Multiple vulnerabilities have been discovered in glibc, the worst of which could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.41-r5 | >= 2.41-r5 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.41-r5"
A vulnerability has been discovered in glibc, which can lead to execution of arbitrary code..
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.40-r8 | >= 2.40-r8 |
glibc is a package that contains the GNU C library.
A vulnerability has been discovered in glibc. Please review the CVE identifier referenced below for details.
Please review the referenced CVE identifier for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.40-r8"
Multiple vulnerabilities have been discovered in glibc, the worst of which could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.38-r13 | >= 2.38-r13 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.38-r13"
Multiple vulnerabilities in glibc could result in Local Privilege Escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.38-r10 | >= 2.38-r10 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.38-r10"
Multiple vulnerabilities in glibc could result in Local Privilege Escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.37-r7 | >= 2.37-r7 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
An attacker could elevate privileges from a local user to root.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.37-r7"
Multiple vulnerabilities have been discovered in the GNU C Library, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.34-r7 | >= 2.34-r7 |
The GNU C library is the standard C library used by Gentoo Linux systems. It provides programs with basic facilities and interfaces to system calls. ld.so is the dynamic linker which prepares dynamically linked programs for execution by resolving runtime dependencies and related functions.
Multiple vulnerabilities have been discovered in GNU C Library. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GNU C Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.34-r7"
Multiple vulnerabilities in glibc could result in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.33-r1 | >= 2.33-r1 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
An attacker could cause a possible Denial of Service condition.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.33-r1"
Multiple vulnerabilities have been found in glibc, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.32-r5 | >= 2.32-r5 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.32-r5"
Multiple vulnerabilities have been found in glibc, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.30-r8 | >= 2.30-r8 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.30-r8"
Multiple vulnerabilities have been found in glibc, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.28-r4 | >= 2.28-r4 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.28-r4"
A vulnerability in the GNU C Library could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.26.0 | >= 2.26.0 |
The GNU C library is the standard C library used by Gentoo Linux systems.
A vulnerability was discovered in the GNU C Library functions xdr_bytes and xdr_string.
A remote attacker, by sending a crafted UDP packet, could cause a Denial of Service condition.
There is no known workaround at this time.
All GNU C Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.26.0"
Multiple vulnerabilities have been found in glibc, the worst of which could allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.25-r11 | >= 2.25-r11 |
glibc is a package that contains the GNU C library.
Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.
An attacker could possibly execute arbitrary code, escalate privileges, cause a Denial of Service condition, or have other unspecified impacts.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.25-r11"
Multiple vulnerabilities have been found in the GNU C Library, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.23-r4 | >= 2.23-r4 |
The GNU C library is the standard C library used by Gentoo Linux systems.
Multiple vulnerabilities have been discovered in the GNU C Library. Please review the CVE identifiers and Qualys’ security advisory referenced below for details.
An attacker could possibly execute arbitrary code with the privileges of the process, escalate privileges or cause a Denial of Service condition.
There is no known workaround at this time.
All GNU C Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.23-r4"
Multiple vulnerabilities have been found in the GNU C Library, the worst of which allows context-dependent attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.23-r3 | >= 2.23-r3 |
The GNU C library is the standard C library used by Gentoo Linux systems.
Multiple vulnerabilities have been discovered in the GNU C Library. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could possibly execute arbitrary code with the privileges of the process, disclose sensitive information, or cause a Denial of Service condition via multiple vectors.
There is no known workaround at this time.
All GNU C Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.23-r3"
Multiple vulnerabilities have been found in the GNU C library, the worst allowing for remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.21-r2 | >= 2.21-r2 |
The GNU C library is the standard C library used by Gentoo Linux systems.
Multiple vulnerabilities have been discovered in the GNU C Library:
Please review the CVEs referenced below for additional vulnerabilities that had already been fixed in previous versions of sys-libs/glibc, for which we have not issued a GLSA before.
A remote attacker could exploit any application which performs host name resolution using getaddrinfo() in order to execute arbitrary code or crash the application. The other vulnerabilities can possibly be exploited to cause a Denial of Service or leak information.
A number of mitigating factors for CVE-2015-7547 have been identified. Please review the upstream advisory and references below.
All GNU C Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.21-r2"
It is important to ensure that no running process uses the old glibc anymore. The easiest way to achieve that is by rebooting the machine after updating the sys-libs/glibc package.
Note: Should you run into compilation failures while updating, please see bug 574948.
Multiple vulnerabilities have been found in GNU C Library, the worst of which allowing a local attacker to execute arbitrary code or cause a Denial of Service .
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.19-r1 | >= 2.19-r1 |
The GNU C library is the standard C library used by Gentoo Linux systems.
Multiple vulnerabilities have been discovered in the GNU C Library. Please review the CVE identifiers referenced below for details.
A local attacker may be able to execute arbitrary code or cause a Denial of Service condition,.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.19-r1"
Multiple vulnerabilities have been found in GNU C Library, the worst of which allowing arbitrary code execution and privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.15-r3 | >= 2.15-r3 |
The GNU C library is the standard C library used by Gentoo Linux systems.
