Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0872
The remote host is missing updates announced in
advisory RHSA-2010:0872.

The glibc packages contain the standard C libraries used by multiple
programs on the system. These packages contain the standard C and the
standard math libraries. Without these two libraries, a Linux system
cannot function properly.

It was discovered that the glibc dynamic linker/loader did not handle the
$ORIGIN dynamic string token set in the LD_AUDIT environment variable
securely. A local attacker with write access to a file system containing
setuid or setgid binaries could use this flaw to escalate their privileges.

It was discovered that the glibc dynamic linker/loader did not perform
sufficient safety checks when loading dynamic shared objects (DSOs) to
provide callbacks for its auditing API during the execution of privileged
programs. A local attacker could use this flaw to escalate their privileges
via a carefully-chosen system DSO library containing unsafe constructors.

Red Hat would like to thank Tavis Ormandy for reporting the CVE-2010-3847
issue, and Ben Hawkes and Tavis Ormandy for reporting the CVE-2010-3856

This update also fixes the following bugs:

* Previously, the generic implementation of the strstr() and memmem()
functions did not handle certain periodic patterns correctly and could find
a false positive match. This error has been fixed, and both functions now
work as expected. (BZ#643341)

* The TCB_ALIGNMENT value has been increased to 32 bytes to prevent
applications from crashing during symbol resolution on 64-bit systems with
support for Intel AVX vector registers. (BZ#643343)

All users are advised to upgrade to these updated packages, which contain
backported patches to correct these issues.

Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

Risk factor : High

CVSS Score:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-3847
BugTraq ID: 44154
Bugtraq: 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap (Google Search)
CERT/CC vulnerability note: VU#537223
Debian Security Information: DSA-2122 (Google Search)
RedHat Security Advisories: RHSA-2010:0787
SuSE Security Announcement: SUSE-SA:2010:052 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2010-3856
BugTraq ID: 44347
Bugtraq: 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series (Google Search)
RedHat Security Advisories: RHSA-2010:0793
CopyrightCopyright (c) 2011 E-Soft Inc.

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.