MGASA-2024-0026 - Updated glibc packages fix security vulnerabilities

Publication date: 04 Feb 2024
URL: https://advisories.mageia.org/MGASA-2024-0026.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-6246,
     CVE-2023-6779,
     CVE-2023-6780

The updated packages fix security vulnerabilities:
A heap-based buffer overflow was found in the __vsyslog_internal
function of the glibc library. This function is called by the syslog and
vsyslog functions. This issue occurs when the openlog function was not
called, or called with the ident argument set to NULL, and the program
name (the basename of argv[0]) is bigger than 1024 bytes, resulting in
an application crash or local privilege escalation. (CVE-2023-6246)
An off-by-one heap-based buffer overflow was found in the
__vsyslog_internal function of the glibc library. This function is
called by the syslog and vsyslog functions. This issue occurs when these
functions are called with a message bigger than INT_MAX bytes, leading
to an incorrect calculation of the buffer size to store the message,
resulting in an application crash. (CVE-2023-6779)
An integer overflow was found in the __vsyslog_internal function of the
glibc library. This function is called by the syslog and vsyslog
functions. This issue occurs when these functions are called with a very
long message, leading to an incorrect calculation of the buffer size to
store the message, resulting in undefined behavior. (CVE-2023-6780)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32796
- https://security-tracker.debian.org/tracker/DSA-5611-1
- https://bodhi.fedoraproject.org/updates/FEDORA-2024-aec80d6e8a
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6246
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6779
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6780

SRPMS:
- 9/core/glibc-2.36-52.mga9