Red Hat Security AdvisoryRHSA-2018:0805
glibc security, bug fix, and enhancement update
Released 2018-04-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) glibc-2.17-222.el7, glibc-common-2.17-222.el7, glibc-devel-2.17-222.el7 +3
- Red Hat Enterprise Linux Client Optional (v. 7) glibc-static-2.17-222.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) glibc-2.17-222.el7, glibc-common-2.17-222.el7, glibc-devel-2.17-222.el7 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-static-2.17-222.el7
- Red Hat Enterprise Linux Server (v. 7) glibc-2.17-222.el7, glibc-2.17-222.el7.ppc, glibc-common-2.17-222.el7 +5
- Red Hat Enterprise Linux Server Optional (v. 7) glibc-static-2.17-222.el7, glibc-static-2.17-222.el7.ppc
- Red Hat Enterprise Linux Workstation (v. 7) glibc-2.17-222.el7, glibc-common-2.17-222.el7, glibc-devel-2.17-222.el7 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-static-2.17-222.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) glibc-2.17-222.el7, glibc-common-2.17-222.el7, glibc-devel-2.17-222.el7 +3
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) glibc-static-2.17-222.el7
Fixes 6 records
Priority MEDIUM 49
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.13368 · Published 2018-01-31 · Partial fix CWE-787
Priority MEDIUM 47
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02801 · Published 2017-10-22 · Partial fix CWE-119
Priority MEDIUM 47
The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator f…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02977 · Published 2017-10-20 · Partial fix CWE-119
Priority MEDIUM 45
The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinit…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.07834 · Published 2015-02-24 · Partial fix CWE-399
Priority MEDIUM 42
res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.06219 · Published 2017-06-27 · Partial fix CWE-476
Priority LOW 30
The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01958 · Published 2017-08-01 · Partial fix CWE-770
THREATIST.IORead the docs