Oval Definition:oval:com.redhat.rhsa:def:20141110
Revision Date:2014-08-29Version:635
Title:RHSA-2014:1110: glibc security update (Important)
Description:The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

  • An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119)

  • A directory traveral flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_
  • environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475)

    Red Hat would like to thank Stephane Chazelas for reporting CVE-2014-0475.

    All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2014-0475
    CVE-2014-0475
    CVE-2014-5119
    CVE-2014-5119
    RHSA-2014:1110
    RHSA-2014:1110-00
    RHSA-2014:1110-01
    Platform(s):Red Hat Enterprise Linux 5
    Red Hat Enterprise Linux 6
    Red Hat Enterprise Linux 7
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 5 is installed
  • AND
  • glibc is earlier than 0:2.5-118.el5_10.3
  • AND glibc is signed with Red Hat redhatrelease2 key
  • glibc-common is earlier than 0:2.5-118.el5_10.3
  • AND glibc-common is signed with Red Hat redhatrelease2 key
  • glibc-devel is earlier than 0:2.5-118.el5_10.3
  • AND glibc-devel is signed with Red Hat redhatrelease2 key
  • glibc-headers is earlier than 0:2.5-118.el5_10.3
  • AND glibc-headers is signed with Red Hat redhatrelease2 key
  • glibc-utils is earlier than 0:2.5-118.el5_10.3
  • AND glibc-utils is signed with Red Hat redhatrelease2 key
  • nscd is earlier than 0:2.5-118.el5_10.3
  • AND nscd is signed with Red Hat redhatrelease2 key
  • OR Package Information
  • Red Hat Enterprise Linux 6 is installed
  • AND
  • glibc is earlier than 0:2.12-1.132.el6_5.4
  • AND glibc is signed with Red Hat redhatrelease2 key
  • glibc-common is earlier than 0:2.12-1.132.el6_5.4
  • AND glibc-common is signed with Red Hat redhatrelease2 key
  • glibc-devel is earlier than 0:2.12-1.132.el6_5.4
  • AND glibc-devel is signed with Red Hat redhatrelease2 key
  • glibc-headers is earlier than 0:2.12-1.132.el6_5.4
  • AND glibc-headers is signed with Red Hat redhatrelease2 key
  • glibc-static is earlier than 0:2.12-1.132.el6_5.4
  • AND glibc-static is signed with Red Hat redhatrelease2 key
  • glibc-utils is earlier than 0:2.12-1.132.el6_5.4
  • AND glibc-utils is signed with Red Hat redhatrelease2 key
  • nscd is earlier than 0:2.12-1.132.el6_5.4
  • AND nscd is signed with Red Hat redhatrelease2 key
  • OR Package Information
  • Red Hat Enterprise Linux 7 is installed
  • AND
  • glibc is earlier than 0:2.17-55.el7_0.1
  • AND glibc is signed with Red Hat redhatrelease2 key
  • glibc-common is earlier than 0:2.17-55.el7_0.1
  • AND glibc-common is signed with Red Hat redhatrelease2 key
  • glibc-devel is earlier than 0:2.17-55.el7_0.1
  • AND glibc-devel is signed with Red Hat redhatrelease2 key
  • glibc-headers is earlier than 0:2.17-55.el7_0.1
  • AND glibc-headers is signed with Red Hat redhatrelease2 key
  • glibc-static is earlier than 0:2.17-55.el7_0.1
  • AND glibc-static is signed with Red Hat redhatrelease2 key
  • glibc-utils is earlier than 0:2.17-55.el7_0.1
  • AND glibc-utils is signed with Red Hat redhatrelease2 key
  • nscd is earlier than 0:2.17-55.el7_0.1
  • AND nscd is signed with Red Hat redhatrelease2 key
  • BACK