Buffer Overflow Affecting glibc-minimal-langpack package, versions <2:2.28-164.0.5.ksplice1.el8_5.3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE8-GLIBCMINIMALLANGPACK-2605437
- published 10 Apr 2022
- disclosed 14 Jan 2022
Introduced: 14 Jan 2022
CVE-2022-23218 Open this link in a new tabHow to fix?
Upgrade Oracle:8 glibc-minimal-langpack to version 2:2.28-164.0.5.ksplice1.el8_5.3 or higher.
This issue was patched in ELSA-2022-9234.
NVD Description
Note: Versions mentioned in the description apply only to the upstream glibc-minimal-langpack package and not the glibc-minimal-langpack package as distributed by Oracle.
See How to fix? for Oracle:8 relevant fixed versions and status.
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
References
- https://linux.oracle.com/cve/CVE-2022-23218.html
- https://linux.oracle.com/errata/ELSA-2022-0896.html
- https://linux.oracle.com/errata/ELSA-2022-9234.html
- https://linux.oracle.com/errata/ELSA-2022-9358.html
- https://linux.oracle.com/errata/ELSA-2022-9421.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security.gentoo.org/glsa/202208-24
- https://sourceware.org/bugzilla/show_bug.cgi?id=28768
- https://www.oracle.com/security-alerts/cpujul2022.html