Ubuntu Security Notice USN-2432-1
3rd December, 2014
eglibc, glibc vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary
The GNU C Library could be made to crash or run programs.
Software description
- eglibc
– GNU C Library - glibc
– GNU C Library
Details
Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled
certain multibyte characters when using the iconv function. An attacker
could possibly use this issue to cause applications to crash, resulting in
a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu
12.04 LTS. (CVE-2012-6656)
Adhemerval Zanella Netto discovered that the GNU C Library incorrectly
handled certain multibyte characters when using the iconv function. An
attacker could possibly use this issue to cause applications to crash,
resulting in a denial of service. (CVE-2014-6040)
Tim Waugh discovered that the GNU C Library incorrectly enforced the
WRDE_NOCMD flag when handling the wordexp function. An attacker could
possibly use this issue to execute arbitrary commands. (CVE-2014-7817)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
libc6
2.19-10ubuntu2.1
- Ubuntu 14.04 LTS:
-
libc6
2.19-0ubuntu6.4
- Ubuntu 12.04 LTS:
-
libc6
2.15-0ubuntu10.9
- Ubuntu 10.04 LTS:
-
libc6
2.11.1-0ubuntu7.19
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all
the necessary changes.