This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Debian fixes 4 vulnerabilities in the GNU C library
Qualys draws attention to 4 vulnerabilities in the glibc (GNU C) library, 3 of which have been assigned CVE identifiers and concern the __vsyslog_internal() function, which is called by the syslog() and vsyslog() functions. The last vulnerability concerns the qsort() function. The vulnerability has so far been fixed only by Debian, in the bookworm release with version 2.36-9+deb12u4. The buster and bullseye releases are not vulnerable.
A local attacker can, using specially crafted inputs for the aforementioned logging functions, cause a heap overflow, which may result in gaining administrator privileges [1].
The vulnerability is present in product:
- >2.36
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2023-6246 at cve.org, NVD
- CWE-1284 at cwe.mitre.org
- CWE-788 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2024.
A local attacker can cause a heap overflow, which may lead to an application crash (DoS) [2][1].
The vulnerability is present in product:
- >2.36
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2023-6780 at cve.org, NVD
- CWE-680 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2024.
A local attacker can cause a heap overflow, which may lead to an application crash (DoS) [3][1].
The vulnerability is present in product:
- >2.36
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2023-6779 at cve.org, NVD
- CWE-788 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2024.
A local attacker can, under certain circumstances, corrupt data in memory [1].
The vulnerability is present in product:
- >2.36
More information:
- CWE-1218 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 1. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 31. 1. 2024.