From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 120471 invoked by alias); 28 Mar 2018 20:44:21 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 119797 invoked by uid 89); 28 Mar 2018 20:44:20 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99.4 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-24.3 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY,KAM_NUMSUBJECT,LIKELY_SPAM_BODY,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.2 spammy=disputes X-Spam-Status: No, score=-24.3 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY,KAM_NUMSUBJECT,LIKELY_SPAM_BODY,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: mx0a-001b2d01.pphosted.com Received: from mx0b-001b2d01.pphosted.com (HELO mx0a-001b2d01.pphosted.com) (148.163.158.5) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 28 Mar 2018 20:44:19 +0000 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2SKdY7E047690 for ; Wed, 28 Mar 2018 16:44:18 -0400 Received: from e35.co.us.ibm.com (e35.co.us.ibm.com [32.97.110.153]) by mx0b-001b2d01.pphosted.com with ESMTP id 2h0h1gk8sh-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Wed, 28 Mar 2018 16:44:18 -0400 Received: from localhost by e35.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 28 Mar 2018 14:44:17 -0600 Received: from b03cxnp08028.gho.boulder.ibm.com (9.17.130.20) by e35.co.us.ibm.com (192.168.1.135) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 28 Mar 2018 14:44:15 -0600 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp08028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w2SKiETF10879318 for ; Wed, 28 Mar 2018 13:44:14 -0700 Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 898557805F for ; Wed, 28 Mar 2018 14:44:14 -0600 (MDT) Received: from localhost (unknown [9.85.149.193]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP id 0BB787805E for ; Wed, 28 Mar 2018 14:44:13 -0600 (MDT) From: Raphael Moreira Zinsly To: libc-stable@sourceware.org Subject: [PATCH 2.22 12/14] Add ChangeLog reference to bug 16750/CVE-2009-5064 Date: Mon, 01 Jan 2018 00:00:00 -0000 X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1522269821-15007-1-git-send-email-rzinsly@linux.vnet.ibm.com> References: <1522269821-15007-1-git-send-email-rzinsly@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 18032820-0012-0000-0000-000015F6CB51 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00008760; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000255; SDB=6.01009783; UDB=6.00514431; IPR=6.00789065; MB=3.00020296; MTD=3.00000008; XFM=3.00000015; UTC=2018-03-28 20:44:15 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18032820-0013-0000-0000-0000520F2660 Message-Id: <1522269821-15007-12-git-send-email-rzinsly@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-28_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=15 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1803280211 X-SW-Source: 2018-03/txt/msg00050.txt.bz2 From: Florian Weimer (cherry picked from commit 403143e1df85dadd374f304bd891be0cd7573e3b) --- ChangeLog | 2 ++ NEWS | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/ChangeLog b/ChangeLog index 91a9fb9..05ef3fd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -77,6 +77,8 @@ 2017-08-16 Andreas Schwab + [BZ #16750] + CVE-2009-5064 * elf/ldd.bash.in: Never run file directly. 2016-10-14 Carlos Eduardo Seo diff --git a/NEWS b/NEWS index e061583..2d703f2 100644 --- a/NEWS +++ b/NEWS @@ -94,6 +94,12 @@ Version 2.22.1 succeeds without returning an absolute path due to unexpected behaviour of the Linux kernel getcwd syscall. Reported by halfdog. +* CVE-2009-5064: The ldd script would sometimes run the program under + examination directly, without preventing code execution through the + dynamic linker. (The glibc project disputes that this is a security + vulnerability; only trusted binaries must be examined using the ldd + script.) + Version 2.22 -- 1.8.3.1