Most recent entries from all

ALSA-2022:0896 — Moderate: glibc security update

Affected: AlmaLinux:8: compat-libpthread-nonshared, AlmaLinux:8: glibc-benchtests, AlmaLinux:8: glibc-nss-devel, AlmaLinux:8: glibc-static, AlmaLinux:8: glibc-utils, AlmaLinux:8: nss_hesiod

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

* glibc: Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)

* glibc: Stack-based buffer overflow in svcunix_create via long pathnames (CVE-2022-23218)

* glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname (CVE-2022-23219)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-01635

certfr-2022-avi-683 — De multiples vulnérabilités ont été découvertes dans IBM QRadar SIEM. Certaines d'entre elles permettent à un attaquant…

certfr-2022-avi-683

EUVD-2026-262351

fkie_cve-2021-3999

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

GHSA-vfch-2fr8-r5c2

gsd-2021-3999

ICSA-23-166-10 — Siemens SIMATIC S7-1500 TM MFP BIOS

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite lo…

msrc_CVE-2021-3999 — A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when t…

msrc_CVE-2021-3999

openSUSE-SU-2022:0330-1 — Security update for glibc

Security update for glibc

SUSE-SU-2022:0330-1 — Security update for glibc

Security update for glibc

UBUNTU-CVE-2021-3999

Affected: Ubuntu:Pro:14.04:LTS: eglibc, Ubuntu:Pro:16.04:LTS: glibc, Ubuntu:18.04:LTS: glibc, Ubuntu:20.04:LTS: glibc

WID-SEC-W-2022-1206 — GNU libc: Mehrere Schwachstellen

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in GNU libc ausnutzen, um Informationen offenzulegen und seine Privilegien zu erweitern.