Lucene search

K
mageiaGentoo FoundationMGASA-2024-0026
HistoryFeb 04, 2024 - 5:49 a.m.

Updated glibc packages fix security vulnerabilities

2024-02-0405:49:27
Gentoo Foundation
advisories.mageia.org
31
glibc
security vulnerabilities
buffer overflow
integer overflow
cve-2023-6246
cve-2023-6779
cve-2023-6780
syslog
vsyslog
application crash
local privilege escalation

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.4%

The updated packages fix security vulnerabilities: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. (CVE-2023-6246) An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. (CVE-2023-6779) An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. (CVE-2023-6780)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchglibc<Β 2.36-52glibc-2.36-52.mga9

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.4%