[ MDVSA-2014:152 ] glibc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2014:152
http://www.mandriva.com/en/support/security/

Package : glibc
Date : August 6, 2014
Affected: Business Server 1.0

Problem Description:

Updated glibc packages fix security issues:

Stephane Chazelas discovered that directory traversal issue in locale
handling in glibc. glibc accepts relative paths with … components
in the LC_* and LANG variables. Together with typical OpenSSH
configurations (with suitable AcceptEnv settings in sshd_config),
this could conceivably be used to bypass ForceCommand restrictions
(or restricted shells), assuming the attacker has sufficient level
of access to a file system location on the host to create crafted
locale definitions there (CVE-2014-0475).

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where
posix_spawn_file_actions_addopen fails to copy the path argument
(glibc bz #17048) which can, in conjunction with many common memory
management techniques from an application, lead to a use after free,
or other vulnerabilities (CVE-2014-4043).

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043
http://advisories.mageia.org/MGASA-2014-0314.html

Updated Packages:

Mandriva Business Server 1/X86_64:
7e4bd56ba434c72f8c9360e54f3ace30 mbs1/x86_64/glibc-2.14.1-12.7.mbs1.x86_64.rpm
c00abe493846257a224bcd217dbda193 mbs1/x86_64/glibc-devel-2.14.1-12.7.mbs1.x86_64.rpm
3dc3199457ef337c453eb48e757b19d7 mbs1/x86_64/glibc-doc-2.14.1-12.7.mbs1.noarch.rpm
642eec51aea574ccb12fe1212fa50eb6 mbs1/x86_64/glibc-doc-pdf-2.14.1-12.7.mbs1.noarch.rpm
25514e42a9b9ebdde40f5fa059dc5a3c mbs1/x86_64/glibc-i18ndata-2.14.1-12.7.mbs1.x86_64.rpm
3c9cdb0cd83af355302df271ae63f49d mbs1/x86_64/glibc-profile-2.14.1-12.7.mbs1.x86_64.rpm
ac264ef2f31ca27d97bd62afcce34af9 mbs1/x86_64/glibc-static-devel-2.14.1-12.7.mbs1.x86_64.rpm
58f3bcd904422da59ac688292c2d9cdc mbs1/x86_64/glibc-utils-2.14.1-12.7.mbs1.x86_64.rpm
f499b1252ed18408eaa11149da20cc22 mbs1/x86_64/nscd-2.14.1-12.7.mbs1.x86_64.rpm
fc23371516f3983f6c190cbbe9fa475a mbs1/SRPMS/glibc-2.14.1-12.7.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFT4jsumqjQ0CJFipgRAlNQAJ0XRiH3s+wH6V0PIAOhRb/OaQltjgCg4la8
kIl2gBBBEbooSlANUSXW9sY=
=me23
-----END PGP SIGNATURE-----