Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Enterprise Watch List (http://www.linux-archive.org/enterprise-watch-list/)
-   -   Moderate: glibc security and bug fix update (http://www.linux-archive.org/enterprise-watch-list/624757-moderate-glibc-security-bug-fix-update.html)

01-24-2012 08:36 PM
Moderate: glibc security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: glibc security and bug fix update
Advisory ID: RHSA-2012:0058-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0058.html
Issue date: 2012-01-24
CVE Names: CVE-2009-5029 CVE-2011-4609
================================================== ===================

1. Summary:

Updated glibc packages that fix two security issues and three bugs are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

The glibc packages contain the standard C libraries used by multiple
programs on the system. These packages contain the standard C and the
standard math libraries. Without these two libraries, a Linux system cannot
function properly.

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way the glibc library read timezone files. If a
carefully-crafted timezone file was loaded by an application linked against
glibc, it could cause the application to crash or, potentially, execute
arbitrary code with the privileges of the user running the application.
(CVE-2009-5029)

A denial of service flaw was found in the remote procedure call (RPC)
implementation in glibc. A remote attacker able to open a large number of
connections to an RPC service that is using the RPC implementation from
glibc, could use this flaw to make that service use an excessive amount of
CPU time. (CVE-2011-4609)

This update also fixes the following bugs:

* glibc had incorrect information for numeric separators and groupings for
specific French, Spanish, and German locales. Therefore, applications
utilizing glibc's locale support printed numbers with the wrong separators
and groupings when those locales were in use. With this update, the
separator and grouping information has been fixed. (BZ#754116)

* The RHBA-2011:1179 glibc update introduced a regression, causing glibc to
incorrectly parse groups with more than 126 members, resulting in
applications such as "id" failing to list all the groups a particular user
was a member of. With this update, group parsing has been fixed.
(BZ#766484)

* glibc incorrectly allocated too much memory due to a race condition
within its own malloc routines. This could cause a multi-threaded
application to allocate more memory than was expected. With this update,
the race condition has been fixed, and malloc's behavior is now consistent
with the documentation regarding the MALLOC_ARENA_TEST and MALLOC_ARENA_MAX
environment variables. (BZ#769594)

Users should upgrade to these updated packages, which contain backported
patches to resolve these issues.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

761245 - CVE-2009-5029 glibc: __tzfile_read integer overflow to buffer overflow
767299 - CVE-2011-4609 glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

i386:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-headers-2.12-1.47.el6_2.5.i686.rpm
glibc-utils-2.12-1.47.el6_2.5.i686.rpm
nscd-2.12-1.47.el6_2.5.i686.rpm

x86_64:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-2.12-1.47.el6_2.5.x86_64.rpm
glibc-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.5.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.5.x86_64.rpm
nscd-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

i386:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

x86_64:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-2.12-1.47.el6_2.5.x86_64.rpm
glibc-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.5.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.5.x86_64.rpm
nscd-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

i386:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-headers-2.12-1.47.el6_2.5.i686.rpm
glibc-utils-2.12-1.47.el6_2.5.i686.rpm
nscd-2.12-1.47.el6_2.5.i686.rpm

ppc64:
glibc-2.12-1.47.el6_2.5.ppc.rpm
glibc-2.12-1.47.el6_2.5.ppc64.rpm
glibc-common-2.12-1.47.el6_2.5.ppc64.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.ppc.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.ppc64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.ppc.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.ppc64.rpm
glibc-devel-2.12-1.47.el6_2.5.ppc.rpm
glibc-devel-2.12-1.47.el6_2.5.ppc64.rpm
glibc-headers-2.12-1.47.el6_2.5.ppc64.rpm
glibc-utils-2.12-1.47.el6_2.5.ppc64.rpm
nscd-2.12-1.47.el6_2.5.ppc64.rpm

s390x:
glibc-2.12-1.47.el6_2.5.s390.rpm
glibc-2.12-1.47.el6_2.5.s390x.rpm
glibc-common-2.12-1.47.el6_2.5.s390x.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.s390.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.s390x.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.s390.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.s390x.rpm
glibc-devel-2.12-1.47.el6_2.5.s390.rpm
glibc-devel-2.12-1.47.el6_2.5.s390x.rpm
glibc-headers-2.12-1.47.el6_2.5.s390x.rpm
glibc-utils-2.12-1.47.el6_2.5.s390x.rpm
nscd-2.12-1.47.el6_2.5.s390x.rpm

x86_64:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-2.12-1.47.el6_2.5.x86_64.rpm
glibc-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.5.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.5.x86_64.rpm
nscd-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

i386:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm

ppc64:
glibc-debuginfo-2.12-1.47.el6_2.5.ppc.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.ppc64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.ppc.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.ppc64.rpm
glibc-static-2.12-1.47.el6_2.5.ppc.rpm
glibc-static-2.12-1.47.el6_2.5.ppc64.rpm

s390x:
glibc-debuginfo-2.12-1.47.el6_2.5.s390.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.s390x.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.s390.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.s390x.rpm
glibc-static-2.12-1.47.el6_2.5.s390.rpm
glibc-static-2.12-1.47.el6_2.5.s390x.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

i386:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-headers-2.12-1.47.el6_2.5.i686.rpm
glibc-utils-2.12-1.47.el6_2.5.i686.rpm
nscd-2.12-1.47.el6_2.5.i686.rpm

