CVE-2016-10739

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.

• CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection
• CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new _validate_host helper to prevent CRLF header injection (the glibc CVE-2016-10739 mitigation shipped on RHEL 7+ is not present on CentOS 6 / Oracle Linux 6 ELS)
• CVE-2018-1000030: cache the readahead buffer thread-locally inside file_iternext to fix heap buffer corruption and crashes when multiple threads iterate over the same file object

• CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection
• CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new _validate_host helper to prevent CRLF header injection (the glibc CVE-2016-10739 mitigation shipped on RHEL 7+ is not present on CentOS 6 / Oracle Linux 6 ELS)
• CVE-2018-1000030: cache the readahead buffer thread-locally inside file_iternext to fix heap buffer corruption and crashes when multiple threads iterate over the same file object

This update for glibc fixes the following issues:

Security issue fixed:

• CVE-2016-10739: Fixed an improper implementation of getaddrinfo function which could allow applications to incorrectly assume that had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings (bsc#1122729).

Other issue fixed:

• Fixed an issue where pthread_mutex_trylock did not use a correct order of instructions while maintained the robust mutex list due to missing compiler barriers (bsc#1130045).
• Added new Japanese Era name support (bsc#1100396).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

Security issue fixed:

• CVE-2016-10739: Fixed an improper implementation of getaddrinfo function which could allow applications to incorrectly assume that had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings (bsc#1122729).

Other issue fixed:

• Fixed an issue where pthread_mutex_trylock did not use a correct order of instructions while maintained the robust mutex list due to missing compiler barriers (bsc#1130045).
• Added new Japanese Era name support (bsc#1100396).

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2019-9169: regex: fix read overrun (bsc#1127308, BZ #24114)
• CVE-2016-10739: Fully parse IPv4 address strings (bsc#1122729, BZ #20018)
• CVE-2009-5155: ERE '0|()0|\1|0' causes regexec undefined behavior (bsc#1127223, BZ #18986)

Non-security issues fixed:

• Enable TLE only if GLIBC_ELISION_ENABLE=yes is defined (bsc#1131994, fate#322271)
• Add more checks for valid ld.so.cache file (bsc#1110661, BZ #18093)
• Added cfi information for start routines in order to stop unwinding (bsc#1128574)
• ja_JP locale: Add entry for the new Japanese era (bsc#1100396, fate#325570, BZ #22964)

This update for glibc fixes the following issues:

• CVE-2016-10739: getaddrinfo: Fully parse IPv4 address strings (bsc#1122729)