From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2012) id 92C6638582B9; Tue, 30 Jan 2024 18:35:25 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 92C6638582B9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1706639725; bh=kRr6uNLdjsik0kCY2bvdnlyfkD4FWiHFF0wMs/CT9vk=; h=From:To:Subject:Date:From; b=y3Hsojk/kGbVf/h8xlduzB3P6STVzT1QB+cP1tDCcENuOuwhoddtQl901Co3sm9Vs 62l1+YlZmIE2Bo/TYZ+exosQADjPdLkhT1ZyTghoSWDmEsg/iXaEHbKz46t5FttIOg 8na5CXDfRDwmFDPmlhaK2/6VVtYSI8Rh7CN5NgfM= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Arjun Shankar To: glibc-cvs@sourceware.org Subject: [glibc] Document CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780 X-Act-Checkin: glibc X-Git-Author: Arjun Shankar X-Git-Refname: refs/heads/master X-Git-Oldrev: ddf542da94caf97ff43cc2875c88749880b7259b X-Git-Newrev: 6cdc44214253a74e7140d75a7ebfc900820a5fa8 Message-Id: <20240130183525.92C6638582B9@sourceware.org> Date: Tue, 30 Jan 2024 18:35:25 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6cdc44214253a74e7140d75a7ebfc900820a5fa8 commit 6cdc44214253a74e7140d75a7ebfc900820a5fa8 Author: Arjun Shankar Date: Tue Jan 30 19:29:45 2024 +0100 Document CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780 This commit adds "advisories" entries for the above three CVEs. Diff: --- advisories/GLIBC-SA-2024-0001 | 15 +++++++++++++++ advisories/GLIBC-SA-2024-0002 | 15 +++++++++++++++ advisories/GLIBC-SA-2024-0003 | 13 +++++++++++++ 3 files changed, 43 insertions(+) diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001 new file mode 100644 index 0000000000..28931c75ae --- /dev/null +++ b/advisories/GLIBC-SA-2024-0001 @@ -0,0 +1,15 @@ +syslog: Heap buffer overflow in __vsyslog_internal + +__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER +containing a long program name failed to update the required buffer +size, leading to the allocation and overflow of a too-small buffer on +the heap. + +CVE-Id: CVE-2023-6246 +Public-Date: 2024-01-30 +Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) +Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39) +Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42) +Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57) +Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) +Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126) diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002 new file mode 100644 index 0000000000..940bfcf2fc --- /dev/null +++ b/advisories/GLIBC-SA-2024-0002 @@ -0,0 +1,15 @@ +syslog: Heap buffer overflow in __vsyslog_internal + +__vsyslog_internal used the return value of snprintf/vsnprintf to +calculate buffer sizes for memory allocation. If these functions (for +any reason) failed and returned -1, the resulting buffer would be too +small to hold output. + +CVE-Id: CVE-2023-6779 +Public-Date: 2024-01-30 +Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) +Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39) +Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43) +Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58) +Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) +Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127) diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003 new file mode 100644 index 0000000000..b43a5150ab --- /dev/null +++ b/advisories/GLIBC-SA-2024-0003 @@ -0,0 +1,13 @@ +syslog: Integer overflow in __vsyslog_internal + +__vsyslog_internal calculated a buffer size by adding two integers, but +did not first check if the addition would overflow. + +CVE-Id: CVE-2023-6780 +Public-Date: 2024-01-30 +Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) +Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39) +Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44) +Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59) +Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) +Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128)