Synopsis

Critical: glibc security update

Type/Severity

Security Advisory: Critical

Topic

Updated glibc packages that fix one security issue are now available for
Red Hat Enterprise Linux 4 Extended Life Cycle Support.

Red Hat Product Security has rated this update as having Critical security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

The glibc packages provide the standard C libraries (libc), POSIX thread
libraries (libpthread), standard math libraries (libm), and the Name
Server Caching Daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.

A heap-based buffer overflow was found in glibc's
__nss_hostname_digits_dots() function, which is used by the gethostbyname()
and gethostbyname2() glibc function calls. A remote attacker able to make
an application call either of these functions could use this flaw to
execute arbitrary code with the permissions of the user running the
application. (CVE-2015-0235)

Red Hat would like to thank Qualys for reporting this issue.

All glibc users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server - Extended Life Cycle Support 4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 4 ia64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 4 i386

Fixes

• BZ - 1183461 - CVE-2015-0235 glibc: __nss_hostname_digits_dots() heap-based buffer overflow

CVEs

• CVE-2015-0235

References

• https://access.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server - Extended Life Cycle Support 4

SRPM
glibc-2.3.4-2.57.el4.2.src.rpm	SHA-256: 07054cb3f0da72cbc5585438397fecdef17e0e400aac6ebdc63698194dba567c
x86_64
glibc-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 714f186b1ca5f9376659436e4d9673344b0bedb73fc18dfaf3dbe69a3ab02856
glibc-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 714f186b1ca5f9376659436e4d9673344b0bedb73fc18dfaf3dbe69a3ab02856
glibc-common-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 306f6b61c0e09377f61963e0ec7102e15ba4deca45c1aa63cc6018e4e1a332f7
glibc-common-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 306f6b61c0e09377f61963e0ec7102e15ba4deca45c1aa63cc6018e4e1a332f7
glibc-devel-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 6e2e1404c23dc0aefe97f7f8ecec362dc297ad895fcc074db89cd2f6683cfed5
glibc-devel-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 6e2e1404c23dc0aefe97f7f8ecec362dc297ad895fcc074db89cd2f6683cfed5
glibc-devel-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 5598615952ca74682e08353a85b2254b8dce86f162657d03d5416553af4c5c72
glibc-devel-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 5598615952ca74682e08353a85b2254b8dce86f162657d03d5416553af4c5c72
glibc-headers-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 5f7b60c1699110569d0c41db8a3e47028565ca09899b38e4a30e4ead11c4eb2c
glibc-headers-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 5f7b60c1699110569d0c41db8a3e47028565ca09899b38e4a30e4ead11c4eb2c
glibc-profile-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 46f29697a4df76d7ea03891e53cffce4fcf87d0ff459d952c148bf5099381f23
glibc-profile-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 46f29697a4df76d7ea03891e53cffce4fcf87d0ff459d952c148bf5099381f23
glibc-utils-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: cc59d5fdb521cb683ec70fbfd78b58e2b302379229e9fe568b8688d1c5f36063
glibc-utils-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: cc59d5fdb521cb683ec70fbfd78b58e2b302379229e9fe568b8688d1c5f36063
nptl-devel-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 665a371417990943e1a3a2ceb5141bf29166d7b6aee00d3b041502fe6cdfd798
