USN-4416-1: GNU C Library vulnerabilities
6 July 2020
Several security issues were fixed in GNU C Library.
Releases
Packages
- glibc - GNU C Library
Details
Florian Weimer discovered that the GNU C Library incorrectly handled
certain memory operations. A remote attacker could use this issue to cause
the GNU C Library to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-12133)
It was discovered that the GNU C Library incorrectly handled certain
SSE2-optimized memmove operations. A remote attacker could use this issue
to cause the GNU C Library to crash, resulting in a denial of service, or
possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-18269)
It was discovered that the GNU C Library incorrectly handled certain
pathname operations. A remote attacker could use this issue to cause the
GNU C Library to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-11236)
It was discovered that the GNU C Library incorrectly handled certain
AVX-512-optimized mempcpy operations. A remote attacker could use this
issue to cause the GNU C Library to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-11237)
It was discovered that the GNU C Library incorrectly handled certain
hostname loookups. A remote attacker could use this issue to cause the GNU
C Library to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19591)
Jakub Wilk discovered that the GNU C Library incorrectly handled certain
memalign functions. A remote attacker could use this issue to cause the GNU
C Library to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-6485)
It was discovered that the GNU C Library incorrectly ignored the
LD_PREFER_MAP_32BIT_EXEC environment variable after security transitions. A
local attacker could use this issue to bypass ASLR restrictions.
(CVE-2019-19126)
It was discovered that the GNU C Library incorrectly handled certain
regular expressions. A remote attacker could possibly use this issue to
cause the GNU C Library to crash, resulting in a denial of service. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9169)
It was discovered that the GNU C Library incorrectly handled certain
bit patterns. A remote attacker could use this issue to cause the GNU C
Library to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-10029)
It was discovered that the GNU C Library incorrectly handled certain
signal trampolines on PowerPC. A remote attacker could use this issue to
cause the GNU C Library to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2020-1751)
It was discovered that the GNU C Library incorrectly handled tilde
expansion. A remote attacker could use this issue to cause the GNU C
Library to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-1752)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.10
Ubuntu 18.04
Ubuntu 16.04
After a standard system update you need to reboot your computer to make
all the necessary changes.
Related notices
- USN-6762-1: libc6-x32, glibc-source, libc6-s390, multiarch-support, libc6-dev-x32, libc6-dev-amd64, libc6-armel, libc6-lse, locales-all, eglibc, libc-dev-bin, libc6-dev-s390, libc6-dev-armel, nscd, libc-bin, libc6-prof, locales, libc6-dev-i386, libc6-i386, libc6, libc6-dev, libc6-amd64, libc6-pic, eglibc-source, glibc, glibc-doc
- USN-4218-1: libc0.1-udeb, libc6-x32, libc0.3, libc6-sparc64v2, libc0.3-pic, libc6.1-alphaev67, libc6-sparc, libc6-dev-s390x, libc6-sparc64b, libc6-dev-ppc64, libc0.3-prof, libc6-dev-powerpc, libc6-dev-sparc64, libc6-s390, libnss-dns-udeb, libc6-ppc64, libc6.1, libc6.1-prof, multiarch-support, libc0.1-i386, libc6-sparc64v, libc6-dev-x32, libc6-dev-amd64, libc0.1-dev, libc6-armel, libc0.3-xen, libc0.1-i686, libc0.3-dev, libc6-dev-sparc, libc6-mips64, eglibc, libc6-s390x, libc-dev-bin, libc6-dev-s390, libc6-i686, libc6-powerpc, libc6-dev-armel, libc6-dev-mipsn32, libc6-xen, libnss-files-udeb, libc6.1-dev, libc6-sparcv9v, libc6-loongson2f, libc6-mipsn32, libc6-dev-armhf, nscd, libc-bin, libc0.1-pic, libc6-armhf, libc6-dev-i386, libc6-prof, libc6-udeb, libc6-i386, libc6, libc0.3-i686, libc6-dev, libc6-amd64, libc6-sparcv9v2, libc6-pic, libc6-sparc64, eglibc-source, libc6.1-pic, libc0.1-prof, libc6.1-udeb, libc0.1, glibc-doc, libc0.3-udeb, libc0.1-dev-i386, libc6-dev-mips64