Lucene search

K
mageiaGentoo FoundationMGASA-2022-0052
HistoryFeb 08, 2022 - 7:27 p.m.

Updated glibc packages fix security vulnerability

2022-02-0819:27:38
Gentoo Foundation
advisories.mageia.org
9

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.3 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

Updated glibc packages fix security vulnerability: An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system (CVE-2021-3999). Other upstream fixes in this update: - gconv: Do not emit spurious NUL character in ISO-2022-JP-3 [BZ #28524] - x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ #28755] - x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP - x86-64: Add ifunc-avx2.h functions with 256-bit EVEX - x86-64: Add strcpy family functions with 256-bit EVEX - x86-64: Add memmove family functions with 256-bit EVEX - x86-64: Add memset family functions with 256-bit EVEX - x86-64: Add memcmp family functions with 256-bit EVEX - x86-64: Add AVX optimized string/memory functions for RTM - x86: Add string/memory function tests in RTM region - x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions - x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions - test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655] - test-strnlen.c: Check that strnlen won’t go beyond the maximum length - x86: Optimize memchr-avx2.S - x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974] - x86: Optimize strlen-avx2.S - x86: Optimize memchr-evex.S - x86-64: Fix an unknown vector operation in memchr-evex.S - x86-64: Move strlen.S to multiarch/strlen-vec.S - x86-64: Add wcslen optimize for sse4.1 - x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974] - x86: Optimize strlen-evex.S - String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974] - x86-64: Require BMI2 for __strlen_evex and __strnlen_evex - x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033] - x86: Black list more Intel CPUs for TSX [BZ #27398] - x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064] - x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064]

OSVersionArchitecturePackageVersionFilename
Mageia8noarchglibc< 2.32-25glibc-2.32-25.mga8

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.3 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

Related for MGASA-2022-0052