stable

FEDORA-2018-8e27ad96ed created by fweimer 4 years ago for Fedora 26

This update addresses two security vulnerabilities:

  • CVE-2017-15670, CVE-2017-15671, CVE-2017-15804: Various vulnerabilities could lead to memory corruption in the glob and glob64 function. (#1505298, RHBZ##1504807)
  • CVE-2017-16997: Check for empty tokens before dynamic string token expansion in the dynamic linker, so that pre-existing privileged programs with $ORIGIN rpaths/runpaths do not cause the dynamic linker to search the current directory, potentially leading to privilege escalation. (#1526866).
  • CVE-2018-1000001: getcwd would sometimes return a non-absolute path, confusing the realpath function, leading to privilege escalation in conjunction with user namespaces. (#1533837)

In addition, this update replaces the dynamic linker trampoline on x86-64 with a version which uses the XSAVE instruction if it is available. This improves compatibility with future hardware and compilers which do not follow the x86-64 ABI. This update also adjusts the thread stack size accounting to provide additional stack space compared to previous glibc versions (to avoid introducing #1527887).

Reboot Required
After installing this update it is required that you reboot your system to ensure the changes supplied by this update are applied properly.

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2018-8e27ad96ed

This update has been submitted for testing by fweimer.

4 years ago

This update has been pushed to testing.

4 years ago
User Icon filiperosset commented & provided feedback 4 years ago
karma

no regressions noted

User Icon hreindl commented & provided feedback 4 years ago
karma

works for me

User Icon samoht0 commented & provided feedback 4 years ago
karma

no regressions noted

This update has been submitted for batched by bodhi.

4 years ago

This update has been submitted for stable by bodhi.

4 years ago

This update has been pushed to stable.

4 years ago

Please login to add feedback.

Metadata
Type
security
Severity
medium
Karma
3
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
disabled
Dates
submitted
4 years ago
in testing
4 years ago
in stable
4 years ago
BZ#1504807 CVE-2017-15670 CVE-2017-15671 glibc: various flaws [fedora-all]
0
0
BZ#1526866 CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries [fedora-all]
0
0
BZ#1533837 CVE-2018-1000001 glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation [fedora-all]
0
0

Automated Test Results