[SECURITY] [DLA 350-1] eglibc security update

2015-11-2617:49:39

lists.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.8 High

AI Score

Confidence

High

0.046 Low

EPSS

Percentile

92.6%

JSON

Package : eglibc
Version : 2.11.3-4+deb6u8
CVE ID : not assigned yet
Debian Bug : 803927

The strxfrm() function is vulnerable to integer overflows when computing
memory allocation sizes (similar to CVE-2012-4412). Furthermore since
it fallbacks to use alloca() when malloc() fails, it is vulnerable to
stack-based buffer overflows (similar to CVE-2012-4424).

Those issues have been fixed in Debian 6 Squeeze with eglibc
2.11.3-4+deb6u8. We recommend that you upgrade libc6 and other
packages provided by eglibc.

–
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian6alleglibc-source< 2.11.3-4+deb6u8eglibc-source_2.11.3-4+deb6u8_all.deb
Debian6amd64libc6-dev< 2.11.3-4+deb6u8libc6-dev_2.11.3-4+deb6u8_amd64.deb
Debian6amd64libc6< 2.11.3-4+deb6u8libc6_2.11.3-4+deb6u8_amd64.deb
Debian6i386libc-bin< 2.11.3-4+deb6u8libc-bin_2.11.3-4+deb6u8_i386.deb
Debian6i386libc6-prof< 2.11.3-4+deb6u8libc6-prof_2.11.3-4+deb6u8_i386.deb
Debian6i386libc6-xen< 2.11.3-4+deb6u8libc6-xen_2.11.3-4+deb6u8_i386.deb
Debian6amd64libc6-udeb< 2.11.3-4+deb6u8libc6-udeb_2.11.3-4+deb6u8_amd64.deb
Debian6i386libnss-dns-udeb< 2.11.3-4+deb6u8libnss-dns-udeb_2.11.3-4+deb6u8_i386.deb
Debian6i386libnss-files-udeb< 2.11.3-4+deb6u8libnss-files-udeb_2.11.3-4+deb6u8_i386.deb
Debian6amd64nscd< 2.11.3-4+deb6u8nscd_2.11.3-4+deb6u8_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	eglibc-source	< 2.11.3-4+deb6u8	eglibc-source_2.11.3-4+deb6u8_all.deb
Debian	6	amd64	libc6-dev	< 2.11.3-4+deb6u8	libc6-dev_2.11.3-4+deb6u8_amd64.deb
Debian	6	amd64	libc6	< 2.11.3-4+deb6u8	libc6_2.11.3-4+deb6u8_amd64.deb
Debian	6	i386	libc-bin	< 2.11.3-4+deb6u8	libc-bin_2.11.3-4+deb6u8_i386.deb
Debian	6	i386	libc6-prof	< 2.11.3-4+deb6u8	libc6-prof_2.11.3-4+deb6u8_i386.deb
Debian	6	i386	libc6-xen	< 2.11.3-4+deb6u8	libc6-xen_2.11.3-4+deb6u8_i386.deb
Debian	6	amd64	libc6-udeb	< 2.11.3-4+deb6u8	libc6-udeb_2.11.3-4+deb6u8_amd64.deb
Debian	6	i386	libnss-dns-udeb	< 2.11.3-4+deb6u8	libnss-dns-udeb_2.11.3-4+deb6u8_i386.deb
Debian	6	i386	libnss-files-udeb	< 2.11.3-4+deb6u8	libnss-files-udeb_2.11.3-4+deb6u8_i386.deb
Debian	6	amd64	nscd	< 2.11.3-4+deb6u8	nscd_2.11.3-4+deb6u8_amd64.deb