MGASA-2014-0376

Dashboard / Vulnerabilities / MGASA-2014-0376

MGASA-2014-0376

Summary: Updated glibc packages fix multiple security vulnerabilities

Details: Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution. This update removes support of loadable gconv transliteration modules. Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose. (CVE-2014-5119) Adhemerval Zanella Netto discovered out-of-bounds reads in additional code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) that can be used to crash the systems, causing a denial of service conditions (CVE-2014-6040).

References: https://advisories.mageia.org/MGASA-2014-0376.html, https://bugs.mageia.org/show_bug.cgi?id=13995, https://www.debian.org/security/2014/dsa-3012, http://openwall.com/lists/oss-security/2014/08/26/2, http://openwall.com/lists/oss-security/2014/09/02/1