——————————————————————————–
Fedora Update Notification
FEDORA-2018-f6b7df660d
2018-11-30 02:48:37.834255
——————————————————————————–

Name : glibc
Product : Fedora 29
Version : 2.28
Release : 22.fc29
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.

——————————————————————————–
Update Information:

This update for the `glibc` package addresses one moderate security
vulnerability and a minor defect: * CVE-2018-19591: A file descriptor leak in
`if_nametoindex` can lead to a denial of service due to resource exhaustion when
processing `getaddrinfo` calls with crafted host names. Reported by Guido
Vranken. (RHBZ#1654000) * Parallel building of locales led to nondeterminism in
the RPM build process. (RHBZ#1652228)
——————————————————————————–
ChangeLog:

* Wed Nov 28 2018 Florian Weimer <fweimer@redhat.com> – 2.28-22
– Auto-sync with upstream branch release/2.28/master,
commit ce6ba630dbc96f49eb1f30366aa62261df4792f9:
– CVE-2018-19591: if_nametoindex: Fix descriptor leak (#1654000)
– support: Print timestamps in timeout handler
– libio/tst-readline: Increase timeout
* Mon Nov 26 2018 Florian Weimer <fweimer@redhat.com> – 2.28-21
– Do not use parallel make for building locales (#1652228)
* Mon Nov 19 2018 Florian Weimer <fweimer@redhat.com> – 2.28-20
– Auto-sync with upstream branch release/2.28/master,
commit f44c2ca5eacd2df76fc38be75f9ebb8f0ff555eb:
– Update system call list to Linux 4.19
– time: Fix tzfile low-memory assertion failure (swbz#21716)
– Add newlines in __libc_fatal calls (swbz#20271)
– nscd: Fix use-after-free in addgetnetgrentX (swbz#23520)
– malloc: Additional heap integrity checks
– Add an additional test to resolv/tst-resolv-network.c (swbz#17630)
* Fri Nov 9 2018 Florian Weimer <fweimer@redhat.com> – 2.28-19
– Auto-sync with upstream branch release/2.28/master,
commit 3e8d8dd5afba18a847ff7a80f473336f777cc329:
– Disable CET for binaries created by older link editors (#1648297)
* Wed Nov 7 2018 Florian Weimer <fweimer@redhat.com> – 2.28-18
– Drop patches that were applied to upstream release/2.28/master branch:
glibc-rh1614705.patch
glibc-rh1615608.patch
glibc-error-va_end.patch
glibc-nscd-leak.patch
glibc-nss_files-leak.patch
glibc-rh1622669.patch
glibc-1622674-1.patch
glibc-1622674-2.patch
glibc-rh1631338-1.patch
glibc-rh1631338-2.patch
glibc-rh1623519.patch
glibc-rh1631719.patch
glibc-rh1631728.patch
glibc-rh1623519-2.patch
– Auto-sync with upstream branch release/2.28/master,
commit fc0e3393ff775aa795b523083bb0db7f18d3b91e:
– RISC-V: Move libc_fesetround_riscv after libc_feholdexcept_riscv
– pthread_spawn: Fix potential segfault in maybe_script_execute
– preadv2/pwritev2: Fix misreported errno (swbz#23579)
– kl_GL: Fix spelling of Sunday, should be “sapaat” (swbz#20209)
– i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK (swbz#23716)
– pthread_mutex_lock: Fix race while promoting to PTHREAD_MUTEX_ELISION_NP
(swbz#23275)
– signal: Use correct type for si_band in siginfo_t (swbz#23562)
– stdlib/test-bz22786: Avoid spurious test failures using alias mappings
– x86: Fix Haswell CPU string flags (swbz#23709)
– libanl: Fix crash if first helper thread creation failed (#1646381)
* Thu Nov 1 2018 Mike FABIAN <mfabian@redhat.com> – 2.28-17
– Include Esperanto (eo) in glibc-all-langpacks (#1643756)
* Thu Sep 27 2018 Florian Weimer <fweimer@redhat.com> – 2.28-16
– stdlib/tst-setcontext9 test suite failure on ppc64le (#1623519)
* Wed Sep 26 2018 Florian Weimer <fweimer@redhat.com> – 2.28-15
– Add missing ENDBR32 in start.S (#1631728)
* Wed Sep 26 2018 Florian Weimer <fweimer@redhat.com> – 2.28-14
– Fix bug in generic strstr with large needles (#1631719)
* Wed Sep 26 2018 Florian Weimer <fweimer@redhat.com> – 2.28-13
– stdlib/tst-setcontext9 test suite failure (#1623519)
* Wed Sep 26 2018 Florian Weimer <fweimer@redhat.com> – 2.28-12
– gethostid: Missing NULL check for gethostbyname_r result (#1631338)
* Wed Sep 5 2018 Florian Weimer <fweimer@redhat.com> – 2.28-11
– Add python3-devel build dependency for downstream benefit
* Wed Sep 5 2018 Carlos O’Donell <carlos@redhat.com> – 2.28-10
– Provide compatibility support for linking against libpthread_nonshared.a
(#1625507)
——————————————————————————–
References:

[ 1 ] Bug #1652228 – glibc: Do not use parallel make for building locales
https://bugzilla.redhat.com/show_bug.cgi?id=1652228
[ 2 ] Bug #1654000 – CVE-2018-19591 glibc: file descriptor leak in if_nametoindex() in sysdeps/unix/sysv/linux/if_index.c [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1654000
——————————————————————————–

This update can be installed with the “dnf” update program. Use
su -c ‘dnf upgrade –advisory FEDORA-2018-f6b7df660d’ at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list — package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org