x86_64:
glibc-2.12-1.47.el6_2.5.i686.rpm
glibc-2.12-1.47.el6_2.5.x86_64.rpm
glibc-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.5.i686.rpm
glibc-devel-2.12-1.47.el6_2.5.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.5.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.5.x86_64.rpm
nscd-2.12-1.47.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/glibc-2.12-1.47.el6_2.5.src.rpm

i386:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.5.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.5.x86_64.rpm
glibc-static-2.12-1.47.el6_2.5.i686.rpm
glibc-static-2.12-1.47.el6_2.5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2009-5029.html
https://www.redhat.com/security/data/cve/CVE-2011-4609.html
https://access.redhat.com/security/updates/classification/#moderate
https://rhn.redhat.com/errata/RHBA-2011-1179.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPHyRKXlSAg2UNWIIRApoWAKC4J5Xxsn2G+Z/DPy9ewnJLtWAAYwCaA3B+
LTuIiDvp3F1TwN7edxyBI6I=
=hOeo
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

02-13-2012 07:37 PM
Moderate: glibc security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: glibc security and bug fix update
Advisory ID: RHSA-2012:0125-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0125.html
Issue date: 2012-02-13
CVE Names: CVE-2009-5029 CVE-2009-5064 CVE-2010-0296
CVE-2010-0830 CVE-2011-1071 CVE-2011-1089
CVE-2011-1095 CVE-2011-1659 CVE-2011-4609
================================================== ===================

1. Summary:

Updated glibc packages that fix multiple security issues and one bug are
now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

The glibc packages contain the standard C libraries used by multiple
programs on the system. These packages contain the standard C and the
standard math libraries. Without these two libraries, a Linux system cannot
function properly.

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way the glibc library read timezone files. If a
carefully-crafted timezone file was loaded by an application linked against
glibc, it could cause the application to crash or, potentially, execute
arbitrary code with the privileges of the user running the application.
(CVE-2009-5029)

A flaw was found in the way the ldd utility identified dynamically linked
libraries. If an attacker could trick a user into running ldd on a
malicious binary, it could result in arbitrary code execution with the
privileges of the user running ldd. (CVE-2009-5064)

It was discovered that the glibc addmntent() function, used by various
mount helper utilities, did not sanitize its input properly. A local
attacker could possibly use this flaw to inject malformed lines into the
mtab (mounted file systems table) file via certain setuid mount helpers, if
the attacker were allowed to mount to an arbitrary directory under their
control. (CVE-2010-0296)

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way the glibc library loaded ELF (Executable and Linking
Format) files. If a carefully-crafted ELF file was loaded by an
application linked against glibc, it could cause the application to crash
or, potentially, execute arbitrary code with the privileges of the user
running the application. (CVE-2010-0830)

It was discovered that the glibc fnmatch() function did not properly
restrict the use of alloca(). If the function was called on sufficiently
large inputs, it could cause an application using fnmatch() to crash or,
possibly, execute arbitrary code with the privileges of the application.
(CVE-2011-1071)

It was found that the glibc addmntent() function, used by various mount
helper utilities, did not handle certain errors correctly when updating the
mtab (mounted file systems table) file. If such utilities had the setuid
bit set, a local attacker could use this flaw to corrupt the mtab file.
(CVE-2011-1089)

It was discovered that the locale command did not produce properly escaped
output as required by the POSIX specification. If an attacker were able to
set the locale environment variables in the environment of a script that
performed shell evaluation on the output of the locale command, and that
script were run with different privileges than the attacker's, it could
execute arbitrary code with the privileges of the script. (CVE-2011-1095)

An integer overflow flaw was found in the glibc fnmatch() function. If an
attacker supplied a long UTF-8 string to an application linked against
glibc, it could cause the application to crash. (CVE-2011-1659)

A denial of service flaw was found in the remote procedure call (RPC)
implementation in glibc. A remote attacker able to open a large number of
connections to an RPC service that is using the RPC implementation from
glibc, could use this flaw to make that service use an excessive amount of
CPU time. (CVE-2011-4609)

Red Hat would like to thank the Ubuntu Security Team for reporting
CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu
Security Team acknowledges Dan Rosenberg as the original reporter of
CVE-2010-0830.

This update also fixes the following bug:

* When using an nscd package that is a different version than the glibc
package, the nscd service could fail to start. This update makes the nscd
package require a specific glibc version to prevent this problem.
(BZ#657009)

Users should upgrade to these updated packages, which resolve these issues.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

559579 - CVE-2010-0296 glibc: Improper encoding of names with certain special character in utilities for writing to mtab table
599056 - CVE-2010-0830 glibc: ld.so d_tag signedness error in elf_get_dynamic_info
625893 - CVE-2011-1095 glibc: insufficient quoting in the locale command output
657009 - nscd rpm installation doesn't check dependencies
681054 - CVE-2011-1071 CVE-2011-1659 glibc: fnmatch() alloca()-based memory corruption flaw
688980 - CVE-2011-1089 glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE
692393 - CVE-2009-5064 glibc: ldd unexpected code execution issue
761245 - CVE-2009-5029 glibc: __tzfile_read integer overflow to buffer overflow
767299 - CVE-2011-4609 glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/glibc-2.3.4-2.57.src.rpm

i386:
glibc-2.3.4-2.57.i386.rpm
glibc-2.3.4-2.57.i686.rpm
glibc-common-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-headers-2.3.4-2.57.i386.rpm
glibc-profile-2.3.4-2.57.i386.rpm
glibc-utils-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i686.rpm
nscd-2.3.4-2.57.i386.rpm

