncalls to dlopen() to terminate unexpectedly or to abort with a library\nassertion. This error has been fixed and recursive calls to dlopen() no\nlonger crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-January/020863.html\n\n**Affected packages:**\nglibc\nglibc-common\nglibc-devel\nglibc-headers\nglibc-static\nglibc-utils\nnscd\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-0016.html", "edition": 1, "reporter": "CentOS Project", "published": "2015-01-07T22:45:41", "title": "glibc, nscd security update", "type": "centos", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2015-01-07T22:45:41", "href": "http://lists.centos.org/pipermail/centos-announce/2015-January/020863.html", "id": "CESA-2015:0016", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-10-03T18:24:26", "references": ["https://rhn.redhat.com/errata/RHSA-2015-0327.html"], "affectedPackage": [{"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-static-2.17-78.el7.i686.rpm", "packageName": "glibc-static", "arch": "i686", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-utils-2.17-78.el7.x86_64.rpm", "packageName": "glibc-utils", "arch": "x86_64", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-common-2.17-78.el7.x86_64.rpm", "packageName": "glibc-common", "arch": "x86_64", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-devel-2.17-78.el7.x86_64.rpm", "packageName": "glibc-devel", "arch": "x86_64", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-devel-2.17-78.el7.i686.rpm", "packageName": "glibc-devel", "arch": "i686", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-headers-2.17-78.el7.x86_64.rpm", "packageName": "glibc-headers", "arch": "x86_64", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-static-2.17-78.el7.x86_64.rpm", "packageName": "glibc-static", "arch": "x86_64", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "nscd-2.17-78.el7.x86_64.rpm", "packageName": "nscd", "arch": "x86_64", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-2.17-78.el7.i686.rpm", "packageName": "glibc", "arch": "i686", "operator": "lt"}, {"OS": "CentOS", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageFilename": "glibc-2.17-78.el7.x86_64.rpm", "packageName": "glibc", "arch": "x86_64", "operator": "lt"}], "description": "**CentOS Errata and Security Advisory** CESA-2015:0327\n\n\nThe glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did not\nisolate iteration over an entire database from key-based look-up API calls.\nAn application performing look-ups on a database while iterating over it\ncould enter an infinite loop, leading to a denial of service.\n(CVE-2014-8121)\n\nThis update also fixes the following bugs:\n\n* Due to problems with buffer extension and reallocation, the nscd daemon\nterminated unexpectedly with a segmentation fault when processing long\nnetgroup entries. With this update, the handling of long netgroup entries\nhas been corrected and nscd no longer crashes in the described scenario.\n(BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate()\nfunction, a subsequent ftell() call could incorrectly modify the file\noffset. This update ensures that ftell() modifies the stream state only\nwhen it is in append mode and the buffer for the stream is not empty.\n(BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers to\ngenerate incorrect code for the btowc() function in the older compatibility C++\nstandard library. Applications calling btowc() in the compatibility C++ standard\nlibrary became unresponsive. With this update, the C library headers have been\ncorrected, and the compatibility C++ standard library shipped with Red Hat\nEnterprise Linux has been rebuilt. Applications that rely on the compatibility\nC++ standard library no longer hang when calling btowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to cache\nnetgroup information, the sudo utility denied access to valid users. The bug in\nnscd has been fixed, and sudo now works in netgroups as\nexpected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which fix these\nissues.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2015-March/001556.html\n\n**Affected packages:**\nglibc\nglibc-common\nglibc-devel\nglibc-headers\nglibc-static\nglibc-utils\nnscd\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-0327.html", "edition": 1, "reporter": "CentOS Project", "published": "2015-03-17T13:28:04", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "title": "glibc, nscd security update", "type": "centos", "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2015-03-17T13:28:04", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2015-March/001556.html", "id": "CESA-2015:0327", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "redhat": [{"lastseen": "2018-06-12T21:10:51", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhat.RedHatBulletin"], "references": [], "affectedPackage": [{"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "src", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "nscd", "packageFilename": "nscd-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-common", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-common", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "nscd", "packageFilename": "nscd-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.12-1.149.el6_6.4.ppc.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.12-1.149.el6_6.4.ppc.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.ppc.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.ppc.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "nscd", "packageFilename": "nscd-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-common", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.ppc.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "ppc64", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.ppc64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.12-1.149.el6_6.4.s390.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.12-1.149.el6_6.4.s390.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.s390.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "nscd", "packageFilename": "nscd-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-common", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.s390.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc", "packageFilename": "glibc-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390x", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.s390x.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "s390", "packageName": "glibc-static", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.s390.rpm", "operator": "lt"}], "description": "The glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the wordexp() function would perform command substitution\neven when the WRDE_NOCMD flag was specified. An attacker able to provide\nspecially crafted input to an application using the wordexp() function, and\nnot sanitizing the input correctly, could potentially use this flaw to\nexecute arbitrary commands with the credentials of the user running that\napplication. (CVE-2014-7817)\n\nThe CVE-2014-7817 issue was discovered by Tim Waugh of the Red Hat\nDeveloper Experience Team.\n\nThis update also fixes the following bugs:\n\n* Previously, when an address lookup using the getaddrinfo() function for\nthe AF_UNSPEC value was performed on a defective DNS server, the server in\nsome cases responded with a valid response for the A record, but a referral\nresponse for the AAAA record, which resulted in a lookup failure. A prior\nupdate was implemented for getaddrinfo() to return the valid response, but\nit contained a typographical error, due to which the lookup could under\nsome circumstances still fail. This error has been corrected and\ngetaddrinfo() now returns a valid response in the described circumstances.\n(BZ#1172023)\n\n* An error in the dlopen() library function previously caused recursive\ncalls to dlopen() to terminate unexpectedly or to abort with a library\nassertion. This error has been fixed and recursive calls to dlopen() no\nlonger crash or abort. (BZ#1173469)\n\nAll glibc users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.\n", "reporter": "RedHat", "published": "2015-01-07T05:00:00", "type": "redhat", "title": "(RHSA-2015:0016) Moderate: glibc security and bug fix update", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "_object_type": "robots.models.redhat.RedHatBulletin", "modified": "2018-06-06T20:24:20", "id": "RHSA-2015:0016", "href": "https://access.redhat.com/errata/RHSA-2015:0016", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-15T16:21:25", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhat.RedHatBulletin"], "references": [], "affectedPackage": [{"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-78.el7.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.17-78.el7.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.src.rpm", "arch": "src", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-static", "packageFilename": "glibc-static-2.17-78.el7.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-static", "packageFilename": "glibc-static-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-78.el7.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "nscd", "packageFilename": "nscd-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-common", "packageFilename": "glibc-common-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.17-78.el7.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.17-78.el7.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-78.el7.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-static", "packageFilename": "glibc-static-2.17-78.el7.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-static", "packageFilename": "glibc-static-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "nscd", "packageFilename": "nscd-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-78.el7.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-common", "packageFilename": "glibc-common-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.17-78.el7.ppc64.rpm", "arch": "ppc64", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-78.el7.s390.rpm", "arch": "s390", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-debuginfo-common", "packageFilename": "glibc-debuginfo-common-2.17-78.el7.s390.rpm", "arch": "s390", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-static", "packageFilename": "glibc-static-2.17-78.el7.s390.rpm", "arch": "s390", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-static", "packageFilename": "glibc-static-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-common", "packageFilename": "glibc-common-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "nscd", "packageFilename": "nscd-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-headers", "packageFilename": "glibc-headers-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-78.el7.s390.rpm", "arch": "s390", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "7", "packageVersion": "2.17-78.el7", "packageName": "glibc", "packageFilename": "glibc-2.17-78.el7.s390.rpm", "arch": "s390", "operator": "lt"}], "description": "The glibc packages provide the standard C libraries (libc), POSIX thread\nlibraries (libpthread), standard math libraries (libm), and the Name Server\nCaching Daemon (nscd) used by multiple programs on the system. Without\nthese libraries, the Linux system cannot function correctly.\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function\nconverted certain encoded data to UTF-8. An attacker able to make an\napplication call the iconv() function with a specially crafted argument\ncould use this flaw to crash that application. (CVE-2014-6040)\n\nIt was found that the files back end of Name Service Switch (NSS) did not\nisolate iteration over an entire database from key-based look-up API calls.\nAn application performing look-ups on a database while iterating over it\ncould enter an infinite loop, leading to a denial of service.\n(CVE-2014-8121)\n\nThis update also fixes the following bugs:\n\n* Due to problems with buffer extension and reallocation, the nscd daemon\nterminated unexpectedly with a segmentation fault when processing long\nnetgroup entries. With this update, the handling of long netgroup entries\nhas been corrected and nscd no longer crashes in the described scenario.\n(BZ#1138520)\n\n* If a file opened in append mode was truncated with the ftruncate()\nfunction, a subsequent ftell() call could incorrectly modify the file\noffset. This update ensures that ftell() modifies the stream state only\nwhen it is in append mode and the buffer for the stream is not empty.\n(BZ#1156331)\n\n* A defect in the C library headers caused builds with older compilers to\ngenerate incorrect code for the btowc() function in the older compatibility C++\nstandard library. Applications calling btowc() in the compatibility C++ standard\nlibrary became unresponsive. With this update, the C library headers have been\ncorrected, and the compatibility C++ standard library shipped with Red Hat\nEnterprise Linux has been rebuilt. Applications that rely on the compatibility\nC++ standard library no longer hang when calling btowc(). (BZ#1120490)\n\n* Previously, when using netgroups and the nscd daemon was set up to cache\nnetgroup information, the sudo utility denied access to valid users. The bug in\nnscd has been fixed, and sudo now works in netgroups as\nexpected. (BZ#1080766)\n\nUsers of glibc are advised to upgrade to these updated packages, which fix these\nissues.\n", "reporter": "RedHat", "published": "2015-03-05T05:00:00", "type": "redhat", "title": "(RHSA-2015:0327) Moderate: glibc security and bug fix update", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "_object_type": "robots.models.redhat.RedHatBulletin", "modified": "2018-04-12T03:33:28", "id": "RHSA-2015:0327", "href": "https://access.redhat.com/errata/RHSA-2015:0327", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "amazon": [{"lastseen": "2016-09-28T21:04:12", "references": [], "affectedPackage": [{"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-headers-2.17-55.139.amzn1.i686", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-debuginfo-2.17-55.139.amzn1.i686", "packageName": "glibc-debuginfo", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "nscd-2.17-55.139.amzn1.x86_64", "packageName": "nscd", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-debuginfo-common-2.17-55.139.amzn1.i686", "packageName": "glibc-debuginfo-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "src", "packageFilename": "glibc-2.17-55.139.amzn1.src", "packageName": "glibc", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-2.17-55.139.amzn1.x86_64", "packageName": "glibc", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-common-2.17-55.139.amzn1.x86_64", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-static-2.17-55.139.amzn1.i686", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-common-2.17-55.139.amzn1.i686", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-2.17-55.139.amzn1.i686", "packageName": "glibc", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-devel-2.17-55.139.amzn1.x86_64", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-debuginfo-common-2.17-55.139.amzn1.x86_64", "packageName": "glibc-debuginfo-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-devel-2.17-55.139.amzn1.i686", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-debuginfo-2.17-55.139.amzn1.x86_64", "packageName": "glibc-debuginfo", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "nscd-2.17-55.139.amzn1.i686", "packageName": "nscd", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-headers-2.17-55.139.amzn1.x86_64", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "i686", "packageFilename": "glibc-utils-2.17-55.139.amzn1.i686", "packageName": "glibc-utils", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-static-2.17-55.139.amzn1.x86_64", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.139", "arch": "x86_64", "packageFilename": "glibc-utils-2.17-55.139.amzn1.x86_64", "packageName": "glibc-utils", "operator": "lt"}], "edition": 1, "description": "**Issue Overview:**\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. ([CVE-2014-6040 __](<https://access.redhat.com/security/cve/CVE-2014-6040>))\n\nIt was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. ([CVE-2014-8121 __](<https://access.redhat.com/security/cve/CVE-2014-8121>))\n\n \n**Affected Packages:** \n\n\nglibc\n\n \n**Issue Correction:** \nRun _yum update glibc_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n glibc-2.17-55.139.amzn1.i686 \n glibc-common-2.17-55.139.amzn1.i686 \n glibc-static-2.17-55.139.amzn1.i686 \n glibc-devel-2.17-55.139.amzn1.i686 \n glibc-headers-2.17-55.139.amzn1.i686 \n glibc-debuginfo-common-2.17-55.139.amzn1.i686 \n glibc-debuginfo-2.17-55.139.amzn1.i686 \n glibc-utils-2.17-55.139.amzn1.i686 \n nscd-2.17-55.139.amzn1.i686 \n \n src: \n glibc-2.17-55.139.amzn1.src \n \n x86_64: \n glibc-debuginfo-2.17-55.139.amzn1.x86_64 \n glibc-devel-2.17-55.139.amzn1.x86_64 \n glibc-headers-2.17-55.139.amzn1.x86_64 \n nscd-2.17-55.139.amzn1.x86_64 \n glibc-common-2.17-55.139.amzn1.x86_64 \n glibc-2.17-55.139.amzn1.x86_64 \n glibc-static-2.17-55.139.amzn1.x86_64 \n glibc-utils-2.17-55.139.amzn1.x86_64 \n glibc-debuginfo-common-2.17-55.139.amzn1.x86_64 \n \n \n", "reporter": "Amazon", "published": "2015-03-23T08:30:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "type": "amazon", "title": "Medium: glibc", "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-8121"], "modified": "2015-03-23T08:55:00", "id": "ALAS-2015-495", "href": "https://alas.aws.amazon.com/ALAS-2015-495.