Bug 8980

Hi,

we are preparing the glibc 2.23 release upstream and have fixed the
following security bugs which, to my best knowledge, lack public CVE
assignment so far:

Passing out of range data to strftime() causes a segfault
https://sourceware.org/bugzilla/show_bug.cgi?id=18985

Out-of-range time values passed to the strftime function may cause it to
crash, leading to a denial of service, or potentially disclosure
information.

LD_POINTER_GUARD is not ignored for privileged binaries
https://sourceware.org/bugzilla/show_bug.cgi?id=18928

LD_POINTER_GUARD was an environment variable which controls
security-related behavior, but was not ignored for privileged binaries
(in AT_SECURE mode).  This might allow local attackers (who can supply
the environment variable) to bypass intended security restrictions.

hcreate((size_t)-1) should fail with ENOMEM
https://sourceware.org/bugzilla/show_bug.cgi?id=18240

This is an integer overflow in hcreate and hcreate_r which can result in
an out-of-bound memory access.  This could lead to application crashes
or, potentially, arbitrary code execution.

nan function unbounded stack allocation
https://sourceware.org/bugzilla/show_bug.cgi?id=16962

A stack overflow (unbounded alloca) can cause applications which process
long strings with the nan function to crash or, potentially, execute
arbitrary code.

catopen() Multiple unbounded stack allocations
https://sourceware.org/bugzilla/show_bug.cgi?id=17905

A stack overflow (unbounded alloca) in the catopen function can cause
applications which pass long strings to the catopen function to crash
or, potentially execute arbitrary code.


Several people have asked for CVE assignment for swbz#18928 on
oss-security already.

Thanks,
Florian