glibc-2.12-1.132.AXS4

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function.

Security issues fixed with this release:

• CVE-2013-0242
Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.

• CVE-2013-1914
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.

• CVE-2013-4332
Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4) memalign, or (5) aligned_alloc functions.

Fixed bugs:

• A defect in the initial release of the getaddrinfo() system call caused AF_INET and AF_INET6 queries to return names queried from the /etc/hosts file as canonical names. This behavior is incorrect but it is the expected behavior. However, a later change in the getaddrinfo() function made AF_INET6 queries return the canonical name correctly but this was unexpected by applications relying on queries from the /etc/hosts file and they could fail to operate properly. This update ensures that AF_INET6 queries resolved from /etc/hosts always return the name as canonical. A proper patch might be issued when a standard is establish. For now, the first entry on the /etc/hosts file should be considered the canonical entry.

• Previously, nscd sometimes failed to return both IPv4 and IPv6 addresses when querying for an address using the AF_UNSPEC address family, even when both IPv4 and IPv6 results existed. This has been fixed.