ia64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.ia64.rpm
glibc-common-2.3.4-2.57.ia64.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.ia64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.ia64.rpm
glibc-headers-2.3.4-2.57.ia64.rpm
glibc-profile-2.3.4-2.57.ia64.rpm
glibc-utils-2.3.4-2.57.ia64.rpm
nptl-devel-2.3.4-2.57.ia64.rpm
nscd-2.3.4-2.57.ia64.rpm

ppc:
glibc-2.3.4-2.57.ppc.rpm
glibc-2.3.4-2.57.ppc64.rpm
glibc-common-2.3.4-2.57.ppc.rpm
glibc-debuginfo-2.3.4-2.57.ppc.rpm
glibc-debuginfo-2.3.4-2.57.ppc64.rpm
glibc-devel-2.3.4-2.57.ppc.rpm
glibc-devel-2.3.4-2.57.ppc64.rpm
glibc-headers-2.3.4-2.57.ppc.rpm
glibc-profile-2.3.4-2.57.ppc.rpm
glibc-utils-2.3.4-2.57.ppc.rpm
nptl-devel-2.3.4-2.57.ppc.rpm
nscd-2.3.4-2.57.ppc.rpm

s390:
glibc-2.3.4-2.57.s390.rpm
glibc-common-2.3.4-2.57.s390.rpm
glibc-debuginfo-2.3.4-2.57.s390.rpm
glibc-devel-2.3.4-2.57.s390.rpm
glibc-headers-2.3.4-2.57.s390.rpm
glibc-profile-2.3.4-2.57.s390.rpm
glibc-utils-2.3.4-2.57.s390.rpm
nptl-devel-2.3.4-2.57.s390.rpm
nscd-2.3.4-2.57.s390.rpm

s390x:
glibc-2.3.4-2.57.s390.rpm
glibc-2.3.4-2.57.s390x.rpm
glibc-common-2.3.4-2.57.s390x.rpm
glibc-debuginfo-2.3.4-2.57.s390.rpm
glibc-debuginfo-2.3.4-2.57.s390x.rpm
glibc-devel-2.3.4-2.57.s390.rpm
glibc-devel-2.3.4-2.57.s390x.rpm
glibc-headers-2.3.4-2.57.s390x.rpm
glibc-profile-2.3.4-2.57.s390x.rpm
glibc-utils-2.3.4-2.57.s390x.rpm
nptl-devel-2.3.4-2.57.s390x.rpm
nscd-2.3.4-2.57.s390x.rpm

x86_64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.x86_64.rpm
glibc-common-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.x86_64.rpm
glibc-headers-2.3.4-2.57.x86_64.rpm
glibc-profile-2.3.4-2.57.x86_64.rpm
glibc-utils-2.3.4-2.57.x86_64.rpm
nptl-devel-2.3.4-2.57.x86_64.rpm
nscd-2.3.4-2.57.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/glibc-2.3.4-2.57.src.rpm

i386:
glibc-2.3.4-2.57.i386.rpm
glibc-2.3.4-2.57.i686.rpm
glibc-common-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-headers-2.3.4-2.57.i386.rpm
glibc-profile-2.3.4-2.57.i386.rpm
glibc-utils-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i686.rpm
nscd-2.3.4-2.57.i386.rpm

x86_64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.x86_64.rpm
glibc-common-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.x86_64.rpm
glibc-headers-2.3.4-2.57.x86_64.rpm
glibc-profile-2.3.4-2.57.x86_64.rpm
glibc-utils-2.3.4-2.57.x86_64.rpm
nptl-devel-2.3.4-2.57.x86_64.rpm
nscd-2.3.4-2.57.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/glibc-2.3.4-2.57.src.rpm

i386:
glibc-2.3.4-2.57.i386.rpm
glibc-2.3.4-2.57.i686.rpm
glibc-common-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-headers-2.3.4-2.57.i386.rpm
glibc-profile-2.3.4-2.57.i386.rpm
glibc-utils-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i686.rpm
nscd-2.3.4-2.57.i386.rpm

ia64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.ia64.rpm
glibc-common-2.3.4-2.57.ia64.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.ia64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.ia64.rpm
glibc-headers-2.3.4-2.57.ia64.rpm
glibc-profile-2.3.4-2.57.ia64.rpm
glibc-utils-2.3.4-2.57.ia64.rpm
nptl-devel-2.3.4-2.57.ia64.rpm
nscd-2.3.4-2.57.ia64.rpm

x86_64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.x86_64.rpm
glibc-common-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.x86_64.rpm
glibc-headers-2.3.4-2.57.x86_64.rpm
glibc-profile-2.3.4-2.57.x86_64.rpm
glibc-utils-2.3.4-2.57.x86_64.rpm
nptl-devel-2.3.4-2.57.x86_64.rpm
nscd-2.3.4-2.57.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/glibc-2.3.4-2.57.src.rpm

i386:
glibc-2.3.4-2.57.i386.rpm
glibc-2.3.4-2.57.i686.rpm
glibc-common-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-headers-2.3.4-2.57.i386.rpm
glibc-profile-2.3.4-2.57.i386.rpm
glibc-utils-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i386.rpm
nptl-devel-2.3.4-2.57.i686.rpm
nscd-2.3.4-2.57.i386.rpm

ia64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.ia64.rpm
glibc-common-2.3.4-2.57.ia64.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.ia64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.ia64.rpm
glibc-headers-2.3.4-2.57.ia64.rpm
glibc-profile-2.3.4-2.57.ia64.rpm
glibc-utils-2.3.4-2.57.ia64.rpm
nptl-devel-2.3.4-2.57.ia64.rpm
nscd-2.3.4-2.57.ia64.rpm

