glibc: add upstream security patches fixing CVE-2017-1000366 (stack clash)
authorPeter Korsgaard <peter@korsgaard.com>
Tue, 27 Jun 2017 06:42:09 +0000 (08:42 +0200)
committerPeter Korsgaard <peter@korsgaard.com>
Wed, 28 Jun 2017 21:28:47 +0000 (23:28 +0200)
commitc87fdfb6059b16c04aea77030816fd120e26d267
treef43a44ed6815fffc0936bad78246077ed26e37a0
parent8398230bc7d81540f2d2e99ad9ab1f83879e4ecd
glibc: add upstream security patches fixing CVE-2017-1000366 (stack clash)

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH
values to manipulate the heap/stack, causing them to alias, potentially
resulting in arbitrary code execution.  Please note that additional
hardening changes have been made to glibc to prevent manipulation of stack
and heap memory but these issues are not directly exploitable, as such they
have not been given a CVE.

https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

Patches are identical to upstream, except that the ChangeLog modifications
have been stripped.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/glibc/0002-CVE-2017-1000366-Ignore-LD_LIBRARY_PATH-for-AT_SECUR.patch [new file with mode: 0644]
package/glibc/0003-ld.so-Reject-overly-long-LD_PRELOAD-path-elements.patch [new file with mode: 0644]
package/glibc/0004-ld.so-Reject-overly-long-LD_AUDIT-path-elements.patch [new file with mode: 0644]