[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a824f65a-ef15-43ea-9563-264c99f88bf1@oracle.com>
Date: Mon, 22 Jul 2024 09:58:35 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: GNU C Library version 2.40 released with 5 CVE fixes
https://lists.gnu.org/archive/html/info-gnu/2024-07/msg00013.html was mailed
out a couple hours ago, announcing the release of GNU libc 2.40.
The announcement included this section:
> Security related changes:
>
> The following CVEs were fixed in this release, details of which can be
> found in the advisories directory of the release tarball:
>
> GLIBC-SA-2024-0004:
> ISO-2022-CN-EXT: fix out-of-bound writes when writing escape
> sequence (CVE-2024-2961)
>
> GLIBC-SA-2024-0005:
> nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599)
>
> GLIBC-SA-2024-0006:
> nscd: Null pointer crash after notfound response (CVE-2024-33600)
>
> GLIBC-SA-2024-0007:
> nscd: netgroup cache may terminate daemon on memory allocation
> failure (CVE-2024-33601)
>
> GLIBC-SA-2024-0008:
> nscd: netgroup cache assumes NSS callback uses in-buffer strings
> (CVE-2024-33602)
The advisories can also be found at:
https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=glibc-2.40
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