nptl-devel-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: 665a371417990943e1a3a2ceb5141bf29166d7b6aee00d3b041502fe6cdfd798
nscd-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: a7bae3667f85cfff8d3e61415efbdb04b3a98941b1e499139a4130c5475080f3
nscd-2.3.4-2.57.el4.2.x86_64.rpm	SHA-256: a7bae3667f85cfff8d3e61415efbdb04b3a98941b1e499139a4130c5475080f3
ia64
glibc-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: b7b1c85a48e66f05eb17ebf61bdfdb1c284fd640fd3683f8121fabc797a4421e
glibc-common-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: 88a0e00358fd93bef6267a4594749ad58ae73399590192ce6c487d4e8a4f879e
glibc-devel-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: d80ad88b4915cc19a5417e1101da0e4bf2d3be79d153f4ef7f096ecff9fcd40a
glibc-headers-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: a3d463d7c1e5438e3775539795dffbdf4da7c34745f401e822e7558d29e8f14a
glibc-profile-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: 7c89797774e5c687a39a1456fe39c9b91cdf90c68ace8daf5af7299ee019c299
glibc-utils-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: e7bdb60699e868799e443a6bc68d93c0d8c08a1f508336859a2d291cb2b5598d
nptl-devel-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: 9e0fce30c934560a3c61f4fa80235a6617bda787f64d942879885e1f4dac505d
nscd-2.3.4-2.57.el4.2.ia64.rpm	SHA-256: d0e4cf0ced2f4cc4cd245d4a86974935dc9510855f6e97de76daf3611d7d5dcd
i386
glibc-2.3.4-2.57.el4.2.i386.rpm	SHA-256: d9d19fca30601a3d6309a6c5b8619d032a3d42ac4e0a7375ffcdce6b6e4c2ba7
glibc-2.3.4-2.57.el4.2.i386.rpm	SHA-256: d9d19fca30601a3d6309a6c5b8619d032a3d42ac4e0a7375ffcdce6b6e4c2ba7
glibc-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-common-2.3.4-2.57.el4.2.i386.rpm	SHA-256: b0ea4cc7799f43ef6b8a3a41ff16519c19836d8acb0fe75306c982a19e545820
glibc-common-2.3.4-2.57.el4.2.i386.rpm	SHA-256: b0ea4cc7799f43ef6b8a3a41ff16519c19836d8acb0fe75306c982a19e545820
glibc-devel-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 6e2e1404c23dc0aefe97f7f8ecec362dc297ad895fcc074db89cd2f6683cfed5
glibc-devel-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 6e2e1404c23dc0aefe97f7f8ecec362dc297ad895fcc074db89cd2f6683cfed5
glibc-headers-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 3578922da3750436b0708b16f49a91b9ad29db10a715c2c71d3ec386b91479c4
glibc-headers-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 3578922da3750436b0708b16f49a91b9ad29db10a715c2c71d3ec386b91479c4
glibc-profile-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 91ef3b9707e605ca7662e7b42714a17e1b60075c00eec318dc939cdb83762245
glibc-profile-2.3.4-2.57.el4.2.i386.rpm	SHA-256: 91ef3b9707e605ca7662e7b42714a17e1b60075c00eec318dc939cdb83762245
glibc-utils-2.3.4-2.57.el4.2.i386.rpm	SHA-256: d528dace670e25d58b87bf5fccf22a8b6365d7fa28f9dec26a31c8d86a54c331
glibc-utils-2.3.4-2.57.el4.2.i386.rpm	SHA-256: d528dace670e25d58b87bf5fccf22a8b6365d7fa28f9dec26a31c8d86a54c331
nptl-devel-2.3.4-2.57.el4.2.i386.rpm	SHA-256: ec848d9ee4548ae102ea2753959373c16fa2489b75b328d2bd7d4cc645ff2cfe
nptl-devel-2.3.4-2.57.el4.2.i386.rpm	SHA-256: ec848d9ee4548ae102ea2753959373c16fa2489b75b328d2bd7d4cc645ff2cfe
nptl-devel-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 1bc215d4cd7cf8f157fba7699125ff89d515556ed27796a616c032506258b97c
nptl-devel-2.3.4-2.57.el4.2.i686.rpm	SHA-256: 1bc215d4cd7cf8f157fba7699125ff89d515556ed27796a616c032506258b97c
nscd-2.3.4-2.57.el4.2.i386.rpm	SHA-256: a225ed8305366e40b8225333b86ab8a0c6a6701e0c2b1bdc8dce64514ce7944a
nscd-2.3.4-2.57.el4.2.i386.rpm	SHA-256: a225ed8305366e40b8225333b86ab8a0c6a6701e0c2b1bdc8dce64514ce7944a