[prev in list] [next in list] [prev in thread] [next in thread]
List: glibc-cvs
Subject: GNU C Library master sources branch release/2.27/master updated. glibc-2.27-56-g50df56c
From: fw () sourceware ! org
Date: 2018-05-24 13:07:06
Message-ID: 20180524130706.58874.qmail () sourceware ! org
[Download RAW message or body]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, release/2.27/master has been updated
via 50df56ca86a281c8fd99a8100aac75539813788d (commit)
from 0cf8a53e5f2ce7f71787537cf206228727afe256 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=50df56ca86a281c8fd99a8100aac75539813788d
commit 50df56ca86a281c8fd99a8100aac75539813788d
Author: Florian Weimer <fweimer@redhat.com>
Date: Thu May 24 14:41:57 2018 +0200
Add references to CVE-2018-11236, CVE-2017-18269
diff --git a/ChangeLog b/ChangeLog
index 4aa9ff7..fefd9e4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -34,6 +34,7 @@
2018-05-09 Paul Pluzhnikov <ppluzhnikov@google.com>
[BZ #22786]
+ CVE-2018-11236
* stdlib/canonicalize.c (__realpath): Fix overflow in path length
computation.
* stdlib/Makefile (test-bz22786): New test.
@@ -147,6 +148,7 @@
Max Horn <max@quendi.de>
[BZ #22644]
+ CVE-2017-18269
* sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed
branch conditions.
* string/test-memmove.c (do_test2): New testcase.
diff --git a/NEWS b/NEWS
index ee08fc3..28535db 100644
--- a/NEWS
+++ b/NEWS
@@ -52,6 +52,13 @@ The following bugs are resolved with this release:
Security related changes:
+ CVE-2017-18269: An SSE2-based memmove implementation for the i386
+ architecture could corrupt memory. Reported by Max Horn.
+
+ CVE-2018-11236: Very long pathname arguments to realpath function could
+ result in an integer overflow and buffer overflow. Reported by Alexey
+ Izbyshev.
+
CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi
architecture could write beyond the target buffer, resulting in a buffer
overflow. Reported by Andreas Schwab.
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 2 ++
NEWS | 7 +++++++
2 files changed, 9 insertions(+), 0 deletions(-)
hooks/post-receive
--
GNU C Library master sources
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic