ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2015.0195
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2015-0195)
Resumen:	The remote host is missing an update for the 'glibc' package(s) announced via the MGASA-2015-0195 advisory.
Descripción:	Summary: The remote host is missing an update for the 'glibc' package(s) announced via the MGASA-2015-0195 advisory. Vulnerability Insight: Updated glibc package fixes security vulnerabilities: It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data. (CVE-2013-7423) It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121) A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1781) Joseph Myers discovered strxfrm is vulnerable to integer overflows when computing memory allocation sizes (similar to CVE-2012-4412) [BZ #16009] (CVE pending) Shaun Colley discovered strxfrm falls back to an unbounded alloca if malloc fails making it vulnerable to stack-based buffer overflows (similar to CVE-2012-4424) [BZ #16009] (CVE pending) A buffer overflow flaw was found in libio/wstrops.c:_IO_wstr_overflow which allows for overflow in calculating the new size in wide characters, but not for overflow in the multiplication to compute the size in bytes, which could thus overflow and result in a buffer overrun copying data into the new buffer. [BZ #17269] (CVE pending) When processing certain malformed patterns, fnmatch can skip over the NUL byte terminating the pattern. This can potentially result in an application crash if fnmatch hits an unmapped page before encountering a NUL byte. [BZ #18032] (CVE pending) Other fixes in this update: nscd package was missing the /var/db/nscd directory which prevented it to work properly (mga#15545). Affected Software/OS: 'glibc' package(s) on Mageia 4. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-7423 BugTraq ID: 72844 http://www.securityfocus.com/bid/72844 http://seclists.org/fulldisclosure/2021/Sep/0 https://security.gentoo.org/glsa/201602-02 http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://www.openwall.com/lists/oss-security/2015/01/28/20 RedHat Security Advisories: RHSA-2015:0863 http://rhn.redhat.com/errata/RHSA-2015-0863.html RedHat Security Advisories: RHSA-2016:1207 https://access.redhat.com/errata/RHSA-2016:1207 SuSE Security Announcement: openSUSE-SU-2015:0351 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html http://www.ubuntu.com/usn/USN-2519-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-8121 73038 http://www.securityfocus.com/bid/73038 DSA-3480 http://www.debian.org/security/2016/dsa-3480 GLSA-201602-02 RHSA-2015:0327 http://rhn.redhat.com/errata/RHSA-2015-0327.html SUSE-SU-2015:1424 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html SUSE-SU-2016:0470 http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html USN-2985-1 http://www.ubuntu.com/usn/USN-2985-1 USN-2985-2 http://www.ubuntu.com/usn/USN-2985-2 [libc-alpha] 20150223 [PATCH] CVE-2014-8121: Fix nss_files file management [BZ#18007] https://sourceware.org/ml/libc-alpha/2015-02/msg00617.html https://bugzilla.redhat.com/show_bug.cgi?id=1165192 Common Vulnerability Exposure (CVE) ID: CVE-2015-1781 1032178 http://www.securitytracker.com/id/1032178 74255 http://www.securityfocus.com/bid/74255 FEDORA-2016-0480defc94 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html RHSA-2015:0863 https://rhn.redhat.com/errata/RHSA-2015-0863.html [libc-alpha] 20150814 The GNU C Library version 2.22 is now available https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html https://sourceware.org/bugzilla/show_bug.cgi?id=18287 https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=2959eda9272a03386
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.