x86_64:
glibc-2.3.4-2.57.i686.rpm
glibc-2.3.4-2.57.x86_64.rpm
glibc-common-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-2.3.4-2.57.i386.rpm
glibc-debuginfo-2.3.4-2.57.i686.rpm
glibc-debuginfo-2.3.4-2.57.x86_64.rpm
glibc-debuginfo-common-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.i386.rpm
glibc-devel-2.3.4-2.57.x86_64.rpm
glibc-headers-2.3.4-2.57.x86_64.rpm
glibc-profile-2.3.4-2.57.x86_64.rpm
glibc-utils-2.3.4-2.57.x86_64.rpm
nptl-devel-2.3.4-2.57.x86_64.rpm
nscd-2.3.4-2.57.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2009-5029.html
https://www.redhat.com/security/data/cve/CVE-2009-5064.html
https://www.redhat.com/security/data/cve/CVE-2010-0296.html
https://www.redhat.com/security/data/cve/CVE-2010-0830.html
https://www.redhat.com/security/data/cve/CVE-2011-1071.html
https://www.redhat.com/security/data/cve/CVE-2011-1089.html
https://www.redhat.com/security/data/cve/CVE-2011-1095.html
https://www.redhat.com/security/data/cve/CVE-2011-1659.html
https://www.redhat.com/security/data/cve/CVE-2011-4609.html
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPOXSCXlSAg2UNWIIRAkh2AKClH0E+XnQu1YTLXYMu5B mEKiFYcQCdHg9T
0yXdY2hQt6glY/0rlrV8Cqg=
=w0We
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

03-15-2012 03:39 PM
Moderate: glibc security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: glibc security and bug fix update
Advisory ID: RHSA-2012:0393-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0393.html
Issue date: 2012-03-15
CVE Names: CVE-2012-0864
================================================== ===================

1. Summary:

Updated glibc packages that fix one security issue and three bugs are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

The glibc packages provide the standard C and standard math libraries used
by multiple programs on the system. Without these libraries, the Linux
system cannot function correctly.

An integer overflow flaw was found in the implementation of the printf
functions family. This could allow an attacker to bypass FORTIFY_SOURCE
protections and execute arbitrary code using a format string flaw in
an application, even though these protections are expected to limit the
impact of such flaws to an application abort. (CVE-2012-0864)

This update also fixes the following bugs:

* Previously, the dynamic loader generated an incorrect ordering for
initialization according to the ELF specification. This could result in
incorrect ordering of DSO constructors and destructors. With this update,
dependency resolution has been fixed. (BZ#783999)

* Previously, locking of the main malloc arena was incorrect in the retry
path. This could result in a deadlock if an sbrk request failed. With this
update, locking of the main arena in the retry path has been fixed. This
issue was exposed by a bug fix provided in the RHSA-2012:0058 update.
(BZ#795328)

* Calling memcpy with overlapping arguments on certain processors would
generate unexpected results. While such code is a clear violation of
ANSI/ISO standards, this update restores prior memcpy behavior. (BZ#799259)

All users of glibc are advised to upgrade to these updated packages, which
contain patches to resolve these issues.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

794766 - CVE-2012-0864 glibc: FORTIFY_SOURCE format string protection bypass via "nargs" integer overflow
799259 - Change in memcpy behavior for overlapping arguments breaks existing applications

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

i386:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-headers-2.12-1.47.el6_2.9.i686.rpm
glibc-utils-2.12-1.47.el6_2.9.i686.rpm
nscd-2.12-1.47.el6_2.9.i686.rpm

x86_64:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-2.12-1.47.el6_2.9.x86_64.rpm
glibc-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.9.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.9.x86_64.rpm
nscd-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

i386:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

x86_64:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-2.12-1.47.el6_2.9.x86_64.rpm
glibc-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.9.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.9.x86_64.rpm
nscd-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

i386:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-headers-2.12-1.47.el6_2.9.i686.rpm
glibc-utils-2.12-1.47.el6_2.9.i686.rpm
nscd-2.12-1.47.el6_2.9.i686.rpm

ppc64:
glibc-2.12-1.47.el6_2.9.ppc.rpm
glibc-2.12-1.47.el6_2.9.ppc64.rpm
glibc-common-2.12-1.47.el6_2.9.ppc64.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.ppc.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.ppc64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.ppc.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.ppc64.rpm
glibc-devel-2.12-1.47.el6_2.9.ppc.rpm
glibc-devel-2.12-1.47.el6_2.9.ppc64.rpm
glibc-headers-2.12-1.47.el6_2.9.ppc64.rpm
glibc-utils-2.12-1.47.el6_2.9.ppc64.rpm
nscd-2.12-1.47.el6_2.9.ppc64.rpm

s390x:
glibc-2.12-1.47.el6_2.9.s390.rpm
glibc-2.12-1.47.el6_2.9.s390x.rpm
glibc-common-2.12-1.47.el6_2.9.s390x.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.s390.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.s390x.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.s390.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.s390x.rpm
glibc-devel-2.12-1.47.el6_2.9.s390.rpm
glibc-devel-2.12-1.47.el6_2.9.s390x.rpm
glibc-headers-2.12-1.47.el6_2.9.s390x.rpm
glibc-utils-2.12-1.47.el6_2.9.s390x.rpm
nscd-2.12-1.47.el6_2.9.s390x.rpm

x86_64:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-2.12-1.47.el6_2.9.x86_64.rpm
glibc-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.9.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.9.x86_64.rpm
nscd-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

