Advisories MDVSA-2010:112: glibc

[paul]

Multiple vulnerabilities was discovered and fixed in glibc:

 

Multiple integer overflows in the strfmon implementation in

the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow

context-dependent attackers to cause a denial of service (memory

consumption or application crash) via a crafted format string, as

demonstrated by a crafted first argument to the money_format function

in PHP, a related issue to CVE-2008-1391 (CVE-2009-4880).

 

nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6)

2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the

passwd.adjunct.byname map to entries in the passwd map, which allows

remote attackers to obtain the encrypted passwords of NIS accounts

by calling the getpwnam function (CVE-2010-0015).

 

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka

glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs,

does not properly handle newline characters in mountpoint names, which

allows local users to cause a denial of service (mtab corruption),

or possibly modify mount options and gain privileges, via a crafted

mount request (CVE-2010-0296).

 

Integer signedness error in the elf_get_dynamic_info function

in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or

libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows

user-assisted remote attackers to execute arbitrary code via a crafted

ELF program with a negative value for a certain d_tag structure member

in the ELF header (CVE-2010-0830).

 

The updated packages have been patched to correct these issues.