glibc: patch 2.23 for CVE-2016-3075, CVE-2016-1234, CVE-2016-3706 #15447
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This addresses the following security advisories: + CVE-2016-3075: Stack overflow in _nss_dns_getnetbyname_r + CVE-2016-1234: glob: buffer overflow with GLOB_ALTDIRFUNC due to incorrect NAME_MAX limit assumption + CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion Patches cherry-picked from glibc's release/2.23/master branch. The "glob-simplify-interface.patch" was a dependency for "cve-2016-1234.patch".
|
Would it be possible to fetch these patches instead of checking them into the repo? |
|
It looks like sourceware.org does have urls where the patches can be downloaded, but they don't apply cleanly without first removing the changes to the file ChangeLog. The other option would be to pull in every patch on the release/2.23/master branch. Looking back at the recent nixpkg history of glibc I didn't see a precedent for doing that, last time individual CVE patches were pulled in. That said, maybe pulling everything in is a better approach, I don't have a lot of experience with this. |
vcunat
added a commit
that referenced
this pull request
May 14, 2016
vcunat
added a commit
that referenced
this pull request
May 14, 2016
(cherry picked from commit 45a14c8)
vcunat
added a commit
that referenced
this pull request
May 14, 2016
(cherry picked from commit 45a14c8) I just tested it builds on x86_64-linux.
|
Thank you. In past I tried to find a better way to pull in patches for glibc but I couldn't. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Things done
(nix.useSandbox on NixOS,
or option
build-use-sandboxinnix.confon non-NixOS)
nix-shell -p nox --run "nox-review wip"./result/bin/)This addresses the following security advisories:
NAME_MAX limit assumption
Patches cherry-picked from glibc's release/2.23/master branch.
The "glob-simplify-interface.patch" was a dependency for
"cve-2016-1234.patch".