i386:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm

ppc64:
glibc-debuginfo-2.12-1.47.el6_2.9.ppc.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.ppc64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.ppc.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.ppc64.rpm
glibc-static-2.12-1.47.el6_2.9.ppc.rpm
glibc-static-2.12-1.47.el6_2.9.ppc64.rpm

s390x:
glibc-debuginfo-2.12-1.47.el6_2.9.s390.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.s390x.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.s390.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.s390x.rpm
glibc-static-2.12-1.47.el6_2.9.s390.rpm
glibc-static-2.12-1.47.el6_2.9.s390x.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

i386:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-headers-2.12-1.47.el6_2.9.i686.rpm
glibc-utils-2.12-1.47.el6_2.9.i686.rpm
nscd-2.12-1.47.el6_2.9.i686.rpm

x86_64:
glibc-2.12-1.47.el6_2.9.i686.rpm
glibc-2.12-1.47.el6_2.9.x86_64.rpm
glibc-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-devel-2.12-1.47.el6_2.9.i686.rpm
glibc-devel-2.12-1.47.el6_2.9.x86_64.rpm
glibc-headers-2.12-1.47.el6_2.9.x86_64.rpm
glibc-utils-2.12-1.47.el6_2.9.x86_64.rpm
nscd-2.12-1.47.el6_2.9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/glibc-2.12-1.47.el6_2.9.src.rpm

i386:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm

x86_64:
glibc-debuginfo-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-2.12-1.47.el6_2.9.x86_64.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.i686.rpm
glibc-debuginfo-common-2.12-1.47.el6_2.9.x86_64.rpm
glibc-static-2.12-1.47.el6_2.9.i686.rpm
glibc-static-2.12-1.47.el6_2.9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-0864.html
https://access.redhat.com/security/updates/classification/#moderate
https://rhn.redhat.com/errata/RHSA-2012-0058.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPYhsdXlSAg2UNWIIRAp6UAJ9KMWB3Beu2SzdJ3xMRpj DdPcCmhwCdHcTh
UvwVKb24VSzaZTqsEU9k0j8=
=Vf1g
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

07-18-2012 03:29 PM
Moderate: glibc security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: glibc security and bug fix update
Advisory ID: RHSA-2012:1097-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1097.html
Issue date: 2012-07-18
CVE Names: CVE-2012-3406
================================================== ===================

1. Summary:

Updated glibc packages that fix one security issue and one bug are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

The glibc packages provide the standard C and standard math libraries used
by multiple programs on the system. Without these libraries, the Linux
system cannot function properly.

It was discovered that the formatted printing functionality in glibc did
not properly restrict the use of alloca(). This could allow an attacker to
bypass FORTIFY_SOURCE protections and execute arbitrary code using a format
string flaw in an application, even though these protections are expected
to limit the impact of such flaws to an application abort. (CVE-2012-3406)

This update also fixes the following bug:

* If a file or a string was in the IBM-930 encoding, and contained the
invalid multibyte character "0xffff", attempting to use iconv() (or the
iconv command) to convert that file or string to another encoding, such as
UTF-8, resulted in a segmentation fault. With this update, the conversion
code for the IBM-930 encoding recognizes this invalid character and calls
an error handler, rather than causing a segmentation fault. (BZ#837896)

All users of glibc are advised to upgrade to these updated packages, which
contain backported patches to fix these issues.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

826943 - CVE-2012-3406 glibc: printf() unbound alloca() usage in case of positional parameters + many format specs

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/glibc-2.5-81.el5_8.4.src.rpm

i386:
glibc-2.5-81.el5_8.4.i386.rpm
glibc-2.5-81.el5_8.4.i686.rpm
glibc-common-2.5-81.el5_8.4.i386.rpm
glibc-debuginfo-2.5-81.el5_8.4.i386.rpm
glibc-debuginfo-2.5-81.el5_8.4.i686.rpm
glibc-debuginfo-common-2.5-81.el5_8.4.i386.rpm
glibc-devel-2.5-81.el5_8.4.i386.rpm
glibc-headers-2.5-81.el5_8.4.i386.rpm
glibc-utils-2.5-81.el5_8.4.i386.rpm
nscd-2.5-81.el5_8.4.i386.rpm

x86_64:
glibc-2.5-81.el5_8.4.i686.rpm
glibc-2.5-81.el5_8.4.x86_64.rpm
glibc-common-2.5-81.el5_8.4.x86_64.rpm
glibc-debuginfo-2.5-81.el5_8.4.i386.rpm
glibc-debuginfo-2.5-81.el5_8.4.i686.rpm
glibc-debuginfo-2.5-81.el5_8.4.x86_64.rpm
glibc-debuginfo-common-2.5-81.el5_8.4.i386.rpm
glibc-devel-2.5-81.el5_8.4.i386.rpm
glibc-devel-2.5-81.el5_8.4.x86_64.rpm
glibc-headers-2.5-81.el5_8.4.x86_64.rpm
glibc-utils-2.5-81.el5_8.4.x86_64.rpm
nscd-2.5-81.el5_8.4.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/glibc-2.5-81.el5_8.4.src.rpm

i386:
glibc-2.5-81.el5_8.4.i386.rpm
glibc-2.5-81.el5_8.4.i686.rpm
glibc-common-2.5-81.el5_8.4.i386.rpm
glibc-debuginfo-2.5-81.el5_8.4.i386.rpm
glibc-debuginfo-2.5-81.el5_8.4.i686.rpm
glibc-debuginfo-common-2.5-81.el5_8.4.i386.rpm
glibc-devel-2.5-81.el5_8.4.i386.rpm
glibc-headers-2.5-81.el5_8.4.i386.rpm
glibc-utils-2.5-81.el5_8.4.i386.rpm
nscd-2.5-81.el5_8.4.i386.rpm

