All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peter Korsgaard <peter@korsgaard.com>
To: buildroot@buildroot.org
Cc: Romain Naour <romain.naour@gmail.com>,
	Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Subject: [Buildroot] [PATCH-2024.02.x] package/glibc: security bump to 2.38-81 for post-2.38 security fixes
Date: Sun, 16 Jun 2024 16:20:48 +0200	[thread overview]
Message-ID: <20240616142048.1001850-1-peter@korsgaard.com> (raw)

Fixes the following security issues:

GLIBC-SA-2024-0004:
  ISO-2022-CN-EXT: fix out-of-bound writes when writing escape
  sequence (CVE-2024-2961)

GLIBC-SA-2024-0005:
  nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599)

GLIBC-SA-2024-0006:
  nscd: Null pointer crash after notfound response (CVE-2024-33600)

GLIBC-SA-2024-0007:
  nscd: netgroup cache may terminate daemon on memory allocation
  failure (CVE-2024-33601)

GLIBC-SA-2024-0008:
  nscd: netgroup cache assumes NSS callback uses in-buffer strings
  (CVE-2024-33602)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/glibc/glibc.hash       |  2 +-
 package/glibc/glibc.mk         | 15 ++++++++++++++-
 package/localedef/localedef.mk |  2 +-
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash
index 15ae55b9e6..9f404afeaf 100644
--- a/package/glibc/glibc.hash
+++ b/package/glibc/glibc.hash
@@ -1,5 +1,5 @@
 # Locally calculated (fetched from Github)
-sha256  e38f4284d6909c6b5db7d79c6e450daeaf136a67e547290eec0b063a55eaaa42  glibc-2.38-44-gd37c2b20a4787463d192b32041c3406c2bd91de0.tar.gz
+sha256  f36243d2500f714e1333a93f0d029f92d6b0e2e8e80ccb3936b7b40ceeb36d54  glibc-2.38-81-gc8cb4d2b86ece572793e31a3422ea29e88d77df5.tar.gz
 
 # Hashes for license files
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index d198d6f04c..104c844907 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -7,7 +7,7 @@
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
 # When updating the version, please also update localedef
-GLIBC_VERSION = 2.38-44-gd37c2b20a4787463d192b32041c3406c2bd91de0
+GLIBC_VERSION = 2.38-81-gc8cb4d2b86ece572793e31a3422ea29e88d77df5
 # Upstream doesn't officially provide an https download link.
 # There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
 # sometimes the connection times out. So use an unofficial github mirror.
@@ -52,6 +52,19 @@ GLIBC_IGNORE_CVES += CVE-2023-6779
 # 2.38 and the version we're really using.
 GLIBC_IGNORE_CVES += CVE-2023-6780
 
+# Fixed by glibc-2.38-66-ge1135387deded5d73924f6ca20c72a35dc8e1bda
+GLIBC_IGNORE_CVES += CVE-2024-2961
+
+# Fixed by glibc-2.38-72-g5968aebb86164034b8f8421b4abab2f837a5bdaf
+GLIBC_IGNORE_CVES += CVE-2024-33599
+
+# Fixed by glibc-2.38-73-g541ea5172aa658c4bd5c6c6d6fd13903c3d5bb0a +
+# glibc-2.38-74-g2ae9446c1b7a3064743b4a51c0bbae668ee43e4c
+GLIBC_IGNORE_CVES += CVE-2024-33600
+
+# Fixed by glibc-2.38-75-g71af8ca864345d39b746d5cee84b94b430fad5db
+GLIBC_IGNORE_CVES += CVE-2024-33601 CVE-2024-33602
+
 # All these CVEs are considered as not being security issues by
 # upstream glibc:
 #  https://security-tracker.debian.org/tracker/CVE-2010-4756
diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk
index c017c0e00e..bade28fdcb 100644
--- a/package/localedef/localedef.mk
+++ b/package/localedef/localedef.mk
@@ -7,7 +7,7 @@
 # Use the same VERSION and SITE as target glibc
 # As in glibc.mk, generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
-LOCALEDEF_VERSION = 2.38-44-gd37c2b20a4787463d192b32041c3406c2bd91de0
+LOCALEDEF_VERSION = 2.38-81-gc8cb4d2b86ece572793e31a3422ea29e88d77df5
 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz
 LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION))
 HOST_LOCALEDEF_DL_SUBDIR = glibc
-- 
2.39.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

             reply	other threads:[~2024-06-16 14:21 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-06-16 14:20 Peter Korsgaard [this message]
2024-06-16 20:43 ` [Buildroot] [PATCH-2024.02.x] package/glibc: security bump to 2.38-81 for post-2.38 security fixes Yann E. MORIN
2024-06-17  5:54   ` Peter Korsgaard

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240616142048.1001850-1-peter@korsgaard.com \
    --to=peter@korsgaard.com \
    --cc=buildroot@buildroot.org \
    --cc=romain.naour@gmail.com \
    --cc=thomas.petazzoni@bootlin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.