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2016-09-28T21:04:03", "references": ["https://rhn.redhat.com/errata/RHSA-2015-0016.html"], "affectedPackage": [{"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-debuginfo-common-2.17-55.92.amzn1.x86_64", "packageName": "glibc-debuginfo-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-static-2.17-55.92.amzn1.x86_64", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-debuginfo-common-2.17-55.92.amzn1.i686", "packageName": "glibc-debuginfo-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-2.17-55.92.amzn1.i686", "packageName": "glibc", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-devel-2.17-55.92.amzn1.i686", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-debuginfo-2.17-55.92.amzn1.x86_64", "packageName": "glibc-debuginfo", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-devel-2.17-55.92.amzn1.x86_64", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-static-2.17-55.92.amzn1.i686", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-debuginfo-2.17-55.92.amzn1.i686", "packageName": "glibc-debuginfo", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "nscd-2.17-55.92.amzn1.i686", "packageName": "nscd", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-common-2.17-55.92.amzn1.i686", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-common-2.17-55.92.amzn1.x86_64", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-headers-2.17-55.92.amzn1.x86_64", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-utils-2.17-55.92.amzn1.i686", "packageName": "glibc-utils", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-2.17-55.92.amzn1.x86_64", "packageName": "glibc", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "i686", "packageFilename": "glibc-headers-2.17-55.92.amzn1.i686", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "src", "packageFilename": "glibc-2.17-55.92.amzn1.src", "packageName": "glibc", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "nscd-2.17-55.92.amzn1.x86_64", "packageName": "nscd", "operator": "lt"}, {"OS": "Amazon Linux", "OSVersion": "any", "packageVersion": "2.17-55.92", "arch": "x86_64", "packageFilename": "glibc-utils-2.17-55.92.amzn1.x86_64", "packageName": "glibc-utils", "operator": "lt"}], "edition": 1, "description": "**Issue Overview:**\n\nAn out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. ([CVE-2014-6040 __](<https://access.redhat.com/security/cve/CVE-2014-6040>))\n\nIt was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. ([CVE-2014-7817 __](<https://access.redhat.com/security/cve/CVE-2014-7817>))\n\n \n**Affected Packages:** \n\n\nglibc\n\n \n**Issue Correction:** \nRun _yum update glibc_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n glibc-common-2.17-55.92.amzn1.i686 \n glibc-devel-2.17-55.92.amzn1.i686 \n glibc-debuginfo-2.17-55.92.amzn1.i686 \n glibc-utils-2.17-55.92.amzn1.i686 \n glibc-debuginfo-common-2.17-55.92.amzn1.i686 \n nscd-2.17-55.92.amzn1.i686 \n glibc-static-2.17-55.92.amzn1.i686 \n glibc-headers-2.17-55.92.amzn1.i686 \n glibc-2.17-55.92.amzn1.i686 \n \n src: \n glibc-2.17-55.92.amzn1.src \n \n x86_64: \n glibc-2.17-55.92.amzn1.x86_64 \n glibc-utils-2.17-55.92.amzn1.x86_64 \n nscd-2.17-55.92.amzn1.x86_64 \n glibc-headers-2.17-55.92.amzn1.x86_64 \n glibc-static-2.17-55.92.amzn1.x86_64 \n glibc-debuginfo-2.17-55.92.amzn1.x86_64 \n glibc-debuginfo-common-2.17-55.92.amzn1.x86_64 \n glibc-common-2.17-55.92.amzn1.x86_64 \n glibc-devel-2.17-55.92.amzn1.x86_64 \n \n \n", "reporter": "Amazon", "published": "2015-01-08T12:38:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "amazon", "title": "Medium: glibc", "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2015-01-08T12:40:00", "id": "ALAS-2015-468", "href": "https://alas.aws.amazon.com/ALAS-2015-468.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "oraclelinux": [{"lastseen": "2018-08-31T01:43:40", "references": [], "affectedPackage": [{"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "glibc-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-utils", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "nscd-2.12-1.149.el6_6.4.i686.rpm", "packageName": "nscd", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-common-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "glibc-headers-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "src", "packageFilename": "glibc-2.12-1.149.el6_6.4.src.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "src", "packageFilename": "glibc-2.12-1.149.el6_6.4.src.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "glibc-utils-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "glibc-utils", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-static-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "x86_64", "packageFilename": "nscd-2.12-1.149.el6_6.4.x86_64.rpm", "packageName": "nscd", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "6", "packageVersion": "2.12-1.149.el6_6.4", "arch": "i686", "packageFilename": "glibc-devel-2.12-1.149.el6_6.4.i686.rpm", "packageName": "glibc-devel", "operator": "lt"}], "description": "[2.12-1.149.4]\n- Fix recursive dlopen() (#1173469).\n[2.12-1.149.3]\n- Fix typo in res_send and res_query (#rh1172023).\n[2.12-1.149.2]\n- Fix crashes on invalid input in IBM gconv modules (CVE-2014-6040, #1139571).\n[2.12-1.149.1]\n- Fix wordexp() to honour WRDE_NOCMD (CVE-2014-7817, #1170121).", "edition": 3, "reporter": "Oracle", "published": "2015-01-07T00:00:00", "title": "glibc security and bug fix update", "type": "oraclelinux", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-7817"], "modified": "2015-01-07T00:00:00", "id": "ELSA-2015-0016", "href": "http://linux.oracle.com/errata/ELSA-2015-0016.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T01:48:41", "references": [], "affectedPackage": [{"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "i686", "packageFilename": "glibc-static-2.17-78.0.1.el7.i686.rpm", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "glibc-static-2.17-78.0.1.el7.x86_64.rpm", "packageName": "glibc-static", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "src", "packageFilename": "glibc-2.17-78.0.1.el7.src.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "i686", "packageFilename": "glibc-2.17-78.0.1.el7.i686.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "glibc-devel-2.17-78.0.1.el7.x86_64.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "glibc-common-2.17-78.0.1.el7.x86_64.rpm", "packageName": "glibc-common", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "glibc-headers-2.17-78.0.1.el7.x86_64.rpm", "packageName": "glibc-headers", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "i686", "packageFilename": "glibc-devel-2.17-78.0.1.el7.i686.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "nscd-2.17-78.0.1.el7.x86_64.rpm", "packageName": "nscd", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "glibc-2.17-78.0.1.el7.x86_64.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "Oracle Linux", "OSVersion": "7", "packageVersion": "2.17-78.0.1.el7", "arch": "x86_64", "packageFilename": "glibc-utils-2.17-78.0.1.el7.x86_64.rpm", "packageName": "glibc-utils", "operator": "lt"}], "description": "[2.17-78.0.1]\n- Remove strstr and strcasestr implementations using sse4.2 instructions.\n- Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and\n 1818483b15d22016b0eae41d37ee91cc87b37510 backported.\n[2.17-78]\n- Fix ppc64le builds (#1077389).\n[2.17-77]\n- Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183545).\n[2.17-76]\n- Fix application crashes during calls to gettimeofday on ppc64\n when kernel exports gettimeofday via VDSO (#1077389).\n- Prevent NSS-based file backend from entering infinite loop\n when different APIs request the same service (CVE-2014-8121, #1182272).\n[2.17-75]\n- Fix permission of debuginfo source files to allow multiarch\n debuginfo packages to be installed and upgraded (#1170110).\n[2.17-74]\n- Fix wordexp() to honour WRDE_NOCMD (CVE-2014-7817, #1170487).\n[2.17-73]\n- ftell: seek to end only when there are unflushed bytes (#1156331).\n[2.17-72]\n- [s390] Fix up _dl_argv after adjusting arguments in _dl_start_user (#1161666).\n[2.17-71]\n- Fix incorrect handling of relocations in 64-bit LE mode for Power\n (#1162847).\n[2.17-70]\n- [s390] Retain stack alignment when skipping over loader argv (#1161666).\n[2.17-69]\n- Use __int128_t in link.h to support older compiler (#1120490).\n[2.17-68]\n- Revert to defining __extern_inline only for gcc-4.3+ (#1120490).\n[2.17-67]\n- Correct a defect in the generated math error table in the manual (#786638).\n[2.17-66]\n- Include preliminary thread, signal and cancellation safety documentation\n in manual (#786638).\n[2.17-65]\n- PowerPC 32-bit and 64-bit optimized function support using STT_GNU_IFUNC\n (#731837).\n- Support running Intel MPX-enabled applications (#1132518).\n- Support running Intel AVX-512-enabled applications (#1140272).\n[2.17-64]\n- Fix crashes on invalid input in IBM gconv modules (#1140474, CVE-2014-6040).\n[2.17-63]\n- Build build-locale-archive statically (#1070611).\n- Return failure in getnetgrent only when all netgroups have been searched\n (#1085313).\n[2.17-62]\n- Don't use alloca in addgetnetgrentX (#1138520).\n- Adjust pointers to triplets in netgroup query data (#1138520).\n[2.17-61]\n- Set CS_PATH to just /use/bin (#1124453).\n- Add systemtap probe in lll_futex_wake for ppc and s390 (#1084089).\n[2.17-60]\n- Add mmap usage to malloc_info output (#1103856).\n- Fix nscd lookup for innetgr when netgroup has wildcards (#1080766).\n- Fix memory order when reading libgcc handle (#1103874).\n- Fix typo in nscd/selinux.c (#1125306).\n- Do not fail if one of the two responses to AF_UNSPEC fails (#1098047).\n[2.17-59]\n- Provide correct buffer length to netgroup queries in nscd (#1083647).\n- Return NULL for wildcard values in getnetgrent from nscd (#1085290).\n- Avoid overlapping addresses to stpcpy calls in nscd (#1083644).\n- Initialize all of datahead structure in nscd (#1083646).\n[2.17-58]\n- Remove gconv transliteration loadable modules support (CVE-2014-5119,\n - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,\n[2.17-57]\n- Merge 64-bit ARM (AArch64) support (#1027179).\n- Fix build failure for rtkaio/tst-aiod2.c and rtkaio/tst-aiod3.c.\n[2.17-56]\n- Merge LE 64-bit POWER support (#1125513).\n[2.17-55.4]\n- Fix tst-cancel4, tst-cancelx4, tst-cancel5, and tst-cancelx5 for all targets.\n- Fix tst-ildoubl, and tst-ldouble for POWER.\n- Allow LE 64-bit POWER to build with VSX if enabled (#1124048).\n[2.17-55.3]\n- Fix ppc64le ABI issue with pthread_atfork being present in libpthread.so.0.\n[2.17-55.2]\n- Add ABI baseline for 64-bit POWER LE.\n[2.17-55.1]\n- Add 64-bit POWER LE support.", "edition": 3, "reporter": "Oracle", "published": "2015-03-09T00:00:00", "title": "glibc security and bug fix update", "type": "oraclelinux", "enchantments": {"score": {"vector": "NONE", "value": 4.3}}, "bulletinFamily": "unix", "cvelist": ["CVE-2015-0235", "CVE-2014-5119", "CVE-2014-6040", "CVE-2014-8121", "CVE-2014-7817", "CVE-2014-0475"], "modified": "2015-03-09T00:00:00", "id": "ELSA-2015-0327", "href": "http://linux.oracle.com/errata/ELSA-2015-0327.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "suse": [{"lastseen": "2016-09-04T11:17:43", "references": ["https://bugzilla.novell.com/894553", "https://bugzilla.novell.com/892073", "https://bugzilla.novell.com/887022"], "affectedPackage": [{"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-extra-debuginfo", "packageFilename": "glibc-extra-debuginfo-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils-debugsource", "packageFilename": "glibc-utils-debugsource-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-extra", "packageFilename": "glibc-extra-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-static", "packageFilename": "glibc-devel-static-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-obsolete", "packageFilename": "glibc-obsolete-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-obsolete-debuginfo", "packageFilename": "glibc-obsolete-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc", "packageFilename": "glibc-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "nscd", "packageFilename": "nscd-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-static", "packageFilename": "glibc-devel-static-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-32bit", "packageFilename": "glibc-devel-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-info", "packageFilename": "glibc-info-2.18-4.21.1.noarch.rpm", "arch": "noarch", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils-debuginfo-32bit", "packageFilename": "glibc-utils-debuginfo-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-info", "packageFilename": "glibc-info-2.17-4.13.1.noarch.rpm", "arch": "noarch", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debugsource", "packageFilename": "glibc-debugsource-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "nscd", "packageFilename": "nscd-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "nscd", "packageFilename": "nscd-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale-32bit", "packageFilename": "glibc-locale-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-debuginfo", "packageFilename": "glibc-devel-debuginfo-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "nscd-debuginfo", "packageFilename": "nscd-debuginfo-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-obsolete", "packageFilename": "glibc-obsolete-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "nscd-debuginfo", "packageFilename": "nscd-debuginfo-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debuginfo-32bit", "packageFilename": "glibc-debuginfo-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-profile-32bit", "packageFilename": "glibc-profile-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-static", "packageFilename": "glibc-devel-static-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "nscd-debuginfo", "packageFilename": "nscd-debuginfo-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-32bit", "packageFilename": "glibc-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-32bit", "packageFilename": "glibc-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale-debuginfo-32bit", "packageFilename": "glibc-locale-debuginfo-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale-debuginfo", "packageFilename": "glibc-locale-debuginfo-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-i18ndata", "packageFilename": "glibc-i18ndata-2.18-4.21.1.noarch.rpm", "arch": "noarch", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-html", "packageFilename": "glibc-html-2.18-4.21.1.noarch.rpm", "arch": "noarch", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils-debuginfo", "packageFilename": "glibc-utils-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-debuginfo", "packageFilename": "glibc-devel-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debugsource", "packageFilename": "glibc-debugsource-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale-debuginfo", "packageFilename": "glibc-locale-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-extra", "packageFilename": "glibc-extra-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "nscd-debuginfo", "packageFilename": "nscd-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debugsource", "packageFilename": "glibc-debugsource-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debuginfo-32bit", "packageFilename": "glibc-debuginfo-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils-32bit", "packageFilename": "glibc-utils-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-debuginfo", "packageFilename": "glibc-devel-debuginfo-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale-debuginfo-32bit", "packageFilename": "glibc-locale-debuginfo-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-debuginfo", "packageFilename": "glibc-devel-debuginfo-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc", "packageFilename": "glibc-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale-debuginfo", "packageFilename": "glibc-locale-debuginfo-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc", "packageFilename": "glibc-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-obsolete-debuginfo", "packageFilename": "glibc-obsolete-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "nscd", "packageFilename": "nscd-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "nscd", "packageFilename": "nscd-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils-debugsource", "packageFilename": "glibc-utils-debugsource-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc", "packageFilename": "glibc-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc", "packageFilename": "glibc-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-debuginfo", "packageFilename": "glibc-devel-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils-debugsource", "packageFilename": "glibc-utils-debugsource-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debugsource", "packageFilename": "glibc-debugsource-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-extra", "packageFilename": "glibc-extra-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-extra", "packageFilename": "glibc-extra-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-debuginfo-32bit", "packageFilename": "glibc-devel-debuginfo-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-obsolete-debuginfo", "packageFilename": "glibc-obsolete-debuginfo-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-extra-debuginfo", "packageFilename": "glibc-extra-debuginfo-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-i18ndata", "packageFilename": "glibc-i18ndata-2.17-4.13.1.noarch.rpm", "arch": "noarch", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-obsolete", "packageFilename": "glibc-obsolete-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils", "packageFilename": "glibc-utils-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-extra", "packageFilename": "glibc-extra-