Lucene search

K
oraclelinuxOracleLinuxELSA-2024-12472
HistoryJul 03, 2024 - 12:00 a.m.

glibc security update

2024-07-0300:00:00
linux.oracle.com
18
glibc
security update
cve fixes
oracle patches
buffer overflow
privilege escalation
memory corruption

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

AI Score

8.1

Confidence

Low

[2.34-100.0.1.2]

  • Forward-port Oracle patches for ol9-u4
    Reviewed by: Jose E. Marchesi
    Oracle history:
    April-30-2024 Cupertino Miranda
  • 2.34-100.0.1
  • Forward-port Oracle patches for ol9-u4
    Reviewed by: Indu Bhagat
    March-28-2024 Cupertino Miranda
  • 2.34-100.0.1
  • Forward-port Oracle patches for ol9-u4-beta
    Reviewed by: Jose E. Marchesi
    March 15 2024 Cupertino Miranda
  • 2.34-83.0.2.12
  • Forward-port Oracle patches for ol9
    Reviewed by: Jose E. Marchesi
    February-26-2024 Cupertino Miranda
  • 2.34-83.0.2.7
  • OraBug 36322437 getaddrinfo does not return correct ipv6 address and family
    Reviewed by: Jose E. Marchesi
    October-24-2023 Cupertino Miranda
  • 2.34-83.0.1.7
  • Forward-port Oracle patches for ol9
    Reviewed by: Jose E. Marchesi
    October-4-2023 Cupertino Miranda
  • 2.34-82.0.1
  • Forward-port Oracle patches for ol9
    Reviewed by: Jose E. Marchesi
    April-18-2023 Cupertino Miranda
  • 2.34-60.0.2
  • OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks
  • Created tunable glibc.pthread.stack_hugetlb to control when hugepages
    can be used for stack allocation.
  • In case THP are enabled and glibc.pthread.stack_hugetlb is set to
    0, glibc will madvise the kernel not to use allow hugepages for stack
    allocations.
    Reviewed by: Jose E. Marchesi
    March-28-2023 Cupertino Miranda
  • 2.34-60.0.1
  • Merge Oracle patches for ol9-u2 beta
    Reviewed by: Jose E. Marchesi
    September-28-2022 Patrick McGehearty
  • 2.34-40.0.1
  • Merge Oracle patches for ol9-u1 beta
    Reviewed by: Jose E. Marchesi
    April-25-2022 Patrick McGehearty
  • 2.34-28.0.1
  • Merge Oracle patches with ol9 beta
  • Reviewed-by: Jose E. Marchesi
    [2.34-100.2]
  • CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34318)
  • CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
  • CVE-2024-33601: nscd: crash on out-of-memory condition
  • CVE-2024-33602: nscd: memory corruption with NSS netgroup modules
    [2.34-100.1]
  • CVE-2024-2961: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (RHEL-32480)
    [2.34-100]
  • manual: fix order of arguments of memalign and aligned_alloc (RHEL-21556)
    [2.34-99]
  • getaddrinfo: Return correct error EAI_MEMORY when out-of-memory (RHEL-19444)
    [2.34-98]
  • getaddrinfo: Fix occasionally empty result due to nscd cache order (RHEL-16643)
    [2.34-97]
  • Re-enable output buffering for wide stdio streams (RHEL-19862)
    [2.34-96]
  • Fix TLS corruption during dlopen()/dlclose() sequences (RHEL-17465)
    [2.34-95]
  • Improve compatibility between underlinking and IFUNC resolvers (RHEL-17319)
    [2.34-94]
  • Update syscall-names.list for Linux 6.6. (RHEL-16016)
    [2.34-93]
  • malloc: Use __get_nprocs on arena_get2. (RHEL-17157)
    [2.34-92]
  • Improve test coverage for wcsdup, strdup and strndup. (RHEL-15343)
    [2.34-91]
  • fstat performance enhancement (RHEL-2338)
    [2.34-90]
  • ldconfig should skip temporary files created by RPM (RHEL-14383)
    [2.34-89]
  • Fix force-first handling in dlclose (RHEL-2491)
    [2.34-88]
  • nscd: Refer to /run instead of /var/run in systemd socket file
    (RHEL-16275)
    [2.34-87]
  • Fix slow tls access after dlopen (RHEL-2123)
    [2.34-86]
  • Add /usr/share/doc/glibc/gai.conf to glibc-doc (RHEL-14545)
    [2.34-85]
  • nscd: Skip unusable entries in first pass in prune_cache (RHEL-3397)
    [2.34-84]
  • x86-64: Report non-zero cache sizes under TDX hypervisors (RHEL-1191)
    [2.34-83.7]
  • Fix memory leak regression in getaddrinfo (RHEL-2426)
    [2.34-83.6]
  • CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation (RHEL-3000)
    [2.34-83.5]
  • Revert: Always call destructors in reverse constructor order (RHEL-2491)
    [2.34-83.4]
  • CVE-2023-4806 glibc: potential use-after-free in getaddrinfo (RHEL-2426)
    [2.34-83.3]
  • CVE-2023-4813: potential use-after-free in gaih_inet (RHEL-2438)

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

AI Score

8.1

Confidence

Low