[OE-core] [PATCH] glibc: fix CVE-2015-8777 and CVE-2015-8779

[Burton, Ross]

On 3 February 2016 at 06:19, Yuanjie Huang <Yuanjie.Huang at windriver.com>
wrote:

> From: Yuanjie Huang <yuanjie.huang at windriver.com>
>
> According to http://seclists.org/oss-sec/2016/q1/153
>
> CVE-2015-8777
>
> LD_POINTER_GUARD was an environment variable which controls
> security-related behavior, but was not ignored for privileged binaries
> (in AT_SECURE mode).  This might allow local attackers (who can supply
> the environment variable) to bypass intended security restriction.
> Ref: https://sourceware.org/bugzilla/show_bug.cgi?id=18928
>
> CVE-2015-8779
>
> A stack overflow (unbounded alloca) in the catopen function can cause
> applications which pass long strings to the catopen function to crash
> or, potentially execute arbitrary code.
> Ref: https://sourceware.org/bugzilla/show_bug.cgi?id=17905
>

We're trying to annotate patches that fix CVEs now, so can you add eg CVE:
CVE-2015-8777 tag alongside the signed-off-by and upstream-status?

Cheers,
Ross
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openembedded.org/pipermail/openembedded-core/attachments/20160203/0588ada9/attachment-0002.html>