From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2191) id 215653858C2C; Wed, 8 Feb 2023 01:12:37 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 215653858C2C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1675818757; bh=BJsaw+/GuahYG4Ybg2IWa7oyd90vBkd7yaAi3uP/zCw=; h=From:To:Subject:Date:From; b=HCb5mnStnmm3JF9TTrhB2v79+Je3j8D6K+kQBnKiDIwN2kOx6N6EIajetuX59YNuK fgEJIi73hQqa+QdL4RpiftV8nSgzjOLwOW4kor1DOJl67u+udKQnh4PRHQMnJuAgNZ nNZhxMuCtBW5HkxnP6ce+d7vWx4oU64QjKbEGkVs= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Carlos O'Donell To: glibc-cvs@sourceware.org Subject: [glibc/release/2.37/master] NEWS: Document CVE-2023-25139. X-Act-Checkin: glibc X-Git-Author: Carlos O'Donell X-Git-Refname: refs/heads/release/2.37/master X-Git-Oldrev: 07b9521fc6369d000216b96562ff7c0ed32a16c4 X-Git-Newrev: 6fe86ecd787a2624cd638131629ba9a824040308 Message-Id: <20230208011237.215653858C2C@sourceware.org> Date: Wed, 8 Feb 2023 01:12:37 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6fe86ecd787a2624cd638131629ba9a824040308 commit 6fe86ecd787a2624cd638131629ba9a824040308 Author: Carlos O'Donell Date: Mon Feb 6 10:36:32 2023 -0500 NEWS: Document CVE-2023-25139. Reviewed-by: Siddhesh Poyarekar (cherry picked from commit 67c37737ed474d25fd4dc535dfd822c426e6b971) Diff: --- NEWS | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/NEWS b/NEWS index 4da140db31..7ba8846fcc 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,15 @@ using `glibc' in the "product" field. Version 2.37.1 +Security related changes: + + CVE-2023-25139: When the printf family of functions is called with a + format specifier that uses an (enable grouping) and a + minimum width specifier, the resulting output could be larger than + reasonably expected by a caller that computed a tight bound on the + buffer size. The resulting larger than expected output could result + in a buffer overflow in the printf family of functions. + The following bugs are resolved with this release: [30053] time: strftime %s returns -1 after 2038 on 32 bits systems