10961940 2003-11-12 11:30 -0500 /318 rader/ <bugzilla@redhat.com>
Importerad: 2003-11-12 18:35 av Brevbäraren
Extern mottagare: redhat-watch-list@redhat.com
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: full-disclosure@lists.netsys.com
Mottagare: Bugtraq (import) <29866>
Mottagare: Red Hat Announce (import) <2391>
Sänt: 2003-11-13 06:39
Ärende: [RHSA-2003:325-01] Updated glibc packages provide security and bug fixes
------------------------------------------------------------
From: bugzilla@redhat.com
To: redhat-watch-list@redhat.com, bugtraq@securityfocus.com,
full-disclosure@lists.netsys.com
Cc:
Message-ID: <200311121630.hACGUsP29403@porkchop.devel.redhat.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated glibc packages provide security and bug fixes
Advisory ID: RHSA-2003:325-01
Issue date: 2003-11-12
Updated on: 2003-11-12
Product: Red Hat Linux
Keywords: netlink getgrouplist
Cross references:
Obsoletes: RHSA-2003:212
CVE Names: CAN-2003-0689 CAN-2003-0859
- ---------------------------------------------------------------------
1. Topic:
Updated glibc packages that resolve vulnerabilities and address
several bugs are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.1 - i386, i686
Red Hat Linux 7.2 - i386, i686, ia64
Red Hat Linux 7.3 - i386, i686
Red Hat Linux 8.0 - i386, i686
Red Hat Linux 9 - i386, i686
3. Problem description:
The glibc packages contain GNU libc, which provides standard system
libraries.
A bug in the getgrouplist function can cause a buffer overflow if the
size of the group list is too small to hold all the user's groups.
This overflow can cause segmentation faults in user applications,
which may have security implications, depending on the application in
question. This vulnerability exists only when an administrator has
placed a user in a number of groups larger than that expected by an
application. Therefore, there is no risk in instances where users are
members of few groups. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0689 to this
issue.
Herbert Xu reported that various applications can accept spoofed
messages sent on the kernel netlink interface by other users on the
local machine. This could lead to a local denial of service attack.
In Red Hat Linux 9 and later, the glibc function getifaddrs uses
netlink and could therefore be vulnerable to this issue. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2003-0859 to this issue.
In addition to the security issues, a number of other bugs were fixed.
Users are advised to upgrade to these erratum packages, which contain
a patch that checks that netlink messages actually came from the
kernel, a backported security patch for the getgroups list
vulnerability, and patches for the various bug fixes.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run the following
command at a shell prompt:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. On the
i686 architecture, *.i686.rpm packages should be installed where
available rather than *.i386.rpm.
If you are unsure which architecture you are on, run the following
command at a shell prompt:
rpm -q --qf '%{arch}\n' glibc
Only those RPMs which are currently installed will be updated. Those
RPMs which are not installed but included in the list will not be
updated. Note that you can also use wildcards (*.rpm) if your
current directory only contains the desired RPMs.
Please note that this update is also available via Red Hat Network.
Many people find this an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
If up2date fails to connect to Red Hat Network due to SSL Certificate
Errors, you need to install a version of the up2date client with an
updated certificate. The latest version of up2date is available from
the Red Hat FTP site and may also be downloaded directly from the RHN
website:
https://rhn.redhat.com/help/latest-up2date.pxt
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
54697 - nscd locks immediately if started with -t 1 and nss_ldap is
used 83973 - Wrong sort order for uk_UA locale 85994 - SIGSEGV in
malloc: __morecore clobbered by perror conflict with _IO_check_libio
86032 - trailing spaces in /etc/ld.so.conf entries are not ignored
88409 - strxfrm() overruns buffer by indexing with uninitialized
value 88456 - glibc-2.3.2-27.9.i686.rpm does not rpm -Fvh properly.
