Red Hat Security Advisory

RHSA-2017:1916

glibc security, bug fix, and enhancement update

Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) glibc-2.17-196.el7, glibc-common-2.17-196.el7, glibc-devel-2.17-196.el7 +3
Red Hat Enterprise Linux Client Optional (v. 7) glibc-static-2.17-196.el7
Red Hat Enterprise Linux ComputeNode (v. 7) glibc-2.17-196.el7, glibc-common-2.17-196.el7, glibc-devel-2.17-196.el7 +3
Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-static-2.17-196.el7
Red Hat Enterprise Linux Server (v. 7) glibc-2.17-196.el7, glibc-2.17-196.el7.ppc, glibc-common-2.17-196.el7 +5
Red Hat Enterprise Linux Server Optional (v. 7) glibc-static-2.17-196.el7, glibc-static-2.17-196.el7.ppc
Red Hat Enterprise Linux Workstation (v. 7) glibc-2.17-196.el7, glibc-common-2.17-196.el7, glibc-devel-2.17-196.el7 +3
Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-static-2.17-196.el7

Fixes 5 records

TI-2015-07226 CVE-2015-8779 · GHSA-p8hg-r2c3-83hv

Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or…

MEDIUM 51

Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06206 Published 2016-04-19 Partial fix CWE-119

TI-2015-07225 CVE-2015-8778 · GHSA-4r54-pcmf-cg7r

Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows…

MEDIUM 51

Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the _…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05738 Published 2016-04-19 Partial fix CWE-119

TI-2014-07940 CVE-2014-9761 · GHSA-vf4r-x8xm-qwqj

Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before…

MEDIUM 50

Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05506 Published 2016-04-19 Partial fix CWE-119

TI-2015-07223 CVE-2015-8776 · GHSA-mm79-9vr7-wx53

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows…

MEDIUM 47

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.048 Published 2016-04-19 Partial fix CWE-189

TI-2015-07224 CVE-2015-8777 · GHSA-2gq8-953m-fqr3

The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6)…

LOW 26

The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment v…

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0057 Published 2016-01-20 Partial fix CWE-254