ELSA-2017-0680 -- Oracle glibcID: oval:org.secpod.oval:def:1501806 | Date: (C)2017-03-31 (M)2023-11-10 |
Class: PATCH | Family: unix |
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: * A stack overflow vulnerability was found in nan* functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. * It was found that out-of-range time values passed to the strftime function could result in an out-of-bounds memory access. This could lead to application crash or, potentially, information disclosure. * An integer overflow vulnerability was found in hcreate and hcreate_r functions which could result in an out-of-bounds memory access. This could lead to application crash or, potentially, arbitrary code execution. * A stack based buffer overflow vulnerability was found in the catopen function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.