88978 - locale ja_JP.EUC-JP has two undefined bytes [buffer overrun]
89448 - getaddrinfo segv - unitialized structure? 90002 - binary
compatibility for '_res' broken in glibc 2.3.x 90036 - race/deadlock
in fork() with signal handler. 90077 - fopen@GLIBC_2_0 corrupts
memory arena by buffer overrun 90301 - Programs fail at exit if
compiled with gcc and cxa_atexit 90987 - sprintf() is limited to 2^26
bytes. 91567 - setegid sets saved gid 97814 - "Incorrectly built
binary which accesses errno..." message in elf/rtld.c needs some way
to be silenced. 97828 - Sudo returns segmentation fault 98966 -
ldconfig automatically prepends /usr/lib and /lib to search order
101261 - getnameinfo fails to to reverse lookup on IPv6 addresses
101691 - CAN-2003-0689 Buffer overrun in getgrouplist function in
initgroups.c 102709 - NPTL pthread_cond_broadcast hangs. 103727 -
LD_PROFILE=libc.so.6 and sprof give seg fault 105348 - Closing socket
breaks the cancellation type of current thread 107846 - locale
utility is broken on big-endian 64-bit platforms 108634 - Signal
handler installation races with signal, glibc-2.3.2
6. RPMs required:
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/glibc-2.2.4-33.src.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/glibc-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-common-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/nscd-2.2.4-33.i386.rpm
i686:
ftp://updates.redhat.com/7.1/en/os/i686/glibc-2.2.4-33.i686.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/glibc-2.2.4-33.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/glibc-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-common-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nscd-2.2.4-33.i386.rpm
i686:
ftp://updates.redhat.com/7.2/en/os/i686/glibc-2.2.4-33.i686.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-common-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-devel-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-profile-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/nscd-2.2.4-33.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/glibc-2.2.5-44.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/glibc-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-common-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-debug-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-debug-static-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-devel-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-profile-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-utils-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/nscd-2.2.5-44.i386.rpm
i686:
ftp://updates.redhat.com/7.3/en/os/i686/glibc-2.2.5-44.i686.rpm
ftp://updates.redhat.com/7.3/en/os/i686/glibc-debug-2.2.5-44.i686.rpm
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/glibc-2.3.2-4.80.8.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/glibc-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-common-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/nscd-2.3.2-4.80.8.i386.rpm
i686:
ftp://updates.redhat.com/8.0/en/os/i686/glibc-2.3.2-4.80.8.i686.rpm
ftp://updates.redhat.com/8.0/en/os/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
Red Hat Linux 9:
SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/glibc-2.3.2-27.9.6.src.rpm
i386:
ftp://updates.redhat.com/9/en/os/i386/glibc-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-common-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-debug-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-devel-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-profile-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-utils-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/nscd-2.3.2-27.9.6.i386.rpm
