Skip to content
OpenAdvisories
Medium ELSA-2014-2023 1 CVE

Moderate: glibc security and bug fix update (Oracle Linux 7)

Published Dec 18, 2014 · Updated Dec 18, 2014

Ecosystem: Oracle Linux

Summary

[2.17-55.0.4.el7_0.3]
- Remove strstr and strcasestr implementations using sse4.2 instructions.
- Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and
1818483b15d22016b0eae41d37ee91cc87b37510 backported. (Jose E. Marchesi)

[2.17-55.3]
- Fix wordexp() to honour WRDE_NOCMD (CVE-2014-7817, #1170118)

[2.17-55.2]
- ftell: seek to end only when there are unflushed bytes (#1170187).

[2.17-55.1]
- Remove gconv transliteration loadable modules support (CVE-2014-5119,
- _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 7 glibc 0:2.17-55.0.4.el7_0.3
Oracle Linux · 7 glibc-common 0:2.17-55.0.4.el7_0.3
Oracle Linux · 7 glibc-devel 0:2.17-55.0.4.el7_0.3
Oracle Linux · 7 glibc-headers 0:2.17-55.0.4.el7_0.3
Oracle Linux · 7 glibc-static 0:2.17-55.0.4.el7_0.3
Oracle Linux · 7 glibc-utils 0:2.17-55.0.4.el7_0.3
Oracle Linux · 7 nscd 0:2.17-55.0.4.el7_0.3

Vulnerabilities 1

  • Unscored —
    CVE-2014-7817

    The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-depen…

    glibc eglibc Debian Ubuntu