CVE-2015-1781

Updated glibc package fixes security vulnerabilities:

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data. (CVE-2013-7423)

It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1781)

Joseph Myers discovered strxfrm is vulnerable to integer overflows when computing memory allocation sizes (similar to CVE-2012-4412) [BZ #16009] (CVE pending)

Shaun Colley discovered strxfrm falls back to an unbounded alloca if malloc fails making it vulnerable to stack-based buffer overflows (similar to CVE-2012-4424) [BZ #16009] (CVE pending)

A buffer overflow flaw was found in libio/wstrops.c:_IO_wstr_overflow wich allows for overflow in calculating the new size in wide characters, but not for overflow in the multiplication to compute the size in bytes, which could thus overflow and result in a buffer overrun copying data into the new buffer. [BZ #17269] (CVE pending)

When processing certain malformed patterns, fnmatch can skip over the NUL byte terminating the pattern. This can potentially result in an application crash if fnmatch hits an unmapped page before encountering a NUL byte. [BZ #18032] (CVE pending)

Other fixes in this update: nscd package was missing the /var/db/nscd directory wich prevented it to work properly (mga#15545).

These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.

This update for glibc provides fixes for security and non-security issues.

These security issues have been fixed:

• CVE-2015-1781: Buffer length after padding in resolv/nss_dns/dns-host.c. (bsc#927080)
• CVE-2013-2207: pt_chown did not properly check permissions for tty files, which allowed local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system. (bsc#830257)
• CVE-2014-8121: DB_LOOKUP in the Name Service Switch (NSS) did not properly check if a file is open, which allowed remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over the database, which triggers the file pointer to be reset. (bsc#918187)
• Fix read past end of pattern in fnmatch. (bsc#920338)

These non-security issues have been fixed:

• Fix locking in _IO_flush_all_lockp() to prevent deadlocks in applications. (bsc#851280)
• Record TTL also for DNS PTR queries. (bsc#928723)
• Fix invalid free in ld.so. (bsc#932059)
• Make PowerPC64 default to non-executable stack. (bsc#933770)
• Fix floating point exceptions in some circumstances with exp() and friends. (bsc#933903)
• Fix bad TEXTREL in glibc.i686. (bsc#935286)

glibc was updated to fix bugs and security issues.

Security issues fixed:

• A buffer overflow in nss_dns was fixed that could lead to crashes. (CVE-2015-1781, bsc#927080, BZ #18287)
• A denial of service attack (out of memory) in the NSS files backend was fixed (CVE-2014-8121, bsc#918187, GLIBC BZ #18007)

Non security bugs fixed:

• Fix regression in threaded application malloc performance (bsc#915955, GLIBC#17195)
• Fix read past end of pattern in fnmatch (bsc#920338, GLIBC#17062, GLIBC#18032, GLIBC#18036)
• Record TTL also for DNS PTR queries (bsc#928723, GLIBC#18513)
• Increase MINSIGSTKSZ and SIGSTKSZ for aarch64 (bsc#931480, GLIBC#16850)
• Fix handling of IPv6 nameservers (bsc#939211, GLIBC#13028, GLIBC#17053)
• Avoid use of asm/ptrace.h (bsc#934084)
• Do not corrupt the top of a threaded heap if top chunk is MINSIZE (GLIBC#18502)
• Terminate unwinding after makecontext_ret on s390 (bsc#940332. bsc#944494, GLIBC#18508)
• Restore signal mask in set/swapcontext on s390 (bsc#940195, bsc#944494, GLIBC#18080)
• fix dlopen in static binaries (bsc#937853, GLIBC#17250)
• Properly reread entry after failure in nss_files getent function (bsc#945779, BZ #18991)

Features added:

• AVX512 support (fate#318844)
• Add compatibility symlinks for LSB 3.0 (fate#318933)

This update for glibc fixes the following issues:

• CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721)
• CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944)
• CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736)
• CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737)
• CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738)
• CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739)
• CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal (bsc#830257)
• CVE-2013-4458: Stack (frame) overflow in getaddrinfo() when called with AF_INET6 (bsc#847227)
• CVE-2014-8121: denial of service issue in the NSS backends (bsc#918187)
• bsc#920338: Read past end of pattern in fnmatch
• CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)

The following non-security bugs were fixed:

• bnc#892065: SIGSEV tst-setlocale3 in glibc-2.11.3-17.68.1
• bnc#863499: Memory leak in getaddrinfo when many RRs are returned
• bsc#892065: Avoid unbound alloca in setenv
• bsc#945779: Properly reread entry after failure in nss_files getent function

Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. (CVE-2013-2207, CVE-2016-2856)

Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite loop). (CVE-2014-8121)

Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2015-1781)

Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not handle long lines in the files databases correctly. A local attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-range argument data. An attacker could use this to cause a denial of service (application crash) or possibly expose sensitive information. (CVE-2015-8776)

Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege boundaries. A local attacker could use this to exploit an existing vulnerability more easily. (CVE-2015-8777)

Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size argument, leading to an integer overflow. An attacker could use to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-8778)

Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C Library when handling long catalog names. An attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly handle long names passed as arguments. An attacker could use to cause a denial of service (stack exhaustion leading to an application crash). (CVE-2016-3075)