[gentoo-announce] [ GLSA 202107-07 ] glibc: Multiple vulnerabilities - gentoo-announce

From:	John Helmert III <ajak@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202107-07 ] glibc: Multiple vulnerabilities
Date:	Tue, 06 Jul 2021 08:35:30
Message-Id:	`YOPQkmZTYBg7Rm9l@sol.nexus.lan`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202107-07

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: glibc: Multiple vulnerabilities

9

     Date: July 06, 2021

10

     Bugs: #764176, #767718, #772425, #792261

11

       ID: 202107-07

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities in glibc could result in Denial of Service.

19

20

Background

21

==========

22

23

glibc is a package that contains the GNU C library.

24

25

Affected packages

26

=================

27

28

    -------------------------------------------------------------------

29

     Package              /     Vulnerable     /            Unaffected

30

    -------------------------------------------------------------------

31

  1  sys-libs/glibc              < 2.33-r1                 >= 2.33-r1 

32

33

Description

34

===========

35

36

Multiple vulnerabilities have been discovered in glibc. Please review

37

the CVE identifiers referenced below for details.

38

39

Impact

40

======

41

42

An attacker could cause a possible Denial of Service condition.

43

44

Workaround

45

==========

46

47

There is no known workaround at this time.

48

49

Resolution

50

==========

51

52

All glibc users should upgrade to the latest version:

53

54

  # emerge --sync

55

  # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.33-r1"

56

57

References

58

==========

59

60

[ 1 ] CVE-2019-25013

61

      https://nvd.nist.gov/vuln/detail/CVE-2019-25013

62

[ 2 ] CVE-2020-27618

63

      https://nvd.nist.gov/vuln/detail/CVE-2020-27618

64

[ 3 ] CVE-2021-27645

65

      https://nvd.nist.gov/vuln/detail/CVE-2021-27645

66

[ 4 ] CVE-2021-3326

67

      https://nvd.nist.gov/vuln/detail/CVE-2021-3326

68

[ 5 ] CVE-2021-33574

69

      https://nvd.nist.gov/vuln/detail/CVE-2021-33574

70

71

Availability

72

============

73

74

This GLSA and any updates to it are available for viewing at

75

the Gentoo Security Website:

76

77

 https://security.gentoo.org/glsa/202107-07

78

79

Concerns?

80

=========

81

82

Security is a primary focus of Gentoo Linux and ensuring the

83

confidentiality and security of our users' machines is of utmost

84

importance to us. Any security concerns should be addressed to

85

security@g.o or alternatively, you may file a bug at

86

https://bugs.gentoo.org.

87

88

License

89

=======

90

91

Copyright 2021 Gentoo Foundation, Inc; referenced text

92

belongs to its owner(s).

93

94

The contents of this document are licensed under the

95

Creative Commons - Attribution / Share Alike license.

96

97

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202107-07
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: glibc: Multiple vulnerabilities
9	Date: July 06, 2021
10	Bugs: #764176, #767718, #772425, #792261
11	ID: 202107-07
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities in glibc could result in Denial of Service.
19
20	Background
21	==========
22
23	glibc is a package that contains the GNU C library.
24
25	Affected packages
26	=================
27
28	-------------------------------------------------------------------
29	Package / Vulnerable / Unaffected
30	-------------------------------------------------------------------
31	1 sys-libs/glibc < 2.33-r1 >= 2.33-r1
32
33	Description
34	===========
35
36	Multiple vulnerabilities have been discovered in glibc. Please review
37	the CVE identifiers referenced below for details.
38
39	Impact
40	======
41
42	An attacker could cause a possible Denial of Service condition.
43
44	Workaround
45	==========
46
47	There is no known workaround at this time.
48
49	Resolution
50	==========
51
52	All glibc users should upgrade to the latest version:
53
54	# emerge --sync
55	# emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.33-r1"
56
57	References
58	==========
59
60	[ 1 ] CVE-2019-25013
61	https://nvd.nist.gov/vuln/detail/CVE-2019-25013
62	[ 2 ] CVE-2020-27618
63	https://nvd.nist.gov/vuln/detail/CVE-2020-27618
64	[ 3 ] CVE-2021-27645
65	https://nvd.nist.gov/vuln/detail/CVE-2021-27645
66	[ 4 ] CVE-2021-3326
67	https://nvd.nist.gov/vuln/detail/CVE-2021-3326
68	[ 5 ] CVE-2021-33574
69	https://nvd.nist.gov/vuln/detail/CVE-2021-33574
70
71	Availability
72	============
73
74	This GLSA and any updates to it are available for viewing at
75	the Gentoo Security Website:
76
77	https://security.gentoo.org/glsa/202107-07
78
79	Concerns?
80	=========
81
82	Security is a primary focus of Gentoo Linux and ensuring the
83	confidentiality and security of our users' machines is of utmost
84	importance to us. Any security concerns should be addressed to
85	security@g.o or alternatively, you may file a bug at
86	https://bugs.gentoo.org.
87
88	License
89	=======
90
91	Copyright 2021 Gentoo Foundation, Inc; referenced text
92	belongs to its owner(s).
93
94	The contents of this document are licensed under the
95	Creative Commons - Attribution / Share Alike license.
96
97	https://creativecommons.org/licenses/by-sa/2.5