[SECURITY] [DLA 139-1] eglibc security update

2015-01-2810:25:42

lists.debian.org

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8 High

AI Score

Confidence

Low

0.975 High

EPSS

Percentile

100.0%

JSON

Package : eglibc
Version : 2.11.3-4+deb6u4
CVE ID : CVE-2015-0235

A vulnerability has been fixed in eglibc, Debian's version of the GNU C
library:

CVE-2015-0235

Qualys discovered that the gethostbyname and gethostbyname2
functions were subject to a buffer overflow if provided with a
crafted IP address argument.  This could be used by an attacker to
execute arbitrary code in processes which called the affected
functions.

The original glibc bug was reported by Peter Klotz.

We recommend that you upgrade your eglibc packages.

The other three CVEs fixed in Debian wheezy via DSA 3142-1 have already been
fixed in squeeze LTS via DLA DLA 97-1.

Attachment:
signature.asc
Description: This is a digitally signed message part.

OSVersionArchitecturePackageVersionFilename
Debian7powerpclibc6-ppc64< 2.13-38+deb7u7libc6-ppc64_2.13-38+deb7u7_powerpc.deb
Debian7ia64libc-dev-bin< 2.13-38+deb7u7libc-dev-bin_2.13-38+deb7u7_ia64.deb
Debian7sparclibc6< 2.13-38+deb7u7libc6_2.13-38+deb7u7_sparc.deb
Debian7mipslibc-dev-bin< 2.13-38+deb7u7libc-dev-bin_2.13-38+deb7u7_mips.deb
Debian7s390xlibc6-dbg< 2.13-38+deb7u7libc6-dbg_2.13-38+deb7u7_s390x.deb
Debian7alleglibc-source< 2.13-38+deb7u7eglibc-source_2.13-38+deb7u7_all.deb
Debian6i386libc6-dev< 2.11.3-4+deb6u4libc6-dev_2.11.3-4+deb6u4_i386.deb
Debian7armhflocales-all< 2.13-38+deb7u7locales-all_2.13-38+deb7u7_armhf.deb
Debian7s390libc6-dev< 2.13-38+deb7u7libc6-dev_2.13-38+deb7u7_s390.deb
Debian7s390xlibc6-udeb< 2.13-38+deb7u7libc6-udeb_2.13-38+deb7u7_s390x.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	powerpc	libc6-ppc64	< 2.13-38+deb7u7	libc6-ppc64_2.13-38+deb7u7_powerpc.deb
Debian	7	ia64	libc-dev-bin	< 2.13-38+deb7u7	libc-dev-bin_2.13-38+deb7u7_ia64.deb
Debian	7	sparc	libc6	< 2.13-38+deb7u7	libc6_2.13-38+deb7u7_sparc.deb
Debian	7	mips	libc-dev-bin	< 2.13-38+deb7u7	libc-dev-bin_2.13-38+deb7u7_mips.deb
Debian	7	s390x	libc6-dbg	< 2.13-38+deb7u7	libc6-dbg_2.13-38+deb7u7_s390x.deb
Debian	7	all	eglibc-source	< 2.13-38+deb7u7	eglibc-source_2.13-38+deb7u7_all.deb
Debian	6	i386	libc6-dev	< 2.11.3-4+deb6u4	libc6-dev_2.11.3-4+deb6u4_i386.deb
Debian	7	armhf	locales-all	< 2.13-38+deb7u7	locales-all_2.13-38+deb7u7_armhf.deb
Debian	7	s390	libc6-dev	< 2.13-38+deb7u7	libc6-dev_2.13-38+deb7u7_s390.deb
Debian	7	s390x	libc6-udeb	< 2.13-38+deb7u7	libc6-udeb_2.13-38+deb7u7_s390x.deb