eglibc - security update

Several vulnerabilities have been fixed in the GNU C Library, eglibc.

The CVE-2015-7547 vulnerability listed below is considered to have
critical impact.

• CVE-2014-8121
  Robin Hack discovered that the nss_files database did not
  correctly implement enumeration interleaved with name-based or
  ID-based lookups. This could cause the enumeration enter an
  endless loop, leading to a denial of service.
• CVE-2015-1781
  Arjun Shankar discovered that the _r variants of host name
  resolution functions (like gethostbyname_r), when performing DNS
  name resolution, suffered from a buffer overflow if a misaligned
  buffer was supplied by the applications, leading to a crash or,
  potentially, arbitrary code execution. Most applications are not
  affected by this vulnerability because they use aligned buffers.
• CVE-2015-7547
  The Google Security Team and Red Hat discovered that the eglibc
  host name resolver function, getaddrinfo, when processing
  AF_UNSPEC queries (for dual A/AAAA lookups), could mismanage its
  internal buffers, leading to a stack-based buffer overflow and
  arbitrary code execution. This vulnerability affects most
  applications which perform host name resolution using getaddrinfo,
  including system services.
• CVE-2015-8776
  Adam Nielsen discovered that if an invalid separated time value
  is passed to strftime, the strftime function could crash or leak
  information. Applications normally pass only valid time
  information to strftime; no affected applications are known.
• CVE-2015-8777
  Hector Marco-Gisbert reported that LD_POINTER_GUARD was not
  ignored for SUID programs, enabling an unintended bypass of a
  security feature. This update causes eglibc to always ignore the
  LD_POINTER_GUARD environment variable.
• CVE-2015-8778
  Szabolcs Nagy reported that the rarely-used hcreate and hcreate_r
  functions did not check the size argument properly, leading to a
  crash (denial of service) for certain arguments. No impacted
  applications are known at this time.
• CVE-2015-8779
  The catopen function contains several unbound stack allocations
  (stack overflows), causing it the crash the process (denial of
  service). No applications where this issue has a security impact
  are currently known.

The following fixed vulnerabilities currently lack CVE assignment:

• Joseph Myers reported that an integer overflow in the
  strxfrm can lead to heap-based buffer overflow, possibly allowing
  arbitrary code execution. In addition, a fallback path in strxfrm
  uses an unbounded stack allocation (stack overflow), leading to a
  crash or erroneous application behavior.
• Kostya Serebryany reported that the fnmatch function could skip
  over the terminating NUL character of a malformed pattern, causing
  an application calling fnmatch to crash (denial of service).
• Joseph Myers reported that the IO_wstr_overflow function,
  internally used by wide-oriented character streams, suffered from
  an integer overflow, leading to a heap-based buffer overflow. On
  GNU/Linux systems, wide-oriented character streams are rarely
  used, and no affected applications are known.
• Andreas Schwab reported a memory leak (memory allocation without a
  matching deallocation) while processing certain DNS answers in
  getaddrinfo, related to the _nss_dns_gethostbyname4_r function.
  This vulnerability could lead to a denial of service.

While it is only necessary to ensure that all processes are not using
the old eglibc anymore, it is recommended to reboot the machines after
applying the security upgrade.

For the oldstable distribution (wheezy), these problems have been fixed
in version 2.13-38+deb7u10.

We recommend that you upgrade your eglibc packages.