* [2.26 COMMITTED] Add references to CVE-2018-11236, CVE-2017-18269
@ 2018-01-01 0:00 Florian Weimer
0 siblings, 0 replies; only message in thread
From: Florian Weimer @ 2018-01-01 0:00 UTC (permalink / raw)
To: libc-stable
[-- Attachment #1: Type: text/plain, Size: 36 bytes --]
Similar change for the 2.26 branch.
[-- Attachment #2: cve-housekeeping.patch --]
[-- Type: text/x-patch, Size: 1630 bytes --]
diff --git a/ChangeLog b/ChangeLog
index 41b4dae231..e45fa8e6d0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,6 +16,7 @@
2018-05-09 Paul Pluzhnikov <ppluzhnikov@google.com>
[BZ #22786]
+ CVE-2018-11236
* stdlib/canonicalize.c (__realpath): Fix overflow in path length
computation.
* stdlib/Makefile (test-bz22786): New test.
@@ -59,6 +60,7 @@
Max Horn <max@quendi.de>
[BZ #22644]
+ CVE-2017-18269
* sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed
branch conditions.
* string/test-memmove.c (do_test2): New testcase.
diff --git a/NEWS b/NEWS
index c3c6aff8fc..c6c5538192 100644
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,9 @@ Security related changes:
for AT_SECURE or SUID binaries could be used to load libraries from the
current directory.
+ CVE-2017-18269: An SSE2-based memmove implementation for the i386
+ architecture could corrupt memory. Reported by Max Horn.
+
CVE-2018-1000001: Buffer underflow in realpath function when getcwd function
succeeds without returning an absolute path due to unexpected behaviour
of the Linux kernel getcwd syscall. Reported by halfdog.
@@ -71,6 +74,10 @@ Security related changes:
the value of SIZE_MAX, would return a pointer to a buffer which is too
small, instead of NULL.
+ CVE-2018-11236: Very long pathname arguments to realpath function could
+ result in an integer overflow and buffer overflow. Reported by Alexey
+ Izbyshev.
+
CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi
architecture could write beyond the target buffer, resulting in a buffer
overflow. Reported by Andreas Schwab.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2018-05-24 14:29 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-01 0:00 [2.26 COMMITTED] Add references to CVE-2018-11236, CVE-2017-18269 Florian Weimer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).