Debian alert DLA-2966-1 (libgc)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2966-1] libgc security update
Date:
             
 
Wed, 30 Mar 2022 21:20:59 +0000
Message-ID:
             
 
<alpine.DEB.2.21.2203302118170.21027@postfach.intern.alteholz.me>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2966-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
March 30, 2022                                https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libgc
Version        : 1:7.4.2-8+deb9u1
CVE ID         : CVE-2016-9427


libgc, a conservative garbage collector, is vulnerable to integer 
overflows in multiple places. In some cases, when asked to allocate a huge 
quantity of memory, instead of failing the request, it will return a 
pointer to a small amount of memory possibly tricking the application into 
a buffer overwrite.


For Debian 9 stretch, this problem has been fixed in version
1:7.4.2-8+deb9u1.

We recommend that you upgrade your libgc packages.

For the detailed security status of libgc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libgc

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmJEybtfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEeDLQ//YnzoWGY6YiThb8gTLhDI3ZuWZvte8Z9Rfyxepy7YygLbc/rkp48xDn0H
EEWw1d5D3PXd19ENJHH8ya3zJVV6BUwtDgacjqbywl1ANlMdM8Hg0eVrILhJ1aKw
JMfrv7xDiMtq5md6Ok/skS7dIBR4RGEZIF9cKtN+ikXHadtYsREsOEwJteclbkri
Y86Esyh0GTKbcWYUGdbk1csYxGbc1ab5YI7QoeiygIL5DuJYGI9ISNBXOOlALSG4
PC6g5zmknRDuUq33BYFzmry3TyKToL3MWCpCb54NHjSgsM/DLgie5K894We6kF5G
zTd2kACJNAi71x1yAoCKCKFGTFM4WWi6GJh1/2asAdNotB2VWSbtgoNDuW7fHdVa
0u1ip8FD73mZ2cAl+22eST6OTWt4/NRuBfvkGFN4u1w6VO0sqhywGa1YKFvLVRux
h2o1eiDQYHZg2unhZ8tY9N/J8ODONyIhXlWaBeaJWefvsactEXgqIjDw8nLkZvWU
V4FwfPEwaHNTzbEa+aGzfYUXP5nu4R90DmtaNk+OLEGJDJltp+41aJkMwFX41/0t
wYSELahhzfZn+JUw4UHan90w0/YuD0x/aMIaPLi5XRyNNmojUcjeqDyT8fNvhPIc
zJbFCYjeypkr86PB7BcfBX4eBub8Mxna7QYNoejv0sFUaCGIB1M=
=VQ0j
-----END PGP SIGNATURE-----