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils-debugsource", "packageFilename": "glibc-utils-debugsource-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-extra-debuginfo", "packageFilename": "glibc-extra-debuginfo-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-static-32bit", "packageFilename": "glibc-devel-static-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-extra", "packageFilename": "glibc-extra-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale-32bit", "packageFilename": "glibc-locale-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-static", "packageFilename": "glibc-devel-static-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-extra-debuginfo", "packageFilename": "glibc-extra-debuginfo-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils-debuginfo", "packageFilename": "glibc-utils-debuginfo-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "nscd-debuginfo", "packageFilename": "nscd-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-32bit", "packageFilename": "glibc-devel-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils-32bit", "packageFilename": "glibc-utils-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale-debuginfo", "packageFilename": "glibc-locale-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils-debuginfo", "packageFilename": "glibc-utils-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "nscd-debuginfo", "packageFilename": "nscd-debuginfo-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-obsolete-debuginfo", "packageFilename": "glibc-obsolete-debuginfo-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debuginfo", "packageFilename": "glibc-debuginfo-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-debuginfo-32bit", "packageFilename": "glibc-devel-debuginfo-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel-debuginfo", "packageFilename": "glibc-devel-debuginfo-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc", "packageFilename": "glibc-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debugsource", "packageFilename": "glibc-debugsource-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-extra-debuginfo", "packageFilename": "glibc-extra-debuginfo-2.17-4.13.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-obsolete", "packageFilename": "glibc-obsolete-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-profile-32bit", "packageFilename": "glibc-profile-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-locale-debuginfo", "packageFilename": "glibc-locale-debuginfo-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-debugsource", "packageFilename": "glibc-debugsource-2.17-4.13.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-extra-debuginfo", "packageFilename": "glibc-extra-debuginfo-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-static", "packageFilename": "glibc-devel-static-2.18-4.21.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "nscd", "packageFilename": "nscd-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-html", "packageFilename": "glibc-html-2.17-4.13.1.noarch.rpm", "arch": "noarch", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-utils-debuginfo", "packageFilename": "glibc-utils-debuginfo-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-locale-debuginfo", "packageFilename": "glibc-locale-debuginfo-2.18-4.21.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "12.3", "packageVersion": "2.17-4.13.1", "packageName": "glibc-utils-debuginfo-32bit", "packageFilename": "glibc-utils-debuginfo-32bit-2.17-4.13.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-static-32bit", "packageFilename": "glibc-devel-static-32bit-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "13.1", "packageVersion": "2.18-4.21.1", "packageName": "glibc-devel-static", "packageFilename": "glibc-devel-static-2.18-4.21.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}], "description": "glibc was updated to fix three security issues:\n\n - A directory traversal in locale environment handling was fixed\n (CVE-2014-0475, bnc#887022, GLIBC BZ #17137)\n\n - Disable gconv transliteration module loading which could be used for\n code execution (CVE-2014-5119, bnc#892073, GLIBC BZ #17187)\n\n - Fix crashes on invalid input in IBM gconv modules (CVE-2014-6040,\n bnc#894553, BZ #17325)\n\n", "edition": 1, "reporter": "Suse", "published": "2014-09-11T09:04:39", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "type": "suse", "title": "glibc (important)", "bulletinFamily": "unix", "cvelist": ["CVE-2014-5119", "CVE-2014-6040", "CVE-2014-0475"], "modified": "2014-09-11T09:04:39", "id": "OPENSUSE-SU-2014:1115-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00009.html", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2016-09-04T12:14:55", "references": ["https://bugzilla.novell.com/894553", "https://bugzilla.novell.com/836746", "https://bugzilla.novell.com/844309", "https://bugzilla.novell.com/894556", "https://bugzilla.novell.com/892073", "http://download.suse.com/patch/finder/?keywords=cd8403453563e9d5a949d2219d62a993"], "affectedPackage": [{"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-i18ndata", "packageFilename": "glibc-i18ndata-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-32bit", "packageFilename": "glibc-32bit-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "nscd", "packageFilename": "nscd-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-html", "packageFilename": "glibc-html-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-locale-32bit", "packageFilename": "glibc-locale-32bit-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-profile-32bit", "packageFilename": "glibc-profile-32bit-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "nscd", "packageFilename": "nscd-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-32bit", "packageFilename": "glibc-32bit-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-i18ndata", "packageFilename": "glibc-i18ndata-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-profile-32bit", "packageFilename": "glibc-profile-32bit-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-profile", "packageFilename": "glibc-profile-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "nscd", "packageFilename": "nscd-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-info", "packageFilename": "glibc-info-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc", "packageFilename": "glibc-2.11.3-17.45.53.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-html", "packageFilename": "glibc-html-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-devel-32bit", "packageFilename": "glibc-devel-32bit-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-html", "packageFilename": "glibc-html-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc", "packageFilename": "glibc-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-i18ndata", "packageFilename": "glibc-i18ndata-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-locale", "packageFilename": "glibc-locale-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.11.3-17.45.53.1.i686.rpm", "arch": "i686", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc", "packageFilename": "glibc-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-info", "packageFilename": "glibc-info-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-devel", "packageFilename": "glibc-devel-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-info", "packageFilename": "glibc-info-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-devel-32bit", "packageFilename": "glibc-devel-32bit-2.11.3-17.45.53.1.s390x.rpm", "arch": "s390x", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc", "packageFilename": "glibc-2.11.3-17.45.53.1.i586.rpm", "arch": "i586", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "11.2", "packageVersion": "2.11.3-17.45.53.1", "packageName": "glibc-locale-32bit", "packageFilename": "glibc-locale-32bit-2.11.3-17.45.53.1.x86_64.rpm", "arch": "x86_64", "operator": "lt"}], "description": "This glibc update fixes a critical privilege escalation problem and two\n additional issues:\n\n * bnc#892073: An off-by-one error leading to a heap-based buffer\n overflow was found in __gconv_translit_find(). An exploit that\n targets the problem is publicly available. (CVE-2014-5119)\n * bnc#836746: Avoid race between {, __de}allocate_stack and\n __reclaim_stacks during fork.