[SECURITY] [DLA 411-2] eglibc regression update

2016-02-1211:03:47

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.049 Low

EPSS

Percentile

92.7%

JSON

Package : eglibc
Version : 2.11.3-4+deb6u10
CVE ID : CVE-2014-9761
Debian Bug : 814078

The fix for CVE-2014-9761 in Squeeze wrongly backported the upstream
patch. New symbols were not declared as private and the ABI changed.
This made some programs and services crash after the upgrade, and needed
to be restarted.
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian6i386libc6-udeb< 2.11.3-4+deb6u10libc6-udeb_2.11.3-4+deb6u10_i386.deb
Debian6alleglibc< 2.11.3-4+deb6u9eglibc_2.11.3-4+deb6u9_all.deb
Debian6amd64nscd< 2.11.3-4+deb6u10nscd_2.11.3-4+deb6u10_amd64.deb
Debian6amd64nscd< 2.11.3-4+deb6u9nscd_2.11.3-4+deb6u9_amd64.deb
Debian6amd64libc6-i386< 2.11.3-4+deb6u10libc6-i386_2.11.3-4+deb6u10_amd64.deb
Debian6i386libc6-udeb< 2.11.3-4+deb6u9libc6-udeb_2.11.3-4+deb6u9_i386.deb
Debian6i386libc6-i686< 2.11.3-4+deb6u10libc6-i686_2.11.3-4+deb6u10_i386.deb
Debian6amd64libnss-dns-udeb< 2.11.3-4+deb6u9libnss-dns-udeb_2.11.3-4+deb6u9_amd64.deb
Debian6amd64libc6-dev-i386< 2.11.3-4+deb6u9libc6-dev-i386_2.11.3-4+deb6u9_amd64.deb
Debian6amd64libnss-dns-udeb< 2.11.3-4+deb6u10libnss-dns-udeb_2.11.3-4+deb6u10_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	i386	libc6-udeb	< 2.11.3-4+deb6u10	libc6-udeb_2.11.3-4+deb6u10_i386.deb
Debian	6	all	eglibc	< 2.11.3-4+deb6u9	eglibc_2.11.3-4+deb6u9_all.deb
Debian	6	amd64	nscd	< 2.11.3-4+deb6u10	nscd_2.11.3-4+deb6u10_amd64.deb
Debian	6	amd64	nscd	< 2.11.3-4+deb6u9	nscd_2.11.3-4+deb6u9_amd64.deb
Debian	6	amd64	libc6-i386	< 2.11.3-4+deb6u10	libc6-i386_2.11.3-4+deb6u10_amd64.deb
Debian	6	i386	libc6-udeb	< 2.11.3-4+deb6u9	libc6-udeb_2.11.3-4+deb6u9_i386.deb
Debian	6	i386	libc6-i686	< 2.11.3-4+deb6u10	libc6-i686_2.11.3-4+deb6u10_i386.deb
Debian	6	amd64	libnss-dns-udeb	< 2.11.3-4+deb6u9	libnss-dns-udeb_2.11.3-4+deb6u9_amd64.deb
Debian	6	amd64	libc6-dev-i386	< 2.11.3-4+deb6u9	libc6-dev-i386_2.11.3-4+deb6u9_amd64.deb
Debian	6	amd64	libnss-dns-udeb	< 2.11.3-4+deb6u10	libnss-dns-udeb_2.11.3-4+deb6u10_amd64.deb