This update addresses two security vulnerabilities:

• CVE-2017-16997: Check for empty tokens before dynamic string token expansion in the dynamic linker, so that pre-existing privileged programs with $ORIGIN rpaths/runpaths do not cause the dynamic linker to search the current directory, potentially leading to privilege escalation. (#1526866).
• CVE-2018-1000001: getcwd would sometimes return a non-absolute path, confusing the realpath function, leading to privilege escalation in conjunction with user namespaces. (#1533837)

In addition, this update changes the thread stack size accounting to provide additional stack space compared to previous glibc versions. For some applications (nptd in particular), the PTHREAD_STACK_MIN stack size was too small on x86-64 machines with AVX-512 support (#1527887).