Bug 914281 (CVE-2023-4527, CVE-2023-4806)

Summary:	<sys-libs/glibc-{2.37-r5, 2.38-r2}: Multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	toolchain
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://sourceware.org/bugzilla/show_bug.cgi?id=30842 https://sourceware.org/bugzilla/show_bug.cgi?id=30843 https://bugs.gentoo.org/show_bug.cgi?id=918412
Whiteboard:	A3 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:	915142
Bug Blocks:

Description Sam James archtester

2023-09-16 09:53:57 UTC

1) Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)

See https://sourceware.org/bugzilla/show_bug.cgi?id=30842.

2) Potential use-after-free in getcanonname (CVE-2023-4806)

See https://sourceware.org/bugzilla/show_bug.cgi?id=30843.

Comment 1 Sam James archtester

2023-09-16 09:54:58 UTC

commit 5e4787264d2ac33ff1718753e683122950fcf317
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Sat Sep 16 11:39:52 2023 +0200

    sys-libs/glibc: 2.37 and 2.38 patchset bumps, untested

    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

Comment 2 Andreas K. Hüttel archtester

2023-09-17 21:30:47 UTC

Both re-keyworded as of now

Comment 3 Sam James archtester

2023-10-03 21:50:40 UTC

GLSA request filed.

Comment 4 Larry the Git Cow gentoo-dev

2023-10-04 08:02:46 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=029e12731f29676d3f6ebed09f7747ee6e15c5e8

commit 029e12731f29676d3f6ebed09f7747ee6e15c5e8
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-10-04 08:02:08 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-10-04 08:02:41 +0000

    [ GLSA 202310-03 ] glibc: Multiple vulnerabilities
    
    Bug: https://bugs.gentoo.org/867952
    Bug: https://bugs.gentoo.org/914281
    Bug: https://bugs.gentoo.org/915127
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202310-03.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)