1.64. glibc

Updated glibc packages that resolve several issues are now available.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contains the standard C and the standard math libraries. Without these two libraries, the Linux system cannot function properly.

These updated glibc packages provide fixes for the following bugs:

* when a thread calls the setuid() function, the change of credentials needs to be performed in every thread as per POSIX requirements. This update corrects the implementation to avoid a race condition which occurred when a thread terminated or a new thread was created while the credential change was performed. (BZ#533213)

* the implementation of the seg_timedwait() function, in assembler, incorrectly decremented the number of waiting threads stored in a block of memory when an invalid nanosecond value was passed through its second argument. This error is corrected in this update. (BZ#540475)

All users of glibc are advised to upgrade to these updated packages, which resolve these issues.

Updated glibc packages that fix a race condition while loading shared libraries are now available

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contains the standard C and the standard math libraries. Without these two libraries, the Linux system cannot function properly.

These updated glibc packages provide a fix for the following bug:

* a rarely-encountered and difficult-to-reproduce race condition existed between resolving dynamic symbols and loading shared libraries that could have resulted in library dependencies not being resolved. This update provides a fix that avoids the potential race condition. (BZ#548692)

All users are advised to upgrade to these updated packages, which resolve this issue.

Updated glibc packages that fix several bugs and add an enhancement are now available.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, the Linux system cannot function properly.

This update applies the following bug fixes:

* a race condition with seteuid() occured between the threads that run on starting the program, presenting the error "EUID is already set!" within 10 to 15 seconds. These updates provide exclusive processes running with no error on startup. (BZ#491995 and BZ#522528)

* assembler implementation of sem_timedwait() on x86/x86_64 wrongly decrements the number of waiting threads stored in block of memory pointed to by (sem_t *) when an invalid nanosecond argument is used. This fix allows the correct nanosecond argument to be passed through the second argument. (BZ#529997)

* a race condition in glibc, between _dl_lookup_symbol_x() and dlopen/dlclose/etc, resulted in a failure in resolving dependencies. These updates provide for processes that are exclusive. (BZ#547631)

This update also adds the following enhancement:

* glibc: incorporates a number of tests to detect corruption in data structures used for heap memory allocation (malloc/free). This corruption can be caused deliberately by attackers exploiting buffer overflow vulnerabilities. This enhancement provides additional corruption tests. (BZ#530107)

All users are advised to upgrade to this updated package, which resolves these issues and adds this enhancement.