| Description: | Summary:
The remote host is missing an update for the 'glibc' package(s) announced via the SSA:2010-301-01 advisory.
Vulnerability Insight:
New glibc packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1,
and -current to fix a security issue.
Here are the details from the Slackware 13.1 ChangeLog:
+--------------------------+
patches/packages/glibc-2.11.1-i486-5_slack13.1.txz: Rebuilt.
Patched 'The GNU C library dynamic linker will dlopen arbitrary DSOs
during setuid loads.' This security issue allows a local attacker to
gain root by specifying an unsafe DSO in the library search path to be
used with a setuid binary in LD_AUDIT mode.
Bug found by Tavis Ormandy (with thanks to Ben Hawkes and Julien Tinnes).
For more information, see:
[links moved to references]
(* Security fix *)
patches/packages/glibc-i18n-2.11.1-i486-5_slack13.1.txz: Rebuilt.
patches/packages/glibc-profile-2.11.1-i486-5_slack13.1.txz: Rebuilt.
patches/packages/glibc-solibs-2.11.1-i486-5_slack13.1.txz: Upgraded.
(* Security fix *)
patches/packages/glibc-zoneinfo-2.11.1-noarch-5_slack13.1.txz: Upgraded.
Rebuilt to tzcode2010n and tzdata2010n.
+--------------------------+
Affected Software/OS:
'glibc' package(s) on Slackware 12.0, Slackware 12.1, Slackware 12.2, Slackware 13.0, Slackware 13.1, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
7.2
CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