\n * bnc#844309: Fixed various overflows, reading large /etc/hosts or\n long names. (CVE-2013-4357)\n * bnc#894553, bnc#894556: Fixed various crashes on invalid input in\n IBM gconv modules. (CVE-2014-6040, CVE-2012-6656)\n\n Security Issues:\n\n * CVE-2012-6656\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6656\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6656</a>&gt;\n * CVE-2013-4357\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4357\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4357</a>&gt;\n * CVE-2014-5119\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119</a>&gt;\n * CVE-2014-6040\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6040\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6040</a>&gt;\n\n", "edition": 1, "reporter": "Suse", "published": "2014-09-15T19:06:41", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "suse", "title": "Security update for glibc (important)", "bulletinFamily": "unix", "cvelist": ["CVE-2014-5119", "CVE-2014-6040", "CVE-2013-4357", "CVE-2012-6656"], "modified": "2014-09-15T19:06:41", "id": "SUSE-SU-2014:1129-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00020.html", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2016-09-04T11:57:20", "references": ["https://bugzilla.novell.com/894553", "https://bugzilla.novell.com/834594", "https://bugzilla.novell.com/860501", "https://bugzilla.novell.com/801246", "https://bugzilla.novell.com/882600", "https://bugzilla.novell.com/779320", "https://bugzilla.novell.com/842291", "https://bugzilla.novell.com/824639", "http://download.suse.com/patch/finder/?keywords=190862be14e3ed91b361e0b0a66e292a", "https://bugzilla.novell.com/839870", "https://bugzilla.novell.com/894556", "https://bugzilla.novell.com/892073"], "affectedPackage": [{"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "nscd-2.4-31.77.112.1.s390x.rpm", "packageName": "nscd", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-profile-2.4-31.77.112.1.i586.rpm", "packageName": "glibc-profile", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-html-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-html", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i686", "packageFilename": "glibc-devel-2.4-31.77.112.1.i686.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-locale-32bit-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-locale-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-info-2.4-31.77.112.1.i586.rpm", "packageName": "glibc-info", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-profile-32bit-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-profile-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-locale-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-locale", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-32bit-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-locale-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-locale", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i686", "packageFilename": "glibc-2.4-31.77.112.1.i686.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-devel-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-info-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-info", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-i18ndata-2.4-31.77.112.1.i586.rpm", "packageName": "glibc-i18ndata", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-devel-32bit-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-devel-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-devel-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-devel", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-devel-32bit-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-devel-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-profile-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-profile", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-profile-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-profile", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-i18ndata-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-i18ndata", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-locale-32bit-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-locale-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "nscd-2.4-31.77.112.1.x86_64.rpm", "packageName": "nscd", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-locale-2.4-31.77.112.1.i586.rpm", "packageName": "glibc-locale", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-2.4-31.77.112.1.i586.rpm", "packageName": "glibc", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-html-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-html", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-html-2.4-31.77.112.1.i586.rpm", "packageName": "glibc-html", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-info-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-info", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-32bit-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "x86_64", "packageFilename": "glibc-i18ndata-2.4-31.77.112.1.x86_64.rpm", "packageName": "glibc-i18ndata", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "nscd-2.4-31.77.112.1.i586.rpm", "packageName": "nscd", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "s390x", "packageFilename": "glibc-profile-32bit-2.4-31.77.112.1.s390x.rpm", "packageName": "glibc-profile-32bit", "operator": "lt"}, {"OS": "SUSE Linux Enterprise Server LTSS", "OSVersion": "10.3", "packageVersion": "2.4-31.77.112.1", "arch": "i586", "packageFilename": "glibc-devel-2.4-31.77.112.1.i586.rpm", "packageName": "glibc-devel", "operator": "lt"}], "description": "This glibc update fixes a critical privilege escalation problem and the\n following security and non-security issues:\n\n * bnc#892073: An off-by-one error leading to a heap-based buffer\n overflow was found in __gconv_translit_find(). An exploit that\n targets the problem is publicly available. (CVE-2014-5119)\n * bnc#882600: Copy filename argument in\n posix_spawn_file_actions_addopen. (CVE-2014-4043)\n * bnc#860501: Use O_LARGEFILE for utmp file.\n * bnc#842291: Fix typo in glibc-2.5-dlopen-lookup-race.diff.\n * bnc#839870: Fix integer overflows in malloc. (CVE-2013-4332)\n * bnc#834594: Fix readdir_r with long file names. (CVE-2013-4237)\n * bnc#824639: Drop lock before calling malloc_printerr.\n * bnc#801246: Fix buffer overrun in regexp matcher. (CVE-2013-0242)\n * bnc#779320: Fix buffer overflow in strcoll. (CVE-2012-4412)\n * bnc#894556 / bnc#894553: Fix crashes on invalid input in IBM gconv\n modules. (CVE-2014-6040, CVE-2012-6656, bnc#894553, bnc#894556,\n BZ#17325, BZ#14134)\n\n Security Issues:\n\n * CVE-2014-5119\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119</a>&gt;\n * CVE-2014-4043\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043</a>&gt;\n * CVE-2013-4332\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332</a>&gt;\n * CVE-2013-4237\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237</a>&gt;\n * CVE-2013-0242\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242</a>&gt;\n * CVE-2012-4412\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412</a>&gt;\n\n\n", "edition": 1, "reporter": "Suse", "published": "2014-09-15T19:04:18", "title": "Security update for glibc (important)", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "suse", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0242", "CVE-2014-5119", "CVE-2014-4043", "CVE-2014-6040", "CVE-2012-4412", "CVE-2013-4332", "CVE-2012-6656", "CVE-2013-4237"], "modified": "2014-09-15T19:04:18", "id": "SUSE-SU-2014:1128-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00019.html", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "debian": [{"lastseen": "2018-07-04T01:37:12", "references": [], "affectedPackage": [{"OS": "Debian GNU/Linux", "OSVersion": "6", "packageVersion": "2.11.3-4+deb6u2", "arch": "all", "packageFilename": "eglibc_2.11.3-4+deb6u2_all.deb", "packageName": "eglibc", "operator": "lt"}], "description": "* [CVE-2012-6656](<https://security-tracker.debian.org/tracker/CVE-2012-6656>)\n\nFix validation check when converting from ibm930 to utf. When converting IBM930 code with iconv(), if IBM930 code which includes invalid multibyte character 0xffff is specified, then iconv() segfaults.\n\n * [CVE-2014-6040](<https://security-tracker.debian.org/tracker/CVE-2014-6040>)\n\nCrashes on invalid input in IBM gconv modules [BZ #17325] These changes are based on the fix for BZ #14134 in commit 6e230d11837f3ae7b375ea69d7905f0d18eb79e5.\n\n * [CVE-2014-7817](<https://security-tracker.debian.org/tracker/CVE-2014-7817>)\n\nThe function wordexp() fails to properly handle the WRDE_NOCMD flag when processing arithmetic inputs in the form of \"$((... ``))\" where \"...\" can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDE_NOCMD forbade command substitution. This allows an attacker to attempt to pass dangerous commands via constructs of the above form, and bypass the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD in exec_comm(), the only place that can execute a shell. All other checks for WRDE_NOCMD are superfluous and removed.