[SECURITY] [DLA 992-1] eglibc security update

2017-06-1919:56:25

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

25.7%

JSON

Package : eglibc
Version : 2.13-38+deb7u12
CVE ID : CVE-2017-1000366

The Qualys Research Labs discovered various problems in the dynamic
linker of the GNU C Library which allow local privilege escalation by
clashing the stack. For the full details, please refer to their advisory
published at:
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

For Debian 7 "Wheezy", these problems have been fixed in version
2.13-38+deb7u12.

We recommend that you upgrade your eglibc packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian8mipslibc6-mips64< 2.19-18+deb8u10libc6-mips64_2.19-18+deb8u10_mips.deb
Debian9i386libc6< 2.24-11+deb9u1libc6_2.24-11+deb9u1_i386.deb
Debian8mipslibc6-udeb< 2.19-18+deb8u10libc6-udeb_2.19-18+deb8u10_mips.deb
Debian9mipsellibc6-dev-mipsn32< 2.24-11+deb9u1libc6-dev-mipsn32_2.24-11+deb9u1_mipsel.deb
Debian9s390xlibc6-s390< 2.24-11+deb9u1libc6-s390_2.24-11+deb9u1_s390x.deb
Debian9mips64ellibc6-dev< 2.24-11+deb9u1libc6-dev_2.24-11+deb9u1_mips64el.deb
Debian7i386libc6-dev-amd64< 2.13-38+deb7u12libc6-dev-amd64_2.13-38+deb7u12_i386.deb
Debian7amd64libc-bin< 2.13-38+deb7u12libc-bin_2.13-38+deb7u12_amd64.deb
Debian8powerpclibc-bin< 2.19-18+deb8u10libc-bin_2.19-18+deb8u10_powerpc.deb
Debian9s390xlibc-dev-bin< 2.24-11+deb9u1libc-dev-bin_2.24-11+deb9u1_s390x.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	mips	libc6-mips64	< 2.19-18+deb8u10	libc6-mips64_2.19-18+deb8u10_mips.deb
Debian	9	i386	libc6	< 2.24-11+deb9u1	libc6_2.24-11+deb9u1_i386.deb
Debian	8	mips	libc6-udeb	< 2.19-18+deb8u10	libc6-udeb_2.19-18+deb8u10_mips.deb
Debian	9	mipsel	libc6-dev-mipsn32	< 2.24-11+deb9u1	libc6-dev-mipsn32_2.24-11+deb9u1_mipsel.deb
Debian	9	s390x	libc6-s390	< 2.24-11+deb9u1	libc6-s390_2.24-11+deb9u1_s390x.deb
Debian	9	mips64el	libc6-dev	< 2.24-11+deb9u1	libc6-dev_2.24-11+deb9u1_mips64el.deb
Debian	7	i386	libc6-dev-amd64	< 2.13-38+deb7u12	libc6-dev-amd64_2.13-38+deb7u12_i386.deb
Debian	7	amd64	libc-bin	< 2.13-38+deb7u12	libc-bin_2.13-38+deb7u12_amd64.deb
Debian	8	powerpc	libc-bin	< 2.19-18+deb8u10	libc-bin_2.19-18+deb8u10_powerpc.deb
Debian	9	s390x	libc-dev-bin	< 2.24-11+deb9u1	libc-dev-bin_2.24-11+deb9u1_s390x.deb