Arch Linux alert ASA-201608-7 (lib32-glibc)
| From: | Levente Polyak <anthraxx@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [arch-security] [ASA-201608-7] lib32-glibc: denial of service | |
| Date: | Mon, 8 Aug 2016 02:44:21 +0200 | |
| Message-ID: | <9e69c1f9-ab53-5a02-8cad-a3aa500b0ca0@archlinux.org> |
Arch Linux Security Advisory ASA-201608-7 ========================================= Severity: Low Date : 2016-08-08 CVE-ID : CVE-2016-3075 CVE-2016-5417 Package : lib32-glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.24-1. # pacman -Syu "lib32-glibc>=2.24-1" The problems have been fixed upstream in version 2.24. Workaround ========== None. Description =========== - CVE-2016-3075 (denial of service) The getnetbyname implementation in nss_dns contains a potentially unbounded alloca call (in the form of a call to strdupa), leading to a stack overflow (stack exhaustion) and a crash if getnetbyname is invoked on a very long name. - CVE-2016-5417 (denial of service) The sockaddr_in6 allocated in resolv/res_init.c:317 is not freed, leaking 28 bytes per thread using the resolver (according to valgrind). The leak is triggered if name resolution functions are called in such a way that internal resolver data structures are only initialized partially. This issue may ultimately lead to denial of service by leaking extensive amounts of memory. Impact ====== A remote attacker is able to perform a denial of service attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-3075 https://access.redhat.com/security/cve/CVE-2016-5417 https://sourceware.org/bugzilla/show_bug.cgi?id=19879 https://sourceware.org/bugzilla/show_bug.cgi?id=19257