CVE-2014-6040

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.

This update removes support of loadable gconv transliteration modules. Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose. (CVE-2014-5119)

Adhemerval Zanella Netto discovered out-of-bounds reads in additional code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) that can be used to crash the systems, causing a denial of service conditions (CVE-2014-6040).

These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.

This glibc update fixes a critical privilege escalation problem and two non-security issues:

* bnc#892073: An off-by-one error leading to a heap-based buffer
  overflow was found in __gconv_translit_find(). An exploit that
  targets the problem is publicly available. (CVE-2014-5119)
* bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.
* bnc#888347: printf-multibyte-format.patch: Don't parse %s format
  argument as multi-byte string.

Security Issues:

* CVE-2014-5119
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119>

This glibc update fixes a critical privilege escalation problem and two non-security issues:

* bnc#892073: An off-by-one error leading to a heap-based buffer
  overflow was found in __gconv_translit_find(). An exploit that
  targets the problem is publicly available. (CVE-2014-5119)
* bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.
* bnc#888347: printf-multibyte-format.patch: Don't parse %s format
  argument as multi-byte string.

Security Issues:

* CVE-2014-5119
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119>

This glibc update fixes a critical privilege escalation problem and two non-security issues:

* bnc#892073: An off-by-one error leading to a heap-based buffer
  overflow was found in __gconv_translit_find(). An exploit that
  targets the problem is publicly available. (CVE-2014-5119)
* bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.
* bnc#888347: printf-multibyte-format.patch: Don't parse %s format
  argument as multi-byte string.

Security Issues:

* CVE-2014-5119
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119>

This update for glibc contains the following fixes:

* Fix integer overflows in malloc (CVE-2013-4332, bnc#839870)
* Fix buffer overflow in glob (bnc#691365)
* Fix buffer overflow in strcoll (CVE-2012-4412, bnc#779320)
* Update mount flags in <sys/mount.h> (bnc#791928)
* Fix buffer overrun in regexp matcher (CVE-2013-0242, bnc#801246)
* Fix memory leaks in dlopen (bnc#811979)
* Fix stack overflow in getaddrinfo with many results (CVE-2013-1914,
  bnc#813121)
* Fix check for XEN build in glibc_post_upgrade that causes missing
  init re-exec (bnc#818628)
* Don't raise UNDERFLOW in tan/tanf for small but normal argument
  (bnc#819347)
* Properly cross page boundary in SSE4.2 implementation of strcmp
  (bnc#822210)
* Fix robust mutex handling after fork (bnc#827811)
* Fix missing character in IBM-943 charset (bnc#828235)
* Fix use of alloca in gaih_inet (bnc#828637)
* Initialize pointer guard also in static executables (CVE-2013-4788,
  bnc#830268)
* Fix readdir_r with long file names (CVE-2013-4237, bnc#834594).

Security Issues:

* CVE-2012-4412
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412>
* CVE-2013-0242
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242>
* CVE-2013-1914
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1914>
* CVE-2013-4237
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237>
* CVE-2013-4332
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332>
* CVE-2013-4788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4788>

GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.

Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled certain multibyte characters when using the iconv function. An attacker could possibly use this issue to cause applications to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2012-6656)

Adhemerval Zanella Netto discovered that the GNU C Library incorrectly handled certain multibyte characters when using the iconv function. An attacker could possibly use this issue to cause applications to crash, resulting in a denial of service. (CVE-2014-6040)

Tim Waugh discovered that the GNU C Library incorrectly enforced the WRDE_NOCMD flag when handling the wordexp function. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2014-7817)