MGASA-2014-0376

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0376.html
Import Source
https://advisories.mageia.org/MGASA-2014-0376.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2014-0376
Related
Published
2014-09-15T10:36:30Z
Modified
2014-09-15T10:20:02Z
Summary
Updated glibc packages fix multiple security vulnerabilities
Details

Tavis Ormandy discovered a heap-based buffer overflow in the transliteration module loading code. As a result, an attacker who can supply a crafted destination character set argument to iconv-related character conversation functions could achieve arbitrary code execution.

This update removes support of loadable gconv transliteration modules. Besides the security vulnerability, the module loading code had functionality defects which prevented it from working for the intended purpose. (CVE-2014-5119)

Adhemerval Zanella Netto discovered out-of-bounds reads in additional code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) that can be used to crash the systems, causing a denial of service conditions (CVE-2014-6040).

References
Credits

Affected packages

Mageia:4 / glibc

Package

Name
glibc
Purl
pkg:rpm/mageia/glibc?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.18-9.4.mga4

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / glibc

Package

Name
glibc
Purl
pkg:rpm/mageia/glibc?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.17-7.5.mga3

Ecosystem specific 

{
    "section": "core"
}