ia64:
glibc-2.5-81.el5_8.4.i686.rpm
glibc-2.5-81.el5_8.4.ia64.rpm
glibc-common-2.5-81.el5_8.4.ia64.rpm
glibc-debuginfo-2.5-81.el5_8.4.i686.rpm
glibc-debuginfo-2.5-81.el5_8.4.ia64.rpm
glibc-devel-2.5-81.el5_8.4.ia64.rpm
glibc-headers-2.5-81.el5_8.4.ia64.rpm
glibc-utils-2.5-81.el5_8.4.ia64.rpm
nscd-2.5-81.el5_8.4.ia64.rpm

ppc:
glibc-2.5-81.el5_8.4.ppc.rpm
glibc-2.5-81.el5_8.4.ppc64.rpm
glibc-common-2.5-81.el5_8.4.ppc.rpm
glibc-debuginfo-2.5-81.el5_8.4.ppc.rpm
glibc-debuginfo-2.5-81.el5_8.4.ppc64.rpm
glibc-devel-2.5-81.el5_8.4.ppc.rpm
glibc-devel-2.5-81.el5_8.4.ppc64.rpm
glibc-headers-2.5-81.el5_8.4.ppc.rpm
glibc-utils-2.5-81.el5_8.4.ppc.rpm
nscd-2.5-81.el5_8.4.ppc.rpm

s390x:
glibc-2.5-81.el5_8.4.s390.rpm
glibc-2.5-81.el5_8.4.s390x.rpm
glibc-common-2.5-81.el5_8.4.s390x.rpm
glibc-debuginfo-2.5-81.el5_8.4.s390.rpm
glibc-debuginfo-2.5-81.el5_8.4.s390x.rpm
glibc-devel-2.5-81.el5_8.4.s390.rpm
glibc-devel-2.5-81.el5_8.4.s390x.rpm
glibc-headers-2.5-81.el5_8.4.s390x.rpm
glibc-utils-2.5-81.el5_8.4.s390x.rpm
nscd-2.5-81.el5_8.4.s390x.rpm

x86_64:
glibc-2.5-81.el5_8.4.i686.rpm
glibc-2.5-81.el5_8.4.x86_64.rpm
glibc-common-2.5-81.el5_8.4.x86_64.rpm
glibc-debuginfo-2.5-81.el5_8.4.i386.rpm
glibc-debuginfo-2.5-81.el5_8.4.i686.rpm
glibc-debuginfo-2.5-81.el5_8.4.x86_64.rpm
glibc-debuginfo-common-2.5-81.el5_8.4.i386.rpm
glibc-devel-2.5-81.el5_8.4.i386.rpm
glibc-devel-2.5-81.el5_8.4.x86_64.rpm
glibc-headers-2.5-81.el5_8.4.x86_64.rpm
glibc-utils-2.5-81.el5_8.4.x86_64.rpm
nscd-2.5-81.el5_8.4.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-3406.html
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFQBtY4XlSAg2UNWIIRAgxaAJ9JvAX7lw/9KWNIc7oiV83BY6HTawCfbCEK
vp+gffA7Y5ZuRVrwAdccwa8=
=HBmV
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

07-18-2012 03:31 PM
Moderate: glibc security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: glibc security and bug fix update
Advisory ID: RHSA-2012:1098-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1098.html
Issue date: 2012-07-18
CVE Names: CVE-2012-3404 CVE-2012-3405 CVE-2012-3406
================================================== ===================

1. Summary:

Updated glibc packages that fix three security issues and one bug are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

The glibc packages provide the standard C and standard math libraries used
by multiple programs on the system. Without these libraries, the Linux
system cannot function properly.

Multiple errors in glibc's formatted printing functionality could allow an
attacker to bypass FORTIFY_SOURCE protections and execute arbitrary code
using a format string flaw in an application, even though these protections
are expected to limit the impact of such flaws to an application abort.
(CVE-2012-3404, CVE-2012-3405, CVE-2012-3406)

This update also fixes the following bug:

* A programming error caused an internal array of nameservers to be only
partially initialized when the /etc/resolv.conf file contained IPv6
nameservers. Depending on the contents of a nearby structure, this could
cause certain applications to terminate unexpectedly with a segmentation
fault. The programming error has been fixed, which restores proper behavior
with IPv6 nameservers listed in the /etc/resolv.conf file. (BZ#837026)

All users of glibc are advised to upgrade to these updated packages, which
contain backported patches to fix these issues.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

826943 - CVE-2012-3406 glibc: printf() unbound alloca() usage in case of positional parameters + many format specs
833703 - CVE-2012-3404 glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
833704 - CVE-2012-3405 glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
837026 - libresolv dumps core when IPv6 address in resolv.conf

