INFSA-2024:3344: glibc security update
Information about definition
Identificator: INFSA-2024:3344
Type: security
Release date: 2024-08-27 10:15:04 UTC
Information about package
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.
Vulnerabilities description
- CVE-2024-33599
A stack-based buffer overflow flaw was found in the glibc netgroup cache. In certain conditions, its possible to trigger a stack-based buffer overflow condition that can lead to a denial of service and potentially other malicious actions that impact confidentiality and integrity.
- CVE-2024-33600
A flaw was found in the glibc netgroup cache. After a failed cache insertion, addgetnetgrentX tries to send the non-existing response after the not-found header. This can lead to a null pointer dereference that causes a crash or exit.
- CVE-2024-33601
A flaw was found in the glibc netgroup cache. The netgroup cache uses xmalloc/xrealloc and may terminate the process due to a memory allocation failure.
- CVE-2024-33602
A flaw was found in the glibc netgroup cache. The buffer-resizing code in addgetnetgrentX assumes that all string pointers point into the supplied buffer. This can potentially lead to memory corruption and cause a crash.
Severity level
| CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
|---|---|---|---|
|
NIST — CVE-2024-33599
|
no information | 7.6 | no information |
|
NIST — CVE-2024-33600
|
no information | 5.3 | no information |
|
NIST — CVE-2024-33601
|
no information | 4 | no information |
|
NIST — CVE-2024-33602
|
no information | 4 | no information |
Updated packages