Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

update: glibc #1621

Closed
dongsupark opened this issue Jan 27, 2025 · 0 comments · Fixed by flatcar/scripts#2614
Closed

update: glibc #1621

dongsupark opened this issue Jan 27, 2025 · 0 comments · Fixed by flatcar/scripts#2614
Labels
advisory security advisory security security concerns

Comments

@dongsupark
Copy link
Member

Name: glibc
CVEs: CVE-2025-0395
CVSSs: n/a
Action Needed: update to >= 2.40-r8

Summary: When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

See also https://seclists.org/oss-sec/2025/q1/48.

refmap.gentoo: https://bugs.gentoo.org/948592
@dongsupark dongsupark added advisory security advisory security security concerns labels Jan 27, 2025
@dongsupark dongsupark moved this from 📝 Needs Triage to 🪵Backlog in Flatcar tactical, release planning, and roadmap Jan 27, 2025
@krnowak krnowak mentioned this issue Jan 27, 2025
Merged
2 tasks
@dongsupark dongsupark moved this from 🪵Backlog to ⚒️ In Progress in Flatcar tactical, release planning, and roadmap Jan 28, 2025
@github-project-automation github-project-automation bot moved this from ⚒️ In Progress to Implemented in Flatcar tactical, release planning, and roadmap Feb 7, 2025
@github-actions github-actions bot mentioned this issue Feb 22, 2025
Open
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
advisory security advisory security security concerns
Projects
Flatcar tactical, release planning, and roadmap
Status: Implemented
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Weekly portage-stable package updates 2025-01-27 flatcar/scripts
1 participant
@dongsupark