i686:
ftp://updates.redhat.com/9/en/os/i686/glibc-2.3.2-27.9.6.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/nptl-devel-2.3.2-27.9.6.i686.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
08a9d7fdb2cc277c80f5a0e1529d7774 7.1/en/os/SRPMS/glibc-2.2.4-33.src.rpm
83d041d5a108d6a27d5bb7e465c62d45 7.1/en/os/i386/glibc-2.2.4-33.i386.rpm
a99df9fce0cf177d42f611ca178a6717 7.1/en/os/i386/glibc-common-2.2.4-33.i386.rpm
9848447715453548af83418087deccd4 7.1/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
d68a6aec30cf1e7d8fb7fc1c0b95e00d 7.1/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
bee8aa9dd31b75b099c9fc6c5bd3295f 7.1/en/os/i386/nscd-2.2.4-33.i386.rpm
5585734c0358b3ba1f952dedbd9c443f 7.1/en/os/i686/glibc-2.2.4-33.i686.rpm
08a9d7fdb2cc277c80f5a0e1529d7774 7.2/en/os/SRPMS/glibc-2.2.4-33.src.rpm
83d041d5a108d6a27d5bb7e465c62d45 7.2/en/os/i386/glibc-2.2.4-33.i386.rpm
a99df9fce0cf177d42f611ca178a6717 7.2/en/os/i386/glibc-common-2.2.4-33.i386.rpm
9848447715453548af83418087deccd4 7.2/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
d68a6aec30cf1e7d8fb7fc1c0b95e00d 7.2/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
bee8aa9dd31b75b099c9fc6c5bd3295f 7.2/en/os/i386/nscd-2.2.4-33.i386.rpm
5585734c0358b3ba1f952dedbd9c443f 7.2/en/os/i686/glibc-2.2.4-33.i686.rpm
d0ded4d10fc72bfa3da24de5a7a078a0 7.2/en/os/ia64/glibc-2.2.4-33.ia64.rpm
44a7683cdfd8f763ccb1405784815fe4 7.2/en/os/ia64/glibc-common-2.2.4-33.ia64.rpm
5bd01df1cfc06fed52b3dd2928cef950 7.2/en/os/ia64/glibc-devel-2.2.4-33.ia64.rpm
27738cfcb12b46ee61e02950b39ed44e 7.2/en/os/ia64/glibc-profile-2.2.4-33.ia64.rpm
a0aad5ab63319615dac47dde5b5d9e16 7.2/en/os/ia64/nscd-2.2.4-33.ia64.rpm
8a161087ca8a0262fd1cdec70a0486a6 7.3/en/os/SRPMS/glibc-2.2.5-44.src.rpm
eb0107c7a3187b0c782314bf3cf38771 7.3/en/os/i386/glibc-2.2.5-44.i386.rpm
a22c95134d40d601ba1ee4dd69cb8372 7.3/en/os/i386/glibc-common-2.2.5-44.i386.rpm
46ed43e8ce6108be6dc628dc14093df5 7.3/en/os/i386/glibc-debug-2.2.5-44.i386.rpm
7945db62704b881f661b6972420564c1 7.3/en/os/i386/glibc-debug-static-2.2.5-44.i386.rpm
128c022a95b405e9628711f65e9bdf0b 7.3/en/os/i386/glibc-devel-2.2.5-44.i386.rpm
241a34a7487d9ff11bea274a11812f73 7.3/en/os/i386/glibc-profile-2.2.5-44.i386.rpm
1ba6bb800c87ed6eb497862da2e5d428 7.3/en/os/i386/glibc-utils-2.2.5-44.i386.rpm
3a465a1bbb95463cc837f1a3e7a20dbd 7.3/en/os/i386/nscd-2.2.5-44.i386.rpm
6c915957618eb229d17f1db2f0684f0f 7.3/en/os/i686/glibc-2.2.5-44.i686.rpm
82fe179cf917a3b012bdb1b2c50d6e7d 7.3/en/os/i686/glibc-debug-2.2.5-44.i686.rpm
d6c96dff6893d449a57439ec3b362ded 8.0/en/os/SRPMS/glibc-2.3.2-4.80.8.src.rpm
8058c50430bca5ee527c3521b8cd5019 8.0/en/os/i386/glibc-2.3.2-4.80.8.i386.rpm
62019c1ecff44880be70871a9b52c4bc 8.0/en/os/i386/glibc-common-2.3.2-4.80.8.i386.rpm
854a98301d8b8000c752a25d70b6634b 8.0/en/os/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
44eb3be20de572a08370182cb5ee82d9 8.0/en/os/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
4b091e271eac8c15ff68112b8b74b597 8.0/en/os/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
1bf2647c6eadf4ca934f9a8e6ab5c8d4 8.0/en/os/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
abfc2b5f8ee84966f136a6d703fb104d 8.0/en/os/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
0c890751f548c460207e2514ca61b3ca 8.0/en/os/i386/nscd-2.3.2-4.80.8.i386.rpm
44d62332cb2494a62ad95473237b5ad4 8.0/en/os/i686/glibc-2.3.2-4.80.8.i686.rpm
