This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GNU glibc fixes 5 vulnerabilities
GNU fixes 5 vulnerabilities in the glibc product with version 2.40, 4 of which specifically affect nscd (Name Service Cache Daemon) [1]. OS releases and their fixed versions: Debian [2][3]: bullseye - 2.31-13+deb11u10 bookworm - 2.36-9+deb12u7 buster - 2.28-10+deb10u4 Ubuntu [4][5][6][7][8]: bionic - 2.27-3ubuntu1.6+esm2 focal - 2.31-0ubuntu9.15 jammy - 2.35-0ubuntu3.7 mantic - 2.38-1ubuntu6.2 noble - 2.39-0ubuntu8.1 Gentoo [9]: all architectures - 2.38-r13 Redhat: more information at [10] Slackware: more information at [11]
An unauthenticated local attacker is allowed to cause a stack overflow, which may cause data corruption or an application crash [12].
The vulnerability is present in product:
- glibc; >=2.39, <2.40;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
More information:
- CVE-2024-2961 at cve.org, NVD
- CWE-787 at cwe.mitre.org
The vulnerability was publicly disclosed 17. 4. 2024.
An unauthenticated local attacker is allowed to cause a stack overflow in nscd, which may cause data corruption or an application crash [13].
The vulnerability is present in product:
- glibc; >=2.15, <2.40;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-33599 at cve.org, NVD
- CWE-121 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 5. 2024.
An unauthenticated remote attacker is allowed to cause a null pointer dereference in nscd, which may cause an application crash [14].
The vulnerability is present in product:
- glibc; >=2.15, <2.40;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-33600 at cve.org, NVD
- CWE-476 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 5. 2024.
An unauthenticated remote attacker is allowed to cause incorrect memory allocation in nscd, which would cause an application crash [15].
The vulnerability is present in product:
- glibc; >=2.15, <2.40;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-33601 at cve.org, NVD
- CWE-617 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 5. 2024.
An unauthenticated remote attacker is allowed to cause a stack overflow in nscd, which could cause data corruption or an application crash [16].
The vulnerability is present in product:
- glibc; >=2.15, <2.40;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
More information:
- CVE-2024-33602 at cve.org, NVD
- CWE-466 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 5. 2024.
Links
- [1] https://lists.gnu.org/archive/html/info-gnu/2024-07/msg00013.html
- [2] https://security-tracker.debian.org/tracker/DSA-5678-1
- [3] https://security-tracker.debian.org/tracker/DLA-3850-1
- [4] https://ubuntu.com/security/CVE-2024-2961
- [5] https://ubuntu.com/security/CVE-2024-33599
- [6] https://ubuntu.com/security/CVE-2024-33600
- [7] https://ubuntu.com/security/CVE-2024-33601
- [8] https://ubuntu.com/security/CVE-2024-33602
- [9] https://security.gentoo.org/glsa/202405-17
- [10] https://access.redhat.com/errata/RHSA-2024:3344
- [11] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2024&m=slackware-security.564783
- [12] https://nvd.nist.gov/vuln/detail/CVE-2024-2961
- [13] https://nvd.nist.gov/vuln/detail/CVE-2024-33599
- [14] https://nvd.nist.gov/vuln/detail/CVE-2024-33600
- [15] https://nvd.nist.gov/vuln/detail/CVE-2024-33601
- [16] https://nvd.nist.gov/vuln/detail/CVE-2024-33602
By CESNET, z.s.p.o. Martin Krajči on 24. 7. 2024.