diff options
| author | Peter Korsgaard <peter@korsgaard.com> | 2018-02-06 16:30:32 +0100 |
|---|---|---|
| committer | Thomas Petazzoni <thomas.petazzoni@bootlin.com> | 2018-02-08 23:22:31 +0100 |
| commit | 49a698f14eab7cb87256f35125d16a08f2eaeb5c (patch) | |
| tree | d9bb1690142cd33abae788860f1081596f82e83f /package/glibc/glibc.hash | |
| parent | 6ba44a70df115b643475e0085e6ad52d18eeb3ea (diff) | |
| download | buildroot-49a698f14eab7cb87256f35125d16a08f2eaeb5c.tar.gz buildroot-49a698f14eab7cb87256f35125d16a08f2eaeb5c.zip | |
glibc: security bump to the latest commit on 2.26 branch
Fixes the following security issues according to NEWS:
CVE-2017-1000408: Incorrect array size computation in _dl_init_paths leads
to the allocation of too much memory. (This is not a security bug per se,
it is mentioned here only because of the CVE assignment.) Reported by
Qualys.
CVE-2017-1000409: Buffer overflow in _dl_init_paths due to miscomputation of
the number of search path components. (This is not a security vulnerability
per se because no trust boundary is crossed if the fix for CVE-2017-1000366
has been applied, but it is mentioned here only because of the CVE
assignment.) Reported by Qualys.
CVE-2017-16997: Incorrect handling of RPATH or RUNPATH containing $ORIGIN
for AT_SECURE or SUID binaries could be used to load libraries from the
current directory.
CVE-2018-1000001: Buffer underflow in realpath function when getcwd function
succeeds without returning an absolute path due to unexpected behaviour of
the Linux kernel getcwd syscall. Reported by halfdog.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Diffstat (limited to 'package/glibc/glibc.hash')
| -rw-r--r-- | package/glibc/glibc.hash | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash index f3a6577d2a..3311be665c 100644 --- a/package/glibc/glibc.hash +++ b/package/glibc/glibc.hash @@ -1,4 +1,4 @@ # Locally calculated (fetched from Github) -sha256 0766875391224153502c5542a71b6e46db53b44691078b3130e1a0df41586430 glibc-glibc-2.26-107-g73a92363619e52c458146e903dfb9b1ba823aa40.tar.gz +sha256 d0d44c2c7a46922376c08a1d45ae7bcbf9abd8f05603dd76637c8b74e6693e9e glibc-glibc-2.26-144-gbbabb868cd248763373d0db763bacd84ce27ede8.tar.gz # Locally calculated (fetched from Github) sha256 5aa9adeac09727db0b8a52794186563771e74d70410e9fd86431e339953fd4bb glibc-arc-2017.09-release.tar.gz |