Multiple vulnerabilities have been discovered in GNU C Library. Please review the CVE identifiers referenced below for details.
A local attacker could trigger vulnerabilities in dynamic library loader, making it possible to load attacker-controlled shared objects during execution of setuid/setgid programs to escalate privileges.
A context-dependent attacker could trigger various vulnerabilities in GNU C Library, including a buffer overflow, leading to execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All GNU C Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.15-r3"
Multiple vulnerabilities were found in glibc, the worst of which allowing local attackers to execute arbitrary code as root.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | < 2.11.2-r3 | >= 2.11.2-r3 |
The GNU C library is the standard C library used by Gentoo Linux systems.
Multiple vulnerabilities were found in glibc, amongst others the widely-known recent LD_AUDIT and $ORIGIN issues. For further information please consult the CVE entries referenced below.
A local attacker could execute arbitrary code as root, cause a Denial of Service, or gain privileges. Additionally, a user-assisted remote attacker could cause the execution of arbitrary code, and a context-dependent attacker could cause a Denial of Service.
There is no known workaround at this time.
All GNU C library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.11.2-r3"
An integer overflow in the dynamic loader, ld.so, could result in the execution of arbitrary code with escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | x86 | < 2.5-r4 | >= 2.5-r4 |
The GNU C library is the standard C library used by Gentoo Linux systems. It provides programs with basic facilities and interfaces to system calls. ld.so is the dynamic linker which prepares dynamically linked programs for execution by resolving runtime dependencies and related functions.
Tavis Ormandy of the Gentoo Linux Security Team discovered a flaw in the handling of the hardware capabilities mask by the dynamic loader. If a mask is specified with a high population count, an integer overflow could occur when allocating memory.
As the hardware capabilities mask is honored by the dynamic loader during the execution of suid and sgid programs, in theory this vulnerability could result in the execution of arbitrary code with root privileges. This update is provided as a precaution against currently unknown attack vectors.
There is no known workaround at this time.
All users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.5-r4"
The catchsegv script in the glibc package is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the script.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | <= 2.3.4.20040808 | >= 2.2.5-r9 (revision), >= 2.3.2-r12 (revision), >= 2.3.3.20040420-r2 (revision), >= 2.3.4.20040619-r2 (revision), >= 2.3.4.20040808-r1 |
glibc is a package that contains the GNU C library.
The catchsegv script creates temporary files in world-writeable directories with predictable names.
A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When catchsegv script is called, this would result in the file being overwritten with the rights of the user running the utility, which could be the root user.
There is no known workaround at this time.
All glibc users should upgrade to the latest version:
# emerge sync # emerge -pv sys-libs/glibc # emerge sys-libs/glibc
glibc contains an information leak vulnerability allowing the debugging of SUID binaries.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | alpha arm hppa ia64 sparc s390 | <= 2.3.2-r10, <= 2.3.3.20040420, <= 2.3.3.20040420, <= 2.3.4.20040619, <= 2.3.4.20040605 | >= 2.3.2-r11, >= 2.3.3.20040420-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040808 |
| sys-libs/glibc | amd64 | <= 2.3.2-r10, <= 2.3.3.20040420, <= 2.3.3.20040420, <= 2.3.4.20040619, <= 2.3.4.20040605 | >= 2.3.2-r11, >= 2.3.3.20040420-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040808 |
| sys-libs/glibc | mips | <= 2.3.2-r10, <= 2.3.3.20040420, <= 2.3.3.20040420, <= 2.3.4.20040619, <= 2.3.4.20040605 | >= 2.3.2-r11, >= 2.3.3.20040420-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040808 |
| sys-libs/glibc | ppc64 | <= 2.3.2-r10, <= 2.3.3.20040420, <= 2.3.3.20040420, <= 2.3.4.20040619, <= 2.3.4.20040605 | >= 2.3.2-r11, >= 2.3.3.20040420-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040808 |
| sys-libs/glibc | x86 ppc | <= 2.3.2-r10, <= 2.3.3.20040420, <= 2.3.3.20040420, <= 2.3.4.20040619, <= 2.3.4.20040605 | >= 2.3.2-r11, >= 2.3.3.20040420-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040619-r1, >= 2.3.4.20040808 |
The GNU C library defines various Unix-like "system calls" and other basic facilities needed for a standard POSIX-like application to operate.
Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidentional information.
An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precendence over those symbols to gain information or perform further exploitation.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of glibc.
All glibc users should upgrade to the latest version:
# emerge sync # emerge -pv your_version # emerge your_version
glibc contains a buffer overflow in the getgrouplist function.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/glibc | * | <= 2.2.4 | >= 2.2.5 |
glibc is the GNU C library.
A bug in the getgrouplist function can cause a buffer overflow if the size of the group list is too small to hold all the user's groups. This overflow can cause segmentation faults in user applications. This vulnerability exists only when an administrator has placed a user in a number of groups larger than that expected by an application.
Applications that use getgrouplist can crash.
There is no known workaround at this time.
It is recommended that all Gentoo Linux users update their systems as follows:
# emerge sync # emerge -pv '>=sys-libs/glibc-2.2.5' # emerge '>=sys-libs/glibc-2.2.5' # emerge clean