MGASA-2021-0308

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2021-0308.html
Import Source
https://advisories.mageia.org/MGASA-2021-0308.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2021-0308
Related
Published
2021-06-30T23:58:41Z
Modified
2021-06-30T22:40:02Z
Summary
Updated glibc packages fix security vulnerability
Details

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact (CVE-2021-33574).

Other fixes in this update: - fix triggers so ldconfig is always run on both installing and uninstalling libs (mga#28797) - Fix SXID_ERASE behavior in setuid programs [BZ#27471]

References
Credits

Affected packages

Mageia:8 / glibc

Package

Name
glibc
Purl
pkg:rpm/mageia/glibc?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.32-16.mga8

Ecosystem specific 

{
    "section": "core"
}