1a74ed2bd5bc54a33f21543a59805235 8.0/en/os/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
2a2ec48adc275c5ca2a7fa29529d4157 9/en/os/SRPMS/glibc-2.3.2-27.9.6.src.rpm
a2deae76869c4173910ebd482f140139 9/en/os/i386/glibc-2.3.2-27.9.6.i386.rpm
5aa9e4868b5d5a8cfc232ee19096c4ed 9/en/os/i386/glibc-common-2.3.2-27.9.6.i386.rpm
2c9451914752bb1c26be6252856c7d38 9/en/os/i386/glibc-debug-2.3.2-27.9.6.i386.rpm
0e85291a87bae9b30f1891f91cb61980 9/en/os/i386/glibc-devel-2.3.2-27.9.6.i386.rpm
10cf4ad3eb09a3d18ac636631f985adb 9/en/os/i386/glibc-profile-2.3.2-27.9.6.i386.rpm
fdd6064c2d2ae288c07b4188d49aed9b 9/en/os/i386/glibc-utils-2.3.2-27.9.6.i386.rpm
473a90c0dadf8bee9d4d803d62dc8725 9/en/os/i386/nscd-2.3.2-27.9.6.i386.rpm
412364110c5c52e685a2c4707617c151 9/en/os/i686/glibc-2.3.2-27.9.6.i686.rpm
e56d3557401d30554f9766421153ca47 9/en/os/i686/nptl-devel-2.3.2-27.9.6.i686.rpm
These packages are GPG signed by Red Hat for security. Our key is
available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0859
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE/smAyXlSAg2UNWIIRAnITAJ46jCDG/j58ilJCAte7SJzDnGp7PQCfTc1k
I0tbY2v0ZLxXwA0GnzfFNxU=
=I+1q
-----END PGP SIGNATURE-----
(10961940) /<bugzilla@redhat.com>/--------(Ombruten)
Kommentar i text 10964292 av Nixon (remontado)
10967909 2003-11-13 16:20 -0500 /321 rader/ <bugzilla@redhat.com>
Sänt av: redhat-watch-list-admin@redhat.com
Importerad: 2003-11-13 22:40 av Brevbäraren
Extern mottagare: redhat-watch-list@redhat.com
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: full-disclosure@lists.netsys.com
Mottagare: Red Hat Announce (import) <2394>
Mottagare: Bugtraq (import) <29909>
Sänt: 2003-11-13 23:50
Ärende: [RHSA-2003:325-01] Updated glibc packages provide security and bug fixes
------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated glibc packages provide security and bug fixes
Advisory ID: RHSA-2003:325-01
Issue date: 2003-11-12
Updated on: 2003-11-13
Product: Red Hat Linux
Keywords: netlink getgrouplist
Cross references:
Obsoletes: RHSA-2003:212
CVE Names: CAN-2003-0689 CAN-2003-0859
- ---------------------------------------------------------------------
1. Topic:
Updated glibc packages that resolve vulnerabilities and address
several bugs are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.1 - i386, i686
Red Hat Linux 7.2 - i386, i686, ia64
Red Hat Linux 7.3 - i386, i686
Red Hat Linux 8.0 - i386, i686
Red Hat Linux 9 - i386, i686
3. Problem description:
The glibc packages contain GNU libc, which provides standard system
libraries.
A bug in the getgrouplist function can cause a buffer overflow if the
size of the group list is too small to hold all the user's groups.
This overflow can cause segmentation faults in user applications,
which may have security implications, depending on the application in
question. This vulnerability exists only when an administrator has
placed a user in a number of groups larger than that expected by an
application. Therefore, there is no risk in instances where users are
members of few groups. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0689 to this
issue.
Herbert Xu reported that various applications can accept spoofed
messages sent on the kernel netlink interface by other users on the
local machine. This could lead to a local denial of service attack.
In Red Hat Linux 9 and later, the glibc function getifaddrs uses
netlink and could therefore be vulnerable to this issue. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2003-0859 to this issue.