\n\nFor Debian 6 Squeeze, these issues have been fixed in eglibc version 2.11.3-4+deb6u2", "edition": 1, "reporter": "Debian", "published": "2014-11-29T00:00:00", "title": "eglibc -- LTS security update", "type": "debian", "enchantments": {"score": {"modified": "2018-07-04T01:37:12", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-7817", "CVE-2012-6656"], "modified": "2014-11-29T00:00:00", "id": "DLA-97", "href": "http://www.debian.org/security/2014/dla-97", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2016-09-02T18:24:07", "references": [], "affectedPackage": [{"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc-bin_2.13-38+deb7u7_all.deb", "packageName": "libc-bin", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-pic_2.13-38+deb7u7_all.deb", "packageName": "libc6-pic", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "glibc-doc_2.13-38+deb7u7_all.deb", "packageName": "glibc-doc", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-xen_2.13-38+deb7u7_all.deb", "packageName": "libc6-xen", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-prof_2.13-38+deb7u7_all.deb", "packageName": "libc6-prof", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc-dev-bin_2.13-38+deb7u7_all.deb", "packageName": "libc-dev-bin", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "nscd_2.13-38+deb7u7_all.deb", "packageName": "nscd", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-dbg_2.13-38+deb7u7_all.deb", "packageName": "libc6-dbg", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-amd64_2.13-38+deb7u7_all.deb", "packageName": "libc6-amd64", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6_2.13-38+deb7u7_all.deb", "packageName": "libc6", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-dev-i386_2.13-38+deb7u7_all.deb", "packageName": "libc6-dev-i386", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "eglibc_2.13-38+deb7u7_all.deb", "packageName": "eglibc", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "locales_2.13-38+deb7u7_all.deb", "packageName": "locales", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "multiarch-support_2.13-38+deb7u7_all.deb", "packageName": "multiarch-support", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-dev-amd64_2.13-38+deb7u7_all.deb", "packageName": "libc6-dev-amd64", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-i386_2.13-38+deb7u7_all.deb", "packageName": "libc6-i386", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "eglibc-source_2.13-38+deb7u7_all.deb", "packageName": "eglibc-source", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "locales-all_2.13-38+deb7u7_all.deb", "packageName": "locales-all", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-dev_2.13-38+deb7u7_all.deb", "packageName": "libc6-dev", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "7", "packageVersion": "2.13-38+deb7u7", "arch": "all", "packageFilename": "libc6-i686_2.13-38+deb7u7_all.deb", "packageName": "libc6-i686", "operator": "lt"}], "description": "Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library:\n\n * [CVE-2015-0235](<https://security-tracker.debian.org/tracker/CVE-2015-0235>)\n\nQualys discovered that the gethostbyname and gethostbyname2 functions were subject to a buffer overflow if provided with a crafted IP address argument. This could be used by an attacker to execute arbitrary code in processes which called the affected functions.\n\nThe original glibc bug was reported by Peter Klotz.\n\n * [CVE-2014-7817](<https://security-tracker.debian.org/tracker/CVE-2014-7817>)\n\nTim Waugh of Red Hat discovered that the WRDE_NOCMD option of the wordexp function did not suppress command execution in all cases. This allows a context-dependent attacker to execute shell commands.\n\n * [CVE-2012-6656](<https://security-tracker.debian.org/tracker/CVE-2012-6656>) [CVE-2014-6040](<https://security-tracker.debian.org/tracker/CVE-2014-6040>)\n\nThe charset conversion code for certain IBM multi-byte code pages could perform an out-of-bounds array access, causing the process to crash. In some scenarios, this allows a remote attacker to cause a persistent denial of service.\n\nFor the stable distribution (wheezy), these problems have been fixed in version 2.13-38+deb7u7.\n\nFor the upcoming stable distribution (jessie) and the unstable distribution (sid), the [CVE-2015-0235](<https://security-tracker.debian.org/tracker/CVE-2015-0235>) issue has been fixed in version 2.18-1 of the glibc package.\n\nWe recommend that you upgrade your eglibc packages.", "edition": 1, "reporter": "Debian", "published": "2015-01-27T00:00:00", "title": "eglibc -- security update", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "debian", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0235", "CVE-2014-6040", "CVE-2014-7817", "CVE-2012-6656"], "modified": "2015-01-27T00:00:00", "id": "DSA-3142", "href": "http://www.debian.org/security/dsa-3142", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:56", "references": ["https://vulners.com/securityvulns/securityvulns:doc:31067"], "description": "Off-by-one in __gconv_translit_find&#40;&#41;.", "edition": 1, "reporter": "BUGTRAQ", "published": "2014-09-01T00:00:00", "title": "GNU glibc buffer overflow", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:09:56", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "glibc", "version": "2.19", "operator": "eq"}], "cvelist": ["CVE-2014-5119", "CVE-2014-6040", "CVE-2012-6656"], "modified": "2014-09-01T00:00:00", "id": "SECURITYVULNS:VULN:13947", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13947", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "ubuntu": [{"lastseen": "2018-08-31T00:08:52", "references": ["https://people.canonical.com/~ubuntu-security/cve/CVE-2012-6656", "https://people.canonical.com/~ubuntu-security/cve/CVE-2014-6040", "https://people.canonical.com/~ubuntu-security/cve/CVE-2014-7817"], "affectedPackage": [{"OS": "Ubuntu", "OSVersion": "12.04", "packageVersion": "2.15-0ubuntu10.9", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libc6", "operator": "lt"}, {"OS": "Ubuntu", "OSVersion": "14.04", "packageVersion": "2.19-0ubuntu6.4", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libc6", "operator": "lt"}, {"OS": "Ubuntu", "OSVersion": "14.10", "packageVersion": "2.19-10ubuntu2.1", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libc6", "operator": "lt"}, {"OS": "Ubuntu", "OSVersion": "10.04", "packageVersion": "2.11.1-0ubuntu7.19", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libc6", "operator": "lt"}], "description": "Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled certain multibyte characters when using the iconv function. An attacker could possibly use this issue to cause applications to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2012-6656)\n\nAdhemerval Zanella Netto discovered that the GNU C Library incorrectly handled certain multibyte characters when using the iconv function. An attacker could possibly use this issue to cause applications to crash, resulting in a denial of service. (CVE-2014-6040)\n\nTim Waugh discovered that the GNU C Library incorrectly enforced the WRDE_NOCMD flag when handling the wordexp function. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2014-7817)", "edition": 3, "reporter": "Ubuntu", "published": "2014-12-03T00:00:00", "title": "GNU C Library vulnerabilities", "type": "ubuntu", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-6040", "CVE-2014-7817", "CVE-2012-6656"], "modified": "2014-12-03T00:00:00", "id": "USN-2432-1", "href": "https://usn.ubuntu.com/2432-1/", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "slackware": [{"lastseen": "2018-08-31T00:36:56", "references": [], "affectedPackage": [{"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "x86_64", "packageFilename": "glibc-solibs-2.17-x86_64-8_slack14.1.txz", "packageName": "glibc-solibs", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "i486", "packageFilename": "glibc-solibs-2.17-i486-8_slack14.1.txz", "packageName": "glibc-solibs", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "x86_64", "packageFilename": "glibc-2.17-x86_64-8_slack14.1.txz", "packageName": "glibc", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2014i", "arch": "noarch", "packageFilename": "glibc-zoneinfo-2014i-noarch-1_slack14.1.txz", "packageName": "glibc-zoneinfo", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2014i", "arch": "noarch", "packageFilename": "glibc-zoneinfo-2014i-noarch-1_slack14.1.txz", "packageName": "glibc-zoneinfo", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "i486", "packageFilename": "glibc-2.17-i486-8_slack14.1.txz", "packageName": "glibc", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "x86_64", "packageFilename": "glibc-i18n-2.17-x86_64-8_slack14.1.txz", "packageName": "glibc-i18n", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "i486", "packageFilename": "glibc-i18n-2.17-i486-8_slack14.1.txz", "packageName": "glibc-i18n", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "i486", "packageFilename": "glibc-profile-2.17-i486-8_slack14.1.txz", "packageName": "glibc-profile", "operator": "lt"}, {"OS": "Slackware", "OSVersion": "14.1", "packageVersion": "2.17", "arch": "x86_64", "packageFilename": "glibc-profile-2.17-x86_64-8_slack14.1.txz", "packageName": "glibc-profile", "operator": "lt"}], "description": "New glibc packages are available for Slackware 14.1 and -current to fix\nsecurity issues.