HEADSUP - CVE 2015-023 remote code execution in glibc

HEADSUP - CVE 2015-023 remote code execution in glibc

[Damian, Alexandru]

[-- Attachment #1: Type: text/plain, Size: 250 bytes --]

More details

http://www.openwall.com/lists/oss-security/2015/01/27/9

redhat bug and patch

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235

Do we need to open a bug to track this ?


-- 
Alex Damian
Yocto Project
SSG / OTC

[-- Attachment #2: Type: text/html, Size: 1271 bytes --]

Re: HEADSUP - CVE 2015-023 remote code execution in glibc

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 219 bytes --]

On 28 January 2015 at 11:17, Damian, Alexandru <alexandru.damian@intel.com>
wrote:

> Do we need to open a bug to track this ?
>

Probably for the best to ensure it goes into all the branches we support.

Ross

[-- Attachment #2: Type: text/html, Size: 732 bytes --]

Re: HEADSUP - CVE 2015-023 remote code execution in glibc

[Paul Eggleton]

On Wednesday 28 January 2015 11:20:27 Burton, Ross wrote:
> On 28 January 2015 at 11:17, Damian, Alexandru <alexandru.damian@intel.com>
> wrote:
> > Do we need to open a bug to track this ?
> 
> Probably for the best to ensure it goes into all the branches we support.

FYI, none of the branches we still officially support use (e)glibc older than 
2.18, which is where the fix went in upstream; even dora that just went out of 
support has 2.18 as the default (2.17 is included though).

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre

Re: HEADSUP - CVE 2015-023 remote code execution in glibc

[akuster]

Alexandr,


On 01/28/2015 03:17 AM, Damian, Alexandru wrote:
> More details
>
> http://www.openwall.com/lists/oss-security/2015/01/27/9
>
> redhat bug and patch
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235
>
> Do we need to open a bug to track this ?

  I am working on patches already. if you opened a bug, please send me 
the #.

- Armin
>
>
> --
> Alex Damian
> Yocto Project
> SSG / OTC
>
>

Re: HEADSUP - CVE 2015-023 remote code execution in glibc

[Sona Sarmadi]

> Subject: Re: [yocto] HEADSUP - CVE 2015-023 remote code execution in glibc
> Alexandr,
> On 01/28/2015 03:17 AM, Damian, Alexandru wrote:
>> More details
>>
>>http://www.openwall.com/lists/oss-security/2015/01/27/9
>>
>> redhat bug and patch
>>
>>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235
>>
>> Do we need to open a bug to track this ?
>    I am working on patches already. if you opened a bug, please send me the #.
> - Armin

Hi guys,

I opened a bug for this yesterday, (Bug 7258 - glibc: __nss_hostname_digits_dots() heap-based buffer overflow (CVE-2015-0235)) but closed it since this doesn't affect us.
 
There is another glibc issue (CVE-2013-7423?) being discussed,  I think this is also fixed in 2.20.

<solardiz> glibc "getaddrinfo() writes DNS queries to random file descriptors under high load" https://sourceware.org/bugzilla/show_bug.cgi?id=15946 "Fixed in 2.20"

//Sona