In addition to the security issues, a number of other bugs were fixed.
Users are advised to upgrade to these erratum packages, which contain
a patch that checks that netlink messages actually came from the
kernel, a backported security patch for the getgroups list
vulnerability, and patches for the various bug fixes.
[Update 2003-11-13]: The packages for Red Hat Linux 9 have been
updated for compatibility with kernels not provided by Red Hat.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run the following
command at a shell prompt:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. On the
i686 architecture, *.i686.rpm packages should be installed where
available rather than *.i386.rpm.
If you are unsure which architecture you are on, run the following
command at a shell prompt:
rpm -q --qf '%{arch}\n' glibc
Only those RPMs which are currently installed will be updated. Those
RPMs which are not installed but included in the list will not be
updated. Note that you can also use wildcards (*.rpm) if your
current directory only contains the desired RPMs.
Please note that this update is also available via Red Hat Network.
Many people find this an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
If up2date fails to connect to Red Hat Network due to SSL Certificate
Errors, you need to install a version of the up2date client with an
updated certificate. The latest version of up2date is available from
the Red Hat FTP site and may also be downloaded directly from the RHN
website:
https://rhn.redhat.com/help/latest-up2date.pxt
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
54697 - nscd locks immediately if started with -t 1 and nss_ldap is
used 83973 - Wrong sort order for uk_UA locale 85994 - SIGSEGV in
malloc: __morecore clobbered by perror conflict with _IO_check_libio
86032 - trailing spaces in /etc/ld.so.conf entries are not ignored
88409 - strxfrm() overruns buffer by indexing with uninitialized
value 88456 - glibc-2.3.2-27.9.i686.rpm does not rpm -Fvh properly.
88978 - locale ja_JP.EUC-JP has two undefined bytes [buffer overrun]
89448 - getaddrinfo segv - unitialized structure? 90002 - binary
compatibility for '_res' broken in glibc 2.3.x 90036 - race/deadlock
in fork() with signal handler. 90077 - fopen@GLIBC_2_0 corrupts
memory arena by buffer overrun 90301 - Programs fail at exit if
compiled with gcc and cxa_atexit 90987 - sprintf() is limited to 2^26
bytes. 91567 - setegid sets saved gid 97814 - "Incorrectly built
binary which accesses errno..." message in elf/rtld.c needs some way
to be silenced. 97828 - Sudo returns segmentation fault 98966 -
ldconfig automatically prepends /usr/lib and /lib to search order
101261 - getnameinfo fails to to reverse lookup on IPv6 addresses
101691 - CAN-2003-0689 Buffer overrun in getgrouplist function in
initgroups.c 102709 - NPTL pthread_cond_broadcast hangs. 103727 -
LD_PROFILE=libc.so.6 and sprof give seg fault 105348 - Closing socket
breaks the cancellation type of current thread 107846 - locale
utility is broken on big-endian 64-bit platforms 108634 - Signal
handler installation races with signal, glibc-2.3.2 109904 - problems
after [RHSA-2003:325-01] glibc upgrades 109918 - executable code in
.data in ld.so renders system unusable for PaX users
6. RPMs required:
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/glibc-2.2.4-33.src.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/glibc-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-common-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/nscd-2.2.4-33.i386.rpm
i686:
