From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 105972 invoked by alias); 24 May 2018 14:29:12 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 105952 invoked by uid 89); 24 May 2018 14:29:12 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99.4 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-24.3 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_NUMSUBJECT,SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=Hx-languages-length:1667 X-Spam-Status: No, score=-24.3 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_NUMSUBJECT,SPF_HELO_PASS autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: mx1.redhat.com Received: from mx3-rdu2.redhat.com (HELO mx1.redhat.com) (66.187.233.73) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 24 May 2018 14:29:10 +0000 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0B7FD407118E for ; Thu, 24 May 2018 14:29:09 +0000 (UTC) Received: from oldenburg.str.redhat.com (ovpn-117-98.ams2.redhat.com [10.36.117.98]) by smtp.corp.redhat.com (Postfix) with ESMTPS id BBF881102E29 for ; Thu, 24 May 2018 14:29:08 +0000 (UTC) From: Florian Weimer Subject: [2.26 COMMITTED] Add references to CVE-2018-11236, CVE-2017-18269 To: libc-stable@sourceware.org Message-ID: <32c55e20-53a1-ab23-39f2-4aa30a069c61@redhat.com> Date: Mon, 01 Jan 2018 00:00:00 -0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------23E7653804088C75A483AB1B" Content-Language: en-US X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Thu, 24 May 2018 14:29:09 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Thu, 24 May 2018 14:29:09 +0000 (UTC) for IP:'10.11.54.3' DOMAIN:'int-mx03.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'fweimer@redhat.com' RCPT:'' X-IsSubscribed: yes X-SW-Source: 2018-05/txt/msg00043.txt.bz2 This is a multi-part message in MIME format. --------------23E7653804088C75A483AB1B Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-length: 36 Similar change for the 2.26 branch. --------------23E7653804088C75A483AB1B Content-Type: text/x-patch; name="cve-housekeeping.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="cve-housekeeping.patch" Content-length: 1630 diff --git a/ChangeLog b/ChangeLog index 41b4dae231..e45fa8e6d0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,6 +16,7 @@ 2018-05-09 Paul Pluzhnikov [BZ #22786] + CVE-2018-11236 * stdlib/canonicalize.c (__realpath): Fix overflow in path length computation. * stdlib/Makefile (test-bz22786): New test. @@ -59,6 +60,7 @@ Max Horn [BZ #22644] + CVE-2017-18269 * sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed branch conditions. * string/test-memmove.c (do_test2): New testcase. diff --git a/NEWS b/NEWS index c3c6aff8fc..c6c5538192 100644 --- a/NEWS +++ b/NEWS @@ -59,6 +59,9 @@ Security related changes: for AT_SECURE or SUID binaries could be used to load libraries from the current directory. + CVE-2017-18269: An SSE2-based memmove implementation for the i386 + architecture could corrupt memory. Reported by Max Horn. + CVE-2018-1000001: Buffer underflow in realpath function when getcwd function succeeds without returning an absolute path due to unexpected behaviour of the Linux kernel getcwd syscall. Reported by halfdog. @@ -71,6 +74,10 @@ Security related changes: the value of SIZE_MAX, would return a pointer to a buffer which is too small, instead of NULL. + CVE-2018-11236: Very long pathname arguments to realpath function could + result in an integer overflow and buffer overflow. Reported by Alexey + Izbyshev. + CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi architecture could write beyond the target buffer, resulting in a buffer overflow. Reported by Andreas Schwab. --------------23E7653804088C75A483AB1B--