stable

glibc-2.37-10.fc38

FEDORA-2023-2b8c11ee75 created by codonell a year ago for Fedora 38

Security fix for CVE-2023-4911, CVE-2023-4806, and CVE-2023-4527.

CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the environment of a setuid program and NAME is valid, it may result in a buffer overflow, which could be exploited to achieve escalated privileges. This flaw was introduced in glibc 2.34.

CVE-2023-4806: When an NSS plugin only implements the _gethostbyname2_r and _getcanonname_r callbacks, getaddrinfo could use memory that was freed during buffer resizing, potentially causing a crash or read or write to arbitrary memory.

CVE-2023-4527: If the system is configured in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC address family, and a DNS response is received over TCP that is larger than 2048 bytes, getaddrinfo may potentially disclose stack contents via the returned address data, or crash.

This update contains changes to ELF destructor ordering, improving compatibility with a certain VPN software product.

Reboot Required
After installing this update it is required that you reboot your system to ensure the changes supplied by this update are applied properly.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-2b8c11ee75

This update has been submitted for testing by codonell.

a year ago

This update's test gating status has been changed to 'waiting'.

a year ago

This update has obsoleted glibc-2.37-7.fc38, and has inherited its bugs and notes.

a year ago
User Icon markec provided feedback a year ago
karma

adamwill edited this update.

a year ago

adamwill edited this update.

a year ago
User Icon snehring commented & provided feedback a year ago
karma

Issue with cisco vpn still present, seems to work otherwise.

BZ#2239304 glibc: Revert change to run ELF destructor in reverse constructor order

This update's test gating status has been changed to 'passed'.

a year ago

This update's test gating status has been changed to 'failed'.

a year ago

This update has been pushed to testing.

a year ago
User Icon bojan commented & provided feedback a year ago
karma

Works.

This update's test gating status has been changed to 'waiting'.

a year ago
User Icon paulblack provided feedback a year ago
karma

This update's test gating status has been changed to 'failed'.

a year ago

This update's test gating status has been changed to 'waiting'.

a year ago

This update's test gating status has been changed to 'passed'.

a year ago

This update can be pushed to stable now if the maintainer wishes

a year ago
User Icon submachine commented & provided feedback a year ago

I just waived the automated test failures, but I don't see my waiver comment here, so:

  1. The scratch build validation failure is an strace build failure that also occurs on baseline; waived
  2. The debugging symbols in libc.so.6 and ld.so is expected; waived
  3. The cope build validation failure seems to be an infrastructure issue; waived
User Icon didier commented & provided feedback a year ago

I can confirm that the cisco secure connect (anyconnect) vpn problem is still present, otherwise everything seems to work.

This update has been submitted for stable by submachine.

a year ago
User Icon besser82 commented & provided feedback a year ago
karma

Works great! LGTM! =)

This update has been pushed to stable.

a year ago
User Icon jostra commented & provided feedback a year ago

cisco anyconnect with glibc-2.37-10.fc38 still doesn't work!!

Please login to add feedback.

Metadata
Type
security
Severity
high
Karma
5
Signed
Content Type
RPM
Test Gating
Autopush Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
14 days
Dates
submitted
a year ago
in testing
a year ago
in stable
a year ago
modified
a year ago
approved
a year ago
Builds
1
glibc-2.37-10.fc38
BZ#2234712 CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode
0
0
BZ#2237782 CVE-2023-4806 glibc: potential use-after-free in getaddrinfo()
0
0
BZ#2238352 CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation
0
0
BZ#2238600 CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode [fedora-all]
0
0
BZ#2238604 CVE-2023-4806 glibc: potential use-after-free in getaddrinfo() [fedora-all]
0
0
BZ#2239304 glibc: Revert change to run ELF destructor in reverse constructor order
-1
0
BZ#2241966 CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation [fedora-all]
0
0
glibc-2.37-10.fc38

Automated Test Results

Copyright © 2007-2024 Red Hat, Inc. and others.

Running bodhi-server 8.3.0 on bodhi-web-176-hkzmp.

bodhi is Free Software. Please file issues if you have any problems. Read the documentation.

• Composes • Legal • Privacy policy •