From bc160478117156ff8eb166b39d59fa5f07114fb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Schr=C3=B6ter?= Date: Thu, 5 Sep 2024 11:33:00 +0200 Subject: [PATCH] Adding patchinfo patchinfo.20240830115148387783.269002615871826 --- glibc | 2 +- .../_patchinfo | 49 +++++++++++++++++++ 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 patchinfo.20240830115148387783.269002615871826/_patchinfo diff --git a/glibc b/glibc index e22ea75..7e9b834 160000 --- a/glibc +++ b/glibc @@ -1 +1 @@ -Subproject commit e22ea755a4993fea72ee826a38a4d932b3748ac5 +Subproject commit 7e9b8346f71581f8fe5df8f1a1d37c92aeb43df7 diff --git a/patchinfo.20240830115148387783.269002615871826/_patchinfo b/patchinfo.20240830115148387783.269002615871826/_patchinfo new file mode 100644 index 0000000..d010a81 --- /dev/null +++ b/patchinfo.20240830115148387783.269002615871826/_patchinfo @@ -0,0 +1,49 @@ + + + Oracle Fusion Middleware component installation issue. + Update in glibc-devel-2.31-150300.52.2 causes performance regression on Sapphire Rapids CPU for glibc compiled benchmarking tests + VUL-0: CVE-2024-2961: glibc: iconv() function in the GNU C Library may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set + VUL-0: CVE-2024-33599: glibc: stack-based buffer overflow in netgroup cache + VUL-0: CVE-2024-33600: glibc: null pointer dereference after failed netgroup cache insertion + VUL-0: CVE-2024-33602: glibc: netgroup cache assumes NSS callback uses in-buffer strings + SLES 16 SP0 - s390x: glibc: z13 wcsncmp implementation segfaults if n=1 + + + + + + Andreas_Schwab + important + security + Security update for glibc + This update for glibc fixes the following issues: + +Fixed security issues: + +- CVE-2024-33602: Use time_t for return type of addgetnetgrentX (bsc#1223425) +- CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bsc#1223423) +- CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response (bsc#1223424) +- CVE-2024-33600: nscd: Do not send missing not-found response in addgetnetgrentX (bsc#1223424) +- CVE-2024-33601, CVE-2024-33602: netgroup: Use two buffers in addgetnetgrentX (bsc#1223425) +- CVE-2024-2961: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (bsc#1222992) + +Fixed non-security issues: + +- Add workaround for invalid use of libc_nonshared.a with non-SUSE libc (bsc#1221482) +- Fix segfault in wcsncmp (bsc#1228041) +- Also include stat64 in the 32-bit libc_nonshared.a workaround (bsc#1221482) +- Avoid creating ULP prologue for _start routine (bsc#1221940) +- Also add libc_nonshared.a workaround to 32-bit x86 compat package (bsc#1221482) +- malloc: Use __get_nprocs on arena_get2 +- linux: Use rseq area unconditionally in sched_getcpu + + glibc + glibc:cross-aarch64 + glibc:cross-ppc64le + glibc:cross-riscv64 + glibc:cross-s390x + glibc:i686 + glibc:testsuite + glibc:utils + +