Most recent entries from all

ALSA-2022:0896 — Moderate: glibc security update

Affected: AlmaLinux:8: compat-libpthread-nonshared, AlmaLinux:8: glibc-benchtests, AlmaLinux:8: glibc-nss-devel, AlmaLinux:8: glibc-static, AlmaLinux:8: glibc-utils, AlmaLinux:8: nss_hesiod

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

* glibc: Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)

* glibc: Stack-based buffer overflow in svcunix_create via long pathnames (CVE-2022-23218)

* glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname (CVE-2022-23219)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-01632

certfr-2022-avi-683 — De multiples vulnérabilités ont été découvertes dans IBM QRadar SIEM. Certaines d'entre elles permettent à un attaquant…

certfr-2022-avi-683

EUVD-2026-237376

fkie_cve-2022-23218

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

GHSA-8g8v-256r-57v7

gsd-2022-23218

ICSA-23-166-10 — Siemens SIMATIC S7-1500 TM MFP BIOS

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite lo…

msrc_CVE-2022-23218 — The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34…

msrc_CVE-2022-23218

openSUSE-SU-2022:0330-1 — Security update for glibc

Security update for glibc

SUSE-SU-2022:0330-1 — Security update for glibc

Security update for glibc

UBUNTU-CVE-2022-23218

Affected: Ubuntu:Pro:14.04:LTS: eglibc, Ubuntu:Pro:16.04:LTS: glibc, Ubuntu:18.04:LTS: glibc, Ubuntu:20.04:LTS: glibc

WID-SEC-W-2022-1220 — GNU libc: Mehrere Schwachstellen ermöglichen Codeausführung und Denial of Service

Ein Angreifer kann mehrere Schwachstellen in GNU libc ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service zu verursachen.