Red Hat Security AdvisoryRHSA-2015:0016
glibc security and bug fix update
Released 2015-01-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) glibc-2.12-1.149.el6_6.4, glibc-common-2.12-1.149.el6_6.4, glibc-devel-2.12-1.149.el6_6.4 +3
- Red Hat Enterprise Linux Desktop Optional (v. 6) glibc-static-2.12-1.149.el6_6.4
- Red Hat Enterprise Linux HPC Node (v. 6) glibc-2.12-1.149.el6_6.4, glibc-common-2.12-1.149.el6_6.4, glibc-devel-2.12-1.149.el6_6.4 +3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) glibc-static-2.12-1.149.el6_6.4
- Red Hat Enterprise Linux Server (v. 6) glibc-2.12-1.149.el6_6.4, glibc-2.12-1.149.el6_6.4.ppc, glibc-common-2.12-1.149.el6_6.4 +5
- Red Hat Enterprise Linux Server Optional (v. 6) glibc-static-2.12-1.149.el6_6.4, glibc-static-2.12-1.149.el6_6.4.ppc
- Red Hat Enterprise Linux Workstation (v. 6) glibc-2.12-1.149.el6_6.4, glibc-common-2.12-1.149.el6_6.4, glibc-devel-2.12-1.149.el6_6.4 +3
- Red Hat Enterprise Linux Workstation Optional (v. 6) glibc-static-2.12-1.149.el6_6.4
Fixes 2 records
Priority LOW 32
GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) I…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.06564 · Published 2014-12-05 · Partial fix CWE-119
Priority LOW 22
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
CVSS 2.0MEDIUM 4.6· Local · No auth · Interaction — · EPSS 0.00578 · Published 2014-11-24 · Partial fix CWE-20
