From 8a0b17e48b83e933960dfeb8fa08b259f03f310e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 14 Dec 2017 15:18:38 +0100 Subject: elf: Compute correct array size in _dl_init_paths [BZ #22606] --- NEWS | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'NEWS') diff --git a/NEWS b/NEWS index abbe561..eef51b6 100644 --- a/NEWS +++ b/NEWS @@ -125,6 +125,11 @@ Security related changes: instead of NULL. This was a regression introduced with the new malloc thread cache in glibc 2.26. Reported by Iain Buclaw. + CVE-2017-1000408: Incorrect array size computation in _dl_init_paths leads + to the allocation of too much memory. (This is not a security bug per se, + it is mentioned here only because of the CVE assignment.) Reported by + Qualys. + The following bugs are resolved with this release: [The release manager will add the list generated by -- cgit v1.1