Moderate: glibc security update
Summary
ALSA-2022:0896: Moderate: glibc security update. Affects compat-libpthread-nonshared versions < 2.28-164.el8_5.3. Fixed in 2.28-164.el8_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. These libraries are essential for the correct functioning of a Linux system.
Vulnerability Detail
This vulnerability includes the following security issues:
- Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)
- Stack-based buffer overflow in svcunix_create via long pathnames (CVE-2022-23218)
- Stack-based buffer overflow in sunrpc clnt_create via a long pathname (CVE-2022-23219)
These vulnerabilities could potentially be exploited by attackers to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
2.28-164.el8_5.3
This is the first release that contains the fix.
sudo dnf update compat-libpthread-nonsharedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for these vulnerabilities.
Conclusion
It is recommended to update the glibc packages to the latest version to mitigate the security vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for compat-libpthread-nonshared →
FAQ
glibc is the GNU C Library, which provides essential C libraries for Linux systems.
These vulnerabilities could allow attackers to execute arbitrary code or cause a denial of service.
The affected versions are prior to 2.28-164.el8_5.3.
You can check the version of glibc by running the command 'ldd --version' in the terminal.
There are no known exploits for these vulnerabilities at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for compat-libpthread-nonshared.
