Test ID:	1.3.6.1.4.1.25623.1.1.10.2024.0026
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2024-0026)
Summary:	The remote host is missing an update for the 'glibc' package(s) announced via the MGASA-2024-0026 advisory.
Description:	Summary: The remote host is missing an update for the 'glibc' package(s) announced via the MGASA-2024-0026 advisory. Vulnerability Insight: The updated packages fix security vulnerabilities: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. (CVE-2023-6246) An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. (CVE-2023-6779) An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. (CVE-2023-6780) Affected Software/OS: 'glibc' package(s) on Mageia 9. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-6246 RHBZ#2249053 https://bugzilla.redhat.com/show_bug.cgi?id=2249053 http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html http://seclists.org/fulldisclosure/2024/Feb/3 http://seclists.org/fulldisclosure/2024/Feb/5 https://access.redhat.com/security/cve/CVE-2023-6246 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/ https://security.gentoo.org/glsa/202402-01 https://www.openwall.com/lists/oss-security/2024/01/30/6 https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt Common Vulnerability Exposure (CVE) ID: CVE-2023-6779 RHBZ#2254395 https://bugzilla.redhat.com/show_bug.cgi?id=2254395 https://access.redhat.com/security/cve/CVE-2023-6779 Common Vulnerability Exposure (CVE) ID: CVE-2023-6780 RHBZ#2254396 https://bugzilla.redhat.com/show_bug.cgi?id=2254396 https://access.redhat.com/security/cve/CVE-2023-6780
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.