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

i386:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-headers-2.12-1.80.el6_3.3.i686.rpm
glibc-utils-2.12-1.80.el6_3.3.i686.rpm
nscd-2.12-1.80.el6_3.3.i686.rpm

x86_64:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-2.12-1.80.el6_3.3.x86_64.rpm
glibc-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.x86_64.rpm
glibc-headers-2.12-1.80.el6_3.3.x86_64.rpm
glibc-utils-2.12-1.80.el6_3.3.x86_64.rpm
nscd-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

i386:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm

x86_64:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

x86_64:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-2.12-1.80.el6_3.3.x86_64.rpm
glibc-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.x86_64.rpm
glibc-headers-2.12-1.80.el6_3.3.x86_64.rpm
glibc-utils-2.12-1.80.el6_3.3.x86_64.rpm
nscd-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

x86_64:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

i386:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-headers-2.12-1.80.el6_3.3.i686.rpm
glibc-utils-2.12-1.80.el6_3.3.i686.rpm
nscd-2.12-1.80.el6_3.3.i686.rpm

ppc64:
glibc-2.12-1.80.el6_3.3.ppc.rpm
glibc-2.12-1.80.el6_3.3.ppc64.rpm
glibc-common-2.12-1.80.el6_3.3.ppc64.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.ppc.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.ppc64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.ppc.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.ppc64.rpm
glibc-devel-2.12-1.80.el6_3.3.ppc.rpm
glibc-devel-2.12-1.80.el6_3.3.ppc64.rpm
glibc-headers-2.12-1.80.el6_3.3.ppc64.rpm
glibc-utils-2.12-1.80.el6_3.3.ppc64.rpm
nscd-2.12-1.80.el6_3.3.ppc64.rpm

s390x:
glibc-2.12-1.80.el6_3.3.s390.rpm
glibc-2.12-1.80.el6_3.3.s390x.rpm
glibc-common-2.12-1.80.el6_3.3.s390x.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.s390.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.s390x.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.s390.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.s390x.rpm
glibc-devel-2.12-1.80.el6_3.3.s390.rpm
glibc-devel-2.12-1.80.el6_3.3.s390x.rpm
glibc-headers-2.12-1.80.el6_3.3.s390x.rpm
glibc-utils-2.12-1.80.el6_3.3.s390x.rpm
nscd-2.12-1.80.el6_3.3.s390x.rpm

x86_64:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-2.12-1.80.el6_3.3.x86_64.rpm
glibc-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.x86_64.rpm
glibc-headers-2.12-1.80.el6_3.3.x86_64.rpm
glibc-utils-2.12-1.80.el6_3.3.x86_64.rpm
nscd-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

i386:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm

ppc64:
glibc-debuginfo-2.12-1.80.el6_3.3.ppc.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.ppc64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.ppc.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.ppc64.rpm
glibc-static-2.12-1.80.el6_3.3.ppc.rpm
glibc-static-2.12-1.80.el6_3.3.ppc64.rpm

s390x:
glibc-debuginfo-2.12-1.80.el6_3.3.s390.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.s390x.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.s390.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.s390x.rpm
glibc-static-2.12-1.80.el6_3.3.s390.rpm
glibc-static-2.12-1.80.el6_3.3.s390x.rpm

x86_64:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

i386:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-headers-2.12-1.80.el6_3.3.i686.rpm
glibc-utils-2.12-1.80.el6_3.3.i686.rpm
nscd-2.12-1.80.el6_3.3.i686.rpm

x86_64:
glibc-2.12-1.80.el6_3.3.i686.rpm
glibc-2.12-1.80.el6_3.3.x86_64.rpm
glibc-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-devel-2.12-1.80.el6_3.3.i686.rpm
glibc-devel-2.12-1.80.el6_3.3.x86_64.rpm
glibc-headers-2.12-1.80.el6_3.3.x86_64.rpm
glibc-utils-2.12-1.80.el6_3.3.x86_64.rpm
nscd-2.12-1.80.el6_3.3.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/glibc-2.12-1.80.el6_3.3.src.rpm

i386:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm

x86_64:
glibc-debuginfo-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-2.12-1.80.el6_3.3.x86_64.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.i686.rpm
glibc-debuginfo-common-2.12-1.80.el6_3.3.x86_64.rpm
glibc-static-2.12-1.80.el6_3.3.i686.rpm
glibc-static-2.12-1.80.el6_3.3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-3404.html
https://www.redhat.com/security/data/cve/CVE-2012-3405.html
https://www.redhat.com/security/data/cve/CVE-2012-3406.html
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFQBtZoXlSAg2UNWIIRAn31AKC95bOMB/b8gzdueQYeWN5p417sWQCfSShZ
rssv+fXNRGWsmg8KX5hEruk=
=TeTR
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

08-27-2012 01:19 PM
Moderate: glibc security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: glibc security and bug fix update
Advisory ID: RHSA-2012:1207-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1207.html
Issue date: 2012-08-27
CVE Names: CVE-2012-3480
================================================== ===================

1. Summary:

Updated glibc packages that fix multiple security issues and one bug are
now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

The glibc packages provide the standard C and standard math libraries used
by multiple programs on the system. Without these libraries, the Linux
system cannot function properly.

