- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3850-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                          Adrian Bunk
June 30, 2024                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : glibc
Version        : 2.28-10+deb10u4
CVE ID         : CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602

Multiple vulnerabilities have been fixed in the Name Service Cache Daemon
that is built by the GNU C library and shipped in the nscd binary package.

CVE-2024-33599

    nscd: Stack-based buffer overflow in netgroup cache

CVE-2024-33600

    nscd: Null pointer crashes after notfound response

CVE-2024-33601

    nscd: Daemon may terminate on memory allocation failure

CVE-2024-33602

    nscd: Possible memory corruption

For Debian 10 buster, these problems have been fixed in version
2.28-10+deb10u4.

We recommend that you upgrade your glibc packages.

For the detailed security status of glibc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/glibc

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS