-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2018-f6b7df660d 2018-11-30 02:48:37.834255 --------------------------------------------------------------------------------

Name : glibc Product : Fedora 29 Version : 2.28 Release : 22.fc29 URL : http://www.gnu.org/software/glibc/ Summary : The GNU libc libraries Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function.

-------------------------------------------------------------------------------- Update Information:

This update for the `glibc` package addresses one moderate security vulnerability and a minor defect: * CVE-2018-19591: A file descriptor leak in `if_nametoindex` can lead to a denial of service due to resource exhaustion when processing `getaddrinfo` calls with crafted host names. Reported by Guido Vranken. (RHBZ#1654000) * Parallel building of locales led to nondeterminism in the RPM build process. (RHBZ#1652228) -------------------------------------------------------------------------------- ChangeLog:

* Wed Nov 28 2018 Florian Weimer fweimer@redhat.com - 2.28-22 - Auto-sync with upstream branch release/2.28/master, commit ce6ba630dbc96f49eb1f30366aa62261df4792f9: - CVE-2018-19591: if_nametoindex: Fix descriptor leak (#1654000) - support: Print timestamps in timeout handler - libio/tst-readline: Increase timeout * Mon Nov 26 2018 Florian Weimer fweimer@redhat.com - 2.28-21 - Do not use parallel make for building locales (#1652228) * Mon Nov 19 2018 Florian Weimer fweimer@redhat.com - 2.28-20 - Auto-sync with upstream branch release/2.28/master, commit f44c2ca5eacd2df76fc38be75f9ebb8f0ff555eb: - Update system call list to Linux 4.19 - time: Fix tzfile low-memory assertion failure (swbz#21716) - Add newlines in __libc_fatal calls (swbz#20271) - nscd: Fix use-after-free in addgetnetgrentX (swbz#23520) - malloc: Additional heap integrity checks - Add an additional test to resolv/tst-resolv-network.c (swbz#17630) * Fri Nov 9 2018 Florian Weimer fweimer@redhat.com - 2.28-19 - Auto-sync with upstream branch release/2.28/master, commit 3e8d8dd5afba18a847ff7a80f473336f777cc329: - Disable CET for binaries created by older link editors (#1648297) * Wed Nov 7 2018 Florian Weimer fweimer@redhat.com - 2.28-18 - Drop patches that were applied to upstream release/2.28/master branch: glibc-rh1614705.patch glibc-rh1615608.patch glibc-error-va_end.patch glibc-nscd-leak.patch glibc-nss_files-leak.patch glibc-rh1622669.patch glibc-1622674-1.patch glibc-1622674-2.patch glibc-rh1631338-1.patch glibc-rh1631338-2.patch glibc-rh1623519.patch glibc-rh1631719.patch glibc-rh1631728.patch glibc-rh1623519-2.patch - Auto-sync with upstream branch release/2.28/master, commit fc0e3393ff775aa795b523083bb0db7f18d3b91e: - RISC-V: Move libc_fesetround_riscv after libc_feholdexcept_riscv - pthread_spawn: Fix potential segfault in maybe_script_execute - preadv2/pwritev2: Fix misreported errno (swbz#23579) - kl_GL: Fix spelling of Sunday, should be "sapaat" (swbz#20209) - i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK (swbz#23716) - pthread_mutex_lock: Fix race while promoting to PTHREAD_MUTEX_ELISION_NP (swbz#23275) - signal: Use correct type for si_band in siginfo_t (swbz#23562) - stdlib/test-bz22786: Avoid spurious test failures using alias mappings - x86: Fix Haswell CPU string flags (swbz#23709) - libanl: Fix crash if first helper thread creation failed (#1646381) * Thu Nov 1 2018 Mike FABIAN mfabian@redhat.com - 2.28-17 - Include Esperanto (eo) in glibc-all-langpacks (#1643756) * Thu Sep 27 2018 Florian Weimer fweimer@redhat.com - 2.28-16 - stdlib/tst-setcontext9 test suite failure on ppc64le (#1623519) * Wed Sep 26 2018 Florian Weimer fweimer@redhat.com - 2.28-15 - Add missing ENDBR32 in start.S (#1631728) * Wed Sep 26 2018 Florian Weimer fweimer@redhat.com - 2.28-14 - Fix bug in generic strstr with large needles (#1631719) * Wed Sep 26 2018 Florian Weimer fweimer@redhat.com - 2.28-13 - stdlib/tst-setcontext9 test suite failure (#1623519) * Wed Sep 26 2018 Florian Weimer fweimer@redhat.com - 2.28-12 - gethostid: Missing NULL check for gethostbyname_r result (#1631338) * Wed Sep 5 2018 Florian Weimer fweimer@redhat.com - 2.28-11 - Add python3-devel build dependency for downstream benefit * Wed Sep 5 2018 Carlos O'Donell carlos@redhat.com - 2.28-10 - Provide compatibility support for linking against libpthread_nonshared.a (#1625507) -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1652228 - glibc: Do not use parallel make for building locales https://bugzilla.redhat.com/show_bug.cgi?id=1652228 [ 2 ] Bug #1654000 - CVE-2018-19591 glibc: file descriptor leak in if_nametoindex() in sysdeps/unix/sysv/linux/if_index.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1654000 --------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-f6b7df660d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------