Multiple integer overflow flaws, leading to stack-based buffer overflows,
were found in glibc's functions for converting a string to a numeric
representation (strtod(), strtof(), and strtold()). If an application used
such a function on attacker controlled input, it could cause the
application to crash or, potentially, execute arbitrary code.
(CVE-2012-3480)

This update also fixes the following bug:

* Previously, logic errors in various mathematical functions, including
exp, exp2, expf, exp2f, pow, sin, tan, and rint, caused inconsistent
results when the functions were used with the non-default rounding mode.
This could also cause applications to crash in some cases. With this
update, the functions now give correct results across the four different
rounding modes. (BZ#839411)

All users of glibc are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

847715 - CVE-2012-3480 glibc: Integer overflows, leading to stack-based buffer overflows in strto* related routines

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/glibc-2.5-81.el5_8.7.src.rpm

i386:
glibc-2.5-81.el5_8.7.i386.rpm
glibc-2.5-81.el5_8.7.i686.rpm
glibc-common-2.5-81.el5_8.7.i386.rpm
glibc-debuginfo-2.5-81.el5_8.7.i386.rpm
glibc-debuginfo-2.5-81.el5_8.7.i686.rpm
glibc-debuginfo-common-2.5-81.el5_8.7.i386.rpm
glibc-devel-2.5-81.el5_8.7.i386.rpm
glibc-headers-2.5-81.el5_8.7.i386.rpm
glibc-utils-2.5-81.el5_8.7.i386.rpm
nscd-2.5-81.el5_8.7.i386.rpm

x86_64:
glibc-2.5-81.el5_8.7.i686.rpm
glibc-2.5-81.el5_8.7.x86_64.rpm
glibc-common-2.5-81.el5_8.7.x86_64.rpm
glibc-debuginfo-2.5-81.el5_8.7.i386.rpm
glibc-debuginfo-2.5-81.el5_8.7.i686.rpm
glibc-debuginfo-2.5-81.el5_8.7.x86_64.rpm
glibc-debuginfo-common-2.5-81.el5_8.7.i386.rpm
glibc-devel-2.5-81.el5_8.7.i386.rpm
glibc-devel-2.5-81.el5_8.7.x86_64.rpm
glibc-headers-2.5-81.el5_8.7.x86_64.rpm
glibc-utils-2.5-81.el5_8.7.x86_64.rpm
nscd-2.5-81.el5_8.7.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/glibc-2.5-81.el5_8.7.src.rpm

i386:
glibc-2.5-81.el5_8.7.i386.rpm
glibc-2.5-81.el5_8.7.i686.rpm
glibc-common-2.5-81.el5_8.7.i386.rpm
glibc-debuginfo-2.5-81.el5_8.7.i386.rpm
glibc-debuginfo-2.5-81.el5_8.7.i686.rpm
glibc-debuginfo-common-2.5-81.el5_8.7.i386.rpm
glibc-devel-2.5-81.el5_8.7.i386.rpm
glibc-headers-2.5-81.el5_8.7.i386.rpm
glibc-utils-2.5-81.el5_8.7.i386.rpm
nscd-2.5-81.el5_8.7.i386.rpm

ia64:
glibc-2.5-81.el5_8.7.i686.rpm
glibc-2.5-81.el5_8.7.ia64.rpm
glibc-common-2.5-81.el5_8.7.ia64.rpm
glibc-debuginfo-2.5-81.el5_8.7.i686.rpm
glibc-debuginfo-2.5-81.el5_8.7.ia64.rpm
glibc-devel-2.5-81.el5_8.7.ia64.rpm
glibc-headers-2.5-81.el5_8.7.ia64.rpm
glibc-utils-2.5-81.el5_8.7.ia64.rpm
nscd-2.5-81.el5_8.7.ia64.rpm

ppc:
glibc-2.5-81.el5_8.7.ppc.rpm
glibc-2.5-81.el5_8.7.ppc64.rpm
glibc-common-2.5-81.el5_8.7.ppc.rpm
glibc-debuginfo-2.5-81.el5_8.7.ppc.rpm
glibc-debuginfo-2.5-81.el5_8.7.ppc64.rpm
glibc-devel-2.5-81.el5_8.7.ppc.rpm
glibc-devel-2.5-81.el5_8.7.ppc64.rpm
glibc-headers-2.5-81.el5_8.7.ppc.rpm
glibc-utils-2.5-81.el5_8.7.ppc.rpm
nscd-2.5-81.el5_8.7.ppc.rpm

s390x:
glibc-2.5-81.el5_8.7.s390.rpm
glibc-2.5-81.el5_8.7.s390x.rpm
glibc-common-2.5-81.el5_8.7.s390x.rpm
glibc-debuginfo-2.5-81.el5_8.7.s390.rpm
glibc-debuginfo-2.5-81.el5_8.7.s390x.rpm
glibc-devel-2.5-81.el5_8.7.s390.rpm
glibc-devel-2.5-81.el5_8.7.s390x.rpm
glibc-headers-2.5-81.el5_8.7.s390x.rpm
glibc-utils-2.5-81.el5_8.7.s390x.rpm
nscd-2.5-81.el5_8.7.s390x.rpm

x86_64:
glibc-2.5-81.el5_8.7.i686.rpm
glibc-2.5-81.el5_8.7.x86_64.rpm
glibc-common-2.5-81.el5_8.7.x86_64.rpm
glibc-debuginfo-2.5-81.el5_8.7.i386.rpm
glibc-debuginfo-2.5-81.el5_8.7.i686.rpm
glibc-debuginfo-2.5-81.el5_8.7.x86_64.rpm
glibc-debuginfo-common-2.5-81.el5_8.7.i386.rpm
glibc-devel-2.5-81.el5_8.7.i386.rpm
glibc-devel-2.5-81.el5_8.7.x86_64.rpm
glibc-headers-2.5-81.el5_8.7.x86_64.rpm
glibc-utils-2.5-81.el5_8.7.x86_64.rpm
nscd-2.5-81.el5_8.7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-3480.html
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFQO3O9XlSAg2UNWIIRAjc/AJ0YkDPrWqB76Ab8BAjSOqQXN0x7IACeOnRl
WMKukS0t4LIc5NaInuuutus=
=agtB
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


All times are GMT. The time now is 01:35 PM.

VBulletin, Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.