public inbox for
 help / color / mirror / Atom feed
From: Arjun Shankar <>
Cc: Arjun Shankar <>
Subject: [COMMITTED 4/4] Document CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780
Date: Tue, 30 Jan 2024 19:40:44 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

This commit adds "advisories" entries for the above three CVEs.
 advisories/GLIBC-SA-2024-0001 | 15 +++++++++++++++
 advisories/GLIBC-SA-2024-0002 | 15 +++++++++++++++
 advisories/GLIBC-SA-2024-0003 | 13 +++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 advisories/GLIBC-SA-2024-0001
 create mode 100644 advisories/GLIBC-SA-2024-0002
 create mode 100644 advisories/GLIBC-SA-2024-0003

diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001
new file mode 100644
index 0000000000..28931c75ae
--- /dev/null
+++ b/advisories/GLIBC-SA-2024-0001
@@ -0,0 +1,15 @@
+syslog: Heap buffer overflow in __vsyslog_internal
+__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
+containing a long program name failed to update the required buffer
+size, leading to the allocation and overflow of a too-small buffer on
+the heap.
+CVE-Id: CVE-2023-6246
+Public-Date: 2024-01-30
+Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
+Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39)
+Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42)
+Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57)
+Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
+Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126)
diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002
new file mode 100644
index 0000000000..940bfcf2fc
--- /dev/null
+++ b/advisories/GLIBC-SA-2024-0002
@@ -0,0 +1,15 @@
+syslog: Heap buffer overflow in __vsyslog_internal
+__vsyslog_internal used the return value of snprintf/vsnprintf to
+calculate buffer sizes for memory allocation.  If these functions (for
+any reason) failed and returned -1, the resulting buffer would be too
+small to hold output.
+CVE-Id: CVE-2023-6779
+Public-Date: 2024-01-30
+Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
+Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39)
+Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43)
+Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58)
+Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
+Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127)
diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003
new file mode 100644
index 0000000000..b43a5150ab
--- /dev/null
+++ b/advisories/GLIBC-SA-2024-0003
@@ -0,0 +1,13 @@
+syslog: Integer overflow in __vsyslog_internal
+__vsyslog_internal calculated a buffer size by adding two integers, but
+did not first check if the addition would overflow.
+CVE-Id: CVE-2023-6780
+Public-Date: 2024-01-30
+Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
+Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39)
+Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44)
+Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59)
+Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
+Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128)

      parent reply	other threads:[~2024-01-30 18:41 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-30 18:40 [COMMITTED 1/4] syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246) Arjun Shankar
2024-01-30 18:40 ` [COMMITTED 2/4] syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779) Arjun Shankar
2024-01-30 18:40 ` [COMMITTED 3/4] syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780) Arjun Shankar
2024-01-30 18:40 ` Arjun Shankar [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).