\n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n\npatches/packages/glibc-2.17-i486-8_slack14.1.txz: Rebuilt.\n This update fixes several security issues, and adds an extra security\n hardening patch from Florian Weimer. Thanks to mancha for help with\n tracking and backporting patches.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4424\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4788\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4458\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0475\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6040\n (* Security fix *)\npatches/packages/glibc-i18n-2.17-i486-8_slack14.1.txz: Rebuilt.\npatches/packages/glibc-profile-2.17-i486-8_slack14.1.txz: Rebuilt.\npatches/packages/glibc-solibs-2.17-i486-8_slack14.1.txz: Rebuilt.\npatches/packages/glibc-zoneinfo-2014i-noarch-1_slack14.1.txz: Upgraded.\n Upgraded to tzcode2014i and tzdata2014i.\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the &quot;Get Slack&quot; section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated packages for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/glibc-2.17-i486-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/glibc-i18n-2.17-i486-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/glibc-profile-2.17-i486-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/glibc-solibs-2.17-i486-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/glibc-zoneinfo-2014i-noarch-1_slack14.1.txz\n\nUpdated packages for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/glibc-2.17-x86_64-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/glibc-i18n-2.17-x86_64-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/glibc-profile-2.17-x86_64-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/glibc-solibs-2.17-x86_64-8_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/glibc-zoneinfo-2014i-noarch-1_slack14.1.txz\n\nUpdated packages for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/glibc-solibs-2.20-i486-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/glibc-zoneinfo-2014i-noarch-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/glibc-2.20-i486-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/glibc-i18n-2.20-i486-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/glibc-profile-2.20-i486-1.txz\n\nUpdated packages for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/glibc-solibs-2.20-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/glibc-zoneinfo-2014i-noarch-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/glibc-2.20-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/glibc-i18n-2.20-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/glibc-profile-2.20-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.1 packages:\n8995409d8ed617125649aaab14299f61 glibc-2.17-i486-8_slack14.1.txz\n877bba4ad31eb68c7e7cce11f6aafd5b glibc-i18n-2.17-i486-8_slack14.1.txz\nf89a9319a1798771b26488e99f0dd1af glibc-profile-2.17-i486-8_slack14.1.txz\nd1756f2721cbb2955152c46ef5fab72e glibc-solibs-2.17-i486-8_slack14.1.txz\nc7080f6d7f309ba2905dacfa555a8115 glibc-zoneinfo-2014i-noarch-1_slack14.1.txz\n\nSlackware x86_64 14.1 packages:\n32904ee5d2a3177d621c4c6f2aa6e67f glibc-2.17-x86_64-8_slack14.1.txz\n1bb4ddd6d4043d632e78dbf3103f2f7c glibc-i18n-2.17-x86_64-8_slack14.1.txz\ne6914d464f57ea493502eea4dd40044a glibc-profile-2.17-x86_64-8_slack14.1.txz\n04562128e188daaad7fdab49756a22f2 glibc-solibs-2.17-x86_64-8_slack14.1.txz\nc7080f6d7f309ba2905dacfa555a8115 glibc-zoneinfo-2014i-noarch-1_slack14.1.txz\n\nSlackware -current packages:\nf547fe51634c852ae17cb1f6c39203e1 a/glibc-solibs-2.20-i486-1.txz\nc7080f6d7f309ba2905dacfa555a8115 a/glibc-zoneinfo-2014i-noarch-1.txz\nf9923d8006a3c03520e93608114cb7de l/glibc-2.20-i486-1.txz\n658301364b68e79d53acb607cd399504 l/glibc-i18n-2.20-i486-1.txz\nd03947abf3d4be41f7bfb0a71bd29f35 l/glibc-profile-2.20-i486-1.txz\n\nSlackware x86_64 -current packages:\na0f46b305c27dd0c80e65cc77254bdf2 a/glibc-solibs-2.20-x86_64-1.txz\nc7080f6d7f309ba2905dacfa555a8115 a/glibc-zoneinfo-2014i-noarch-1.txz\nd673acf56308355713ac67ae68e6bd2b l/glibc-2.20-x86_64-1.txz\n410918dc8bf5b7a84d1bed5b6e125ee3 l/glibc-i18n-2.20-x86_64-1.txz\nc023f4514cd0a672e4852986c74268e6 l/glibc-profile-2.20-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the packages as root:\n > upgradepkg glibc-*.txz", "edition": 3, "reporter": "Slackware Linux Project", "published": "2014-10-23T22:36:04", "title": "glibc", "type": "slackware", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-5119", "CVE-2014-4043", "CVE-2014-6040", "CVE-2013-4788", "CVE-2012-4412", "CVE-2012-4424", "CVE-2013-4458", "CVE-2013-4237", "CVE-2014-0475"], "modified": "2014-10-23T22:36:04", "id": "SSA-2014-296-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.647059", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:03", "references": ["http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5119", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9402", "https://bugs.gentoo.org/show_bug.cgi?id=541246", "https://googleonlinesecurity.blogspot.de/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html", "https://bugs.gentoo.org/show_bug.cgi?id=521932", "https://bugs.gentoo.org/show_bug.cgi?id=538090", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6040", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1472", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8121", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7817", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8779", "https://bugs.gentoo.org/show_bug.cgi?id=547296", "https://bugs.gentoo.org/show_bug.cgi?id=529982", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7423", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8776", "https://bugs.gentoo.org/show_bug.cgi?id=516884", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8778", "https://bugs.gentoo.org/show_bug.cgi?id=540070", "https://bugs.gentoo.org/show_bug.cgi?id=532874", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1781", "https://bugs.gentoo.org/show_bug.cgi?id=574880", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0475", "https://bugs.gentoo.org/show_bug.cgi?id=552692", "https://bugs.gentoo.org/show_bug.cgi?id=541542", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7547", "https://bugs.gentoo.org/show_bug.cgi?id=517082", "https://bugs.gentoo.org/show_bug.cgi?id=538814"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "2.21-r2", "packageName": "sys-libs/glibc", "packageFilename": "UNKNOWN", "arch": "all", "operator": "lt"}], "description": "### Background\n\nThe GNU C library is the standard C library used by Gentoo Linux systems. \n\n### Description\n\nMultiple vulnerabilities have been discovered in the GNU C Library:\n\n * The Google Security Team and Red Hat discovered a stack-based buffer overflow in the send_dg() and send_vc() functions due to a buffer mismanagement when getaddrinfo() is called with AF_UNSPEC (CVE-2015-7547). \n * The strftime() function access invalid memory when passed out-of-range data, resulting in a crash (CVE-2015-8776). \n * An integer overflow was found in the __hcreate_r() function (CVE-2015-8778). \n * Multiple unbounded stack allocations were found in the catopen() function (CVE-2015-8779). \n\nPlease review the CVEs referenced below for additional vulnerabilities that had already been fixed in previous versions of sys-libs/glibc, for which we have not issued a GLSA before. \n\n### Impact\n\nA remote attacker could exploit any application which performs host name resolution using getaddrinfo() in order to execute arbitrary code or crash the application. The other vulnerabilities can possibly be exploited to cause a Denial of Service or leak information. \n\n### Workaround\n\nA number of mitigating factors for CVE-2015-7547 have been identified. Please review the upstream advisory and references below. \n\n### Resolution\n\nAll GNU C Library users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-libs/glibc-2.21-r2\"\n \n\nIt is important to ensure that no running process uses the old glibc anymore. The easiest way to achieve that is by rebooting the machine after updating the sys-libs/glibc package. \n\nNote: Should you run into compilation failures while updating, please see bug 574948.", "edition": 1, "reporter": "Gentoo Foundation", "published": "2016-02-17T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "gentoo", "title": "GNU C Library: Multiple vulnerabilities", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8776", "CVE-2014-5119", "CVE-2014-6040", "CVE-2014-9402", "CVE-2014-8121", "CVE-2015-8779", "CVE-2015-8778", "CVE-2014-7817", "CVE-2015-1472", "CVE-2015-1781", "CVE-2013-7423", "CVE-2014-0475", "CVE-2015-7547"], "modified": "2016-02-17T00:00:00", "id": "GLSA-201602-02", "href": "https://security.gentoo.org/glsa/201602-02", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}]}