From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 65046 invoked by alias); 20 Dec 2018 23:39:37 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 65017 invoked by uid 89); 20 Dec 2018 23:39:37 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.100.2 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-25.4 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY,KAM_NUMSUBJECT autolearn=ham version=3.3.2 spammy= X-Spam-Status: No, score=-25.4 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY,KAM_NUMSUBJECT autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: hall.aurel32.net Received: from hall.aurel32.net (HELO hall.aurel32.net) (163.172.24.10) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 20 Dec 2018 23:39:36 +0000 Received: from [2a01:e35:2e4c:a861:655e:aef3:f589:b897] (helo=ohm.rr44.fr) by hall.aurel32.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1ga7ug-0002hR-1l; Fri, 21 Dec 2018 00:39:34 +0100 Received: from aurel32 by ohm.rr44.fr with local (Exim 4.91) (envelope-from ) id 1ga7uf-0005Qe-Fl; Fri, 21 Dec 2018 00:39:33 +0100 From: Aurelien Jarno To: libc-stable@sourceware.org Cc: Florian Weimer Subject: [2.24 COMMITTED 4/4] Add references to CVE-2017-18269, CVE-2018-11236, CVE-2018-11237 Date: Mon, 01 Jan 2018 00:00:00 -0000 Message-Id: <20181220233902.20796-4-aurelien@aurel32.net> X-Mailer: git-send-email 2.19.2 In-Reply-To: <20181220233902.20796-1-aurelien@aurel32.net> References: <20181220233902.20796-1-aurelien@aurel32.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-IsSubscribed: yes X-SW-Source: 2018-12/txt/msg00024.txt.bz2 From: Florian Weimer (cherry picked from commit 43d4f3d5ad94e1fa5e56d7a7200d0e9f3d8e2f02) --- ChangeLog | 2 ++ NEWS | 11 +++++++++++ 2 files changed, 13 insertions(+) diff --git a/ChangeLog b/ChangeLog index f650db1d59..988615f03b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,7 @@ 2018-05-09 Paul Pluzhnikov [BZ #22786] + CVE-2018-11236 * stdlib/canonicalize.c (__realpath): Fix overflow in path length computation. * stdlib/Makefile (test-bz22786): New test. @@ -19,6 +20,7 @@ Max Horn [BZ #22644] + CVE-2017-18269 * sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed branch conditions. * string/test-memmove.c (do_test2): New testcase. diff --git a/NEWS b/NEWS index 7e1859b78e..13ac8dd911 100644 --- a/NEWS +++ b/NEWS @@ -49,6 +49,17 @@ Security related changes: for AT_SECURE or SUID binaries could be used to load libraries from the current directory. + CVE-2017-18269: An SSE2-based memmove implementation for the i386 + architecture could corrupt memory. Reported by Max Horn. + + CVE-2018-11236: Very long pathname arguments to realpath function could + result in an integer overflow and buffer overflow. Reported by Alexey + Izbyshev. + + CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi + architecture could write beyond the target buffer, resulting in a buffer + overflow. Reported by Andreas Schwab. + The following bugs are resolved with this release: [20790] Fix rpcgen buffer overrun -- 2.19.2