aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2018-02-06 09:19:03 +0100
committerFlorian Weimer <fweimer@redhat.com>2018-02-06 09:21:00 +0100
commitbdac1623cca4c3d1683e24cc7d093201c5d9fa26 (patch)
treee1dc2a6e881c5841e1332c010db5753bf46473fd
parent23158b08a0908f381459f273a984c6fd328363cb (diff)
downloadglibc-bdac1623cca4c3d1683e24cc7d093201c5d9fa26.zip
glibc-bdac1623cca4c3d1683e24cc7d093201c5d9fa26.tar.gz
glibc-bdac1623cca4c3d1683e24cc7d093201c5d9fa26.tar.bz2
Record CVE-2018-6551 in NEWS and ChangeLog [BZ #22774]
(cherry picked from commit 71aa429b029fdb6f9e65d44050388b51eca460d6)
-rw-r--r--ChangeLog2
-rw-r--r--NEWS4
2 files changed, 6 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index f3fe271..76e2767 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -710,7 +710,9 @@
2018-01-18 Arjun Shankar <arjun@redhat.com>
[BZ #22343]
+ [BZ #22774]
CVE-2018-6485
+ CVE-2018-6551
* malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE
after padding.
(_int_memalign): check for integer overflow before calling
diff --git a/NEWS b/NEWS
index a71c103..0f7b0d5 100644
--- a/NEWS
+++ b/NEWS
@@ -262,6 +262,10 @@ Security related changes:
an object size near the value of SIZE_MAX, would return a pointer to a
buffer which is too small, instead of NULL. Reported by Jakub Wilk.
+ CVE-2018-6551: The malloc function, when called with an object size near
+ the value of SIZE_MAX, would return a pointer to a buffer which is too
+ small, instead of NULL.
+
The following bugs are resolved with this release:
[866] glob: glob should match dangling symlinks