ftp://updates.redhat.com/7.1/en/os/i686/glibc-2.2.4-33.i686.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/glibc-2.2.4-33.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/glibc-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-common-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nscd-2.2.4-33.i386.rpm
i686:
ftp://updates.redhat.com/7.2/en/os/i686/glibc-2.2.4-33.i686.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-common-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-devel-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-profile-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/nscd-2.2.4-33.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/glibc-2.2.5-44.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/glibc-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-common-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-debug-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-debug-static-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-devel-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-profile-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-utils-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/nscd-2.2.5-44.i386.rpm
i686:
ftp://updates.redhat.com/7.3/en/os/i686/glibc-2.2.5-44.i686.rpm
ftp://updates.redhat.com/7.3/en/os/i686/glibc-debug-2.2.5-44.i686.rpm
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/glibc-2.3.2-4.80.8.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/glibc-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-common-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/nscd-2.3.2-4.80.8.i386.rpm
i686:
ftp://updates.redhat.com/8.0/en/os/i686/glibc-2.3.2-4.80.8.i686.rpm
ftp://updates.redhat.com/8.0/en/os/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
Red Hat Linux 9:
SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/glibc-2.3.2-27.9.7.src.rpm
i386:
ftp://updates.redhat.com/9/en/os/i386/glibc-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-common-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-debug-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-devel-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-profile-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-utils-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/nscd-2.3.2-27.9.7.i386.rpm
i686:
ftp://updates.redhat.com/9/en/os/i686/glibc-2.3.2-27.9.7.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/nptl-devel-2.3.2-27.9.7.i686.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
08a9d7fdb2cc277c80f5a0e1529d7774 7.1/en/os/SRPMS/glibc-2.2.4-33.src.rpm
83d041d5a108d6a27d5bb7e465c62d45 7.1/en/os/i386/glibc-2.2.4-33.i386.rpm
a99df9fce0cf177d42f611ca178a6717 7.1/en/os/i386/glibc-common-2.2.4-33.i386.rpm
9848447715453548af83418087deccd4 7.1/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
d68a6aec30cf1e7d8fb7fc1c0b95e00d 7.1/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
bee8aa9dd31b75b099c9fc6c5bd3295f 7.1/en/os/i386/nscd-2.2.4-33.i386.rpm
5585734c0358b3ba1f952dedbd9c443f 7.1/en/os/i686/glibc-2.2.4-33.i686.rpm
08a9d7fdb2cc277c80f5a0e1529d7774 7.2/en/os/SRPMS/glibc-2.2.4-33.src.rpm
83d041d5a108d6a27d5bb7e465c62d45 7.2/en/os/i386/glibc-2.2.4-33.i386.rpm
a99df9fce0cf177d42f611ca178a6717 7.2/en/os/i386/glibc-common-2.2.4-33.i386.rpm
9848447715453548af83418087deccd4 7.2/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
d68a6aec30cf1e7d8fb7fc1c0b95e00d 7.2/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
bee8aa9dd31b75b099c9fc6c5bd3295f 7.2/en/os/i386/nscd-2.2.4-33.i386.rpm
