Red Hat Security AdvisoryRHSA-2014:2023
glibc security and bug fix update
Released 2014-12-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) glibc-2.17-55.el7_0.3, glibc-common-2.17-55.el7_0.3, glibc-devel-2.17-55.el7_0.3 +3
- Red Hat Enterprise Linux Client Optional (v. 7) glibc-static-2.17-55.el7_0.3
- Red Hat Enterprise Linux ComputeNode (v. 7) glibc-2.17-55.el7_0.3, glibc-common-2.17-55.el7_0.3, glibc-devel-2.17-55.el7_0.3 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-static-2.17-55.el7_0.3
- Red Hat Enterprise Linux Server (v. 7) glibc-2.17-55.el7_0.3, glibc-2.17-55.el7_0.3.ppc, glibc-common-2.17-55.el7_0.3 +5
- Red Hat Enterprise Linux Server Optional (v. 7) glibc-static-2.17-55.el7_0.3, glibc-static-2.17-55.el7_0.3.ppc
- Red Hat Enterprise Linux Workstation (v. 7) glibc-2.17-55.el7_0.3, glibc-common-2.17-55.el7_0.3, glibc-devel-2.17-55.el7_0.3 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-static-2.17-55.el7_0.3
Fixes 1 record
Priority LOW 22
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
CVSS 2.0MEDIUM 4.6· Local · No auth · Interaction — · EPSS 0.00578 · Published 2014-11-24 · Partial fix CWE-20
