stable

glibc-2.38-6.fc39

FEDORA-2023-63e5a77522 created by codonell 7 months ago for Fedora 39

Security fix for CVE-2023-4911, CVE-2023-4806, and CVE-2023-4527.

CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the environment of a setuid program and NAME is valid, it may result in a buffer overflow, which could be exploited to achieve escalated privileges. This flaw was introduced in glibc 2.34.

CVE-2023-4806: When an NSS plugin only implements the _gethostbyname2_r and _getcanonname_r callbacks, getaddrinfo could use memory that was freed during buffer resizing, potentially causing a crash or read or write to arbitrary memory.

CVE-2023-4527: If the system is configured in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC address family, and a DNS response is received over TCP that is larger than 2048 bytes, getaddrinfo may potentially disclose stack contents via the returned address data, or crash.

Reboot Required
After installing this update it is required that you reboot your system to ensure the changes supplied by this update are applied properly.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-63e5a77522

This update has been submitted for testing by codonell.

7 months ago

This update's test gating status has been changed to 'waiting'.

7 months ago

adamwill edited this update.

7 months ago

This update's test gating status has been changed to 'passed'.

7 months ago
User Icon adamwill commented & provided feedback 7 months ago
karma

Can't confirm all the CVE fixes, but does not affect critical path functionality on my system.

User Icon tflink commented & provided feedback 7 months ago
karma

Works without obvious regression on my system

This update's test gating status has been changed to 'failed'.

7 months ago

This update has been pushed to testing.

7 months ago
User Icon bojan commented & provided feedback 7 months ago
karma

Works.

This update's test gating status has been changed to 'waiting'.

7 months ago
karma

This update's test gating status has been changed to 'passed'.

7 months ago

This update can be pushed to stable now if the maintainer wishes

7 months ago
User Icon imabug provided feedback 7 months ago
karma

This update has been submitted for stable by bodhi.

There is an ongoing freeze; this will be pushed to stable after the freeze is over.

7 months ago
karma
User Icon saluki provided feedback 7 months ago
karma

This update has been pushed to stable.

7 months ago

Please login to add feedback.

Metadata
Type
security
Severity
high
Karma
7
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
14 days
Dates
submitted
7 months ago
in testing
7 months ago
in stable
7 months ago
modified
7 months ago
approved
7 months ago
BZ#2234712 CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode
0
0
BZ#2237782 CVE-2023-4806 glibc: potential use-after-free in getaddrinfo()
0
0
BZ#2238352 CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation
0
0
BZ#2238600 CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode [fedora-all]
0
0
BZ#2238604 CVE-2023-4806 glibc: potential use-after-free in getaddrinfo() [fedora-all]
0
0
BZ#2241966 CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation [fedora-all]
0
0
BZ#2242014 Ensure CVE-2023-4911 fix lands in Fedora 39 Final
0
0

Automated Test Results