5585734c0358b3ba1f952dedbd9c443f 7.2/en/os/i686/glibc-2.2.4-33.i686.rpm
d0ded4d10fc72bfa3da24de5a7a078a0 7.2/en/os/ia64/glibc-2.2.4-33.ia64.rpm
44a7683cdfd8f763ccb1405784815fe4 7.2/en/os/ia64/glibc-common-2.2.4-33.ia64.rpm
5bd01df1cfc06fed52b3dd2928cef950 7.2/en/os/ia64/glibc-devel-2.2.4-33.ia64.rpm
27738cfcb12b46ee61e02950b39ed44e 7.2/en/os/ia64/glibc-profile-2.2.4-33.ia64.rpm
a0aad5ab63319615dac47dde5b5d9e16 7.2/en/os/ia64/nscd-2.2.4-33.ia64.rpm
8a161087ca8a0262fd1cdec70a0486a6 7.3/en/os/SRPMS/glibc-2.2.5-44.src.rpm
eb0107c7a3187b0c782314bf3cf38771 7.3/en/os/i386/glibc-2.2.5-44.i386.rpm
a22c95134d40d601ba1ee4dd69cb8372 7.3/en/os/i386/glibc-common-2.2.5-44.i386.rpm
46ed43e8ce6108be6dc628dc14093df5 7.3/en/os/i386/glibc-debug-2.2.5-44.i386.rpm
7945db62704b881f661b6972420564c1 7.3/en/os/i386/glibc-debug-static-2.2.5-44.i386.rpm
128c022a95b405e9628711f65e9bdf0b 7.3/en/os/i386/glibc-devel-2.2.5-44.i386.rpm
241a34a7487d9ff11bea274a11812f73 7.3/en/os/i386/glibc-profile-2.2.5-44.i386.rpm
1ba6bb800c87ed6eb497862da2e5d428 7.3/en/os/i386/glibc-utils-2.2.5-44.i386.rpm
3a465a1bbb95463cc837f1a3e7a20dbd 7.3/en/os/i386/nscd-2.2.5-44.i386.rpm
6c915957618eb229d17f1db2f0684f0f 7.3/en/os/i686/glibc-2.2.5-44.i686.rpm
82fe179cf917a3b012bdb1b2c50d6e7d 7.3/en/os/i686/glibc-debug-2.2.5-44.i686.rpm
d6c96dff6893d449a57439ec3b362ded 8.0/en/os/SRPMS/glibc-2.3.2-4.80.8.src.rpm
8058c50430bca5ee527c3521b8cd5019 8.0/en/os/i386/glibc-2.3.2-4.80.8.i386.rpm
62019c1ecff44880be70871a9b52c4bc 8.0/en/os/i386/glibc-common-2.3.2-4.80.8.i386.rpm
854a98301d8b8000c752a25d70b6634b 8.0/en/os/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
44eb3be20de572a08370182cb5ee82d9 8.0/en/os/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
4b091e271eac8c15ff68112b8b74b597 8.0/en/os/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
1bf2647c6eadf4ca934f9a8e6ab5c8d4 8.0/en/os/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
abfc2b5f8ee84966f136a6d703fb104d 8.0/en/os/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
0c890751f548c460207e2514ca61b3ca 8.0/en/os/i386/nscd-2.3.2-4.80.8.i386.rpm
44d62332cb2494a62ad95473237b5ad4 8.0/en/os/i686/glibc-2.3.2-4.80.8.i686.rpm
1a74ed2bd5bc54a33f21543a59805235 8.0/en/os/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
b0835a2d24994b0ec50b73f10e91c839 9/en/os/SRPMS/glibc-2.3.2-27.9.7.src.rpm
8e9e1bd574b10b6a55ee627973a46c7d 9/en/os/i386/glibc-2.3.2-27.9.7.i386.rpm
9a369a25585261ac590e4e02cde90d49 9/en/os/i386/glibc-common-2.3.2-27.9.7.i386.rpm
54c566f6dbf63e8efd8d48fcd845f48d 9/en/os/i386/glibc-debug-2.3.2-27.9.7.i386.rpm
83e103623d0b9e05937edc775094ad68 9/en/os/i386/glibc-devel-2.3.2-27.9.7.i386.rpm
7e6d0c5f8586a2605ed38d8ceb768973 9/en/os/i386/glibc-profile-2.3.2-27.9.7.i386.rpm
14f1b45918fc14abd744776c6cc8c9ce 9/en/os/i386/glibc-utils-2.3.2-27.9.7.i386.rpm
920d4bfedfb843818a38dcdfc491c6ef 9/en/os/i386/nscd-2.3.2-27.9.7.i386.rpm
b1311b31b1e2f349aaef5bba91be3caa 9/en/os/i686/glibc-2.3.2-27.9.7.i686.rpm
2d7819fa0bd582e4746e9b8ddbbceecf 9/en/os/i686/nptl-devel-2.3.2-27.9.7.i686.rpm
These packages are GPG signed by Red Hat for security. Our key is
available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0859
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE/s/V/XlSAg2UNWIIRAkGbAJ9UytBdxuJcjEs/DCTG80Urwa8NgACcCVfs
e0AVf8WbGQZ6F6qlHg4kbmE=
=zkKr
-----END PGP SIGNATURE-----
_______________________________________________ Redhat-watch-list
mailing list To unsubscribe, visit:
https://www.redhat.com/mailman/listinfo/redhat-watch-list
(10967909) /<bugzilla@redhat.com>/--------(Ombruten)