CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS
Percentile
87.0%
Issue Overview:
An out-of-bounds read flaw was found in the way glibc’s iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. (CVE-2014-6040)
It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)
Affected Packages:
glibc
Issue Correction:
Run yum update glibc to update your system.
New Packages:
i686:
glibc-common-2.17-55.92.amzn1.i686
glibc-devel-2.17-55.92.amzn1.i686
glibc-debuginfo-2.17-55.92.amzn1.i686
glibc-utils-2.17-55.92.amzn1.i686
glibc-debuginfo-common-2.17-55.92.amzn1.i686
nscd-2.17-55.92.amzn1.i686
glibc-static-2.17-55.92.amzn1.i686
glibc-headers-2.17-55.92.amzn1.i686
glibc-2.17-55.92.amzn1.i686
src:
glibc-2.17-55.92.amzn1.src
x86_64:
glibc-2.17-55.92.amzn1.x86_64
glibc-utils-2.17-55.92.amzn1.x86_64
nscd-2.17-55.92.amzn1.x86_64
glibc-headers-2.17-55.92.amzn1.x86_64
glibc-static-2.17-55.92.amzn1.x86_64
glibc-debuginfo-2.17-55.92.amzn1.x86_64
glibc-debuginfo-common-2.17-55.92.amzn1.x86_64
glibc-common-2.17-55.92.amzn1.x86_64
glibc-devel-2.17-55.92.amzn1.x86_64
Red Hat: CVE-2014-6040, CVE-2014-7817
Mitre: CVE-2014-6040, CVE-2014-7817
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 1 | i686 | glibc-common | < 2.17-55.92.amzn1 | glibc-common-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc-devel | < 2.17-55.92.amzn1 | glibc-devel-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc-debuginfo | < 2.17-55.92.amzn1 | glibc-debuginfo-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc-utils | < 2.17-55.92.amzn1 | glibc-utils-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc-debuginfo-common | < 2.17-55.92.amzn1 | glibc-debuginfo-common-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | nscd | < 2.17-55.92.amzn1 | nscd-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc-static | < 2.17-55.92.amzn1 | glibc-static-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc-headers | < 2.17-55.92.amzn1 | glibc-headers-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | glibc | < 2.17-55.92.amzn1 | glibc-2.17-55.92.amzn1.i686.rpm |
Amazon Linux | 1 | x86_64 | glibc | < 2.17-55.92.amzn1 | glibc-2.17-55.92.amzn1.x86_64.rpm |