AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-24 05:50:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add references to CVE-2017-18269, CVE-2018-11236, CVE-2018-11237

Browse Source
This commit is contained in:
Florian Weimer 2018-05-24 12:19:11 +02:00
parent 1dfeb17e67
commit 43d4f3d5ad
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -817,6 +817,7 @@
2018-05-09 Paul Pluzhnikov <ppluzhnikov@google.com> 2018-05-09 Paul Pluzhnikov <ppluzhnikov@google.com>
[BZ #22786] [BZ #22786]
CVE-2018-11236
* stdlib/canonicalize.c (__realpath): Fix overflow in path length * stdlib/canonicalize.c (__realpath): Fix overflow in path length
computation. computation.
* stdlib/Makefile (test-bz22786): New test. * stdlib/Makefile (test-bz22786): New test.
@ -2676,6 +2677,7 @@
Max Horn <max@quendi.de> Max Horn <max@quendi.de>
[BZ #22644] [BZ #22644]
CVE-2017-18269
* sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed * sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed
branch conditions. branch conditions.
* string/test-memmove.c (do_test2): New testcase. * string/test-memmove.c (do_test2): New testcase.

11
NEWS
View File

@ -109,6 +109,17 @@ Security related changes:
the system-provided libidn2 library instead. Originally reported by Hanno the system-provided libidn2 library instead. Originally reported by Hanno
Böck and Christian Weisgerber. Böck and Christian Weisgerber.
CVE-2017-18269: An SSE2-based memmove implementation for the i386
architecture could corrupt memory. Reported by Max Horn.
CVE-2018-11236: Very long pathname arguments to realpath function could
result in an integer overflow and buffer overflow. Reported by Alexey
Izbyshev.
CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi
architecture could write beyond the target buffer, resulting in a buffer
overflow. Reported by Andreas Schwab.
The following bugs are resolved with this release: The following bugs are resolved with this release:
[The release manager will add the list generated by [The release manager will add the list generated by