==========================================================================
Ubuntu Security Notice USN-2432-1
December 03, 2014

eglibc, glibc vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.10
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS
– Ubuntu 10.04 LTS

Summary:

The GNU C Library could be made to crash or run programs.

Software Description:
– glibc: GNU C Library
– eglibc: GNU C Library

Details:

Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled
certain multibyte characters when using the iconv function. An attacker
could possibly use this issue to cause applications to crash, resulting in
a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu
12.04 LTS. (CVE-2012-6656)

Adhemerval Zanella Netto discovered that the GNU C Library incorrectly
handled certain multibyte characters when using the iconv function. An
attacker could possibly use this issue to cause applications to crash,
resulting in a denial of service. (CVE-2014-6040)

Tim Waugh discovered that the GNU C Library incorrectly enforced the
WRDE_NOCMD flag when handling the wordexp function. An attacker could
possibly use this issue to execute arbitrary commands. (CVE-2014-7817)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
libc6 2.19-10ubuntu2.1

Ubuntu 14.04 LTS:
libc6 2.19-0ubuntu6.4

Ubuntu 12.04 LTS:
libc6 2.15-0ubuntu10.9

Ubuntu 10.04 LTS:
libc6 2.11.1-0ubuntu7.19

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2432-1
CVE-2012-6656, CVE-2014-6040, CVE-2014-7817

Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.19-10ubuntu2.1
https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.4
https://launchpad.net/ubuntu/+source/eglibc/2.15-0ubuntu10.9
https://launchpad.net/ubuntu/+source/eglibc/2.11.1-0ubuntu7.19

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJUf19WAAoJEGVp2FWnRL6TEQ0P/A+gky5A6AYGDE+iT2L2EBE3
8DXe1+WLgqFfCx1DHbk5+n7WbeVnsxaT4IY3rMAbw/EGZagE0JyuG+Q/YroN7UTw
htbv5DuY4XG83N6kniSC2LnI6Z/o9ImGn+53pAvdMtid6/hgs5O0udb32uWiZkRu
oTL6NgYw5ae2nLxElSHpaJWtyOriR68Fz7tyCkPiUoK+7De0wLDG+09PUfB8B9Zn
ec062nNO/ERKQljw6D9CQLmfojh+yElmOJevOuIWyd9+G5XV9qfsULk/Gjnpwqun
cIivlXE9HLkOU5Haj7AwG0ZitssjClBCLRJCFCmpT7b9RrLaGNqbBjq5BnkhFSIi
J9yY88Nm+7O88wRtUGV5HFy7B13Dl1wKkV/sz9eIcxpEed+QWxyyGVi3Z/bmf8eI
BZ+iqwXkVZEOBbRYxBwd5gxdrg9K1YNRa/R2ovdKCKJvk2mKjxNEE8hXeIYWxEWy
9vemFHlmW44ed08P8AVpW4BSfa5wQtmpeYuic5qvE09+FlKwQw5DBispnxDRmFWn
BE1LJuFskdzqWOBJdhqmHpaeCHZYAunwiH5rbC7AOThsCz4IHUJP/dwGwgzz+fMs
QM/UyTaRSJg25KmFeJ8Erow6QmljUwVUdlDTgBgql3jyJWyX5+SJgo9nYDMgvpJQ
5I+TDSH+XVuBVbgtZr1N
=IzEu
—–END PGP SIGNATURE—–
—