From patchwork Tue Feb 6 08:20:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 25834 Received: (qmail 104024 invoked by alias); 6 Feb 2018 08:20:29 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 103662 invoked by uid 89); 6 Feb 2018 08:20:28 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-25.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_LAZY_DOMAIN_SECURITY, SPF_HELO_PASS, T_RP_MATCHES_RCVD autolearn=ham version=3.3.2 spammy= X-HELO: mx1.redhat.com To: GNU C Library From: Florian Weimer Subject: [PATCH COMMITTED] Record CVE-2018-6551 in NEWS and ChangeLog [BZ #22774] Message-ID: <71de7bc7-a676-9e8f-b9e5-9b65dd85f6da@redhat.com> Date: Tue, 6 Feb 2018 09:20:23 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 commit 71aa429b029fdb6f9e65d44050388b51eca460d6 Author: Florian Weimer Date: Tue Feb 6 09:19:03 2018 +0100 Record CVE-2018-6551 in NEWS and ChangeLog [BZ #22774] diff --git a/ChangeLog b/ChangeLog index ca221a4ebe..e6e29b1e11 100644 --- a/ChangeLog +++ b/ChangeLog @@ -999,7 +999,9 @@ 2018-01-18 Arjun Shankar [BZ #22343] + [BZ #22774] CVE-2018-6485 + CVE-2018-6551 * malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE after padding. (_int_memalign): check for integer overflow before calling diff --git a/NEWS b/NEWS index 06ae43d3f0..3629944946 100644 --- a/NEWS +++ b/NEWS @@ -291,6 +291,10 @@ Security related changes: an object size near the value of SIZE_MAX, would return a pointer to a buffer which is too small, instead of NULL. Reported by Jakub Wilk. + CVE-2018-6551: The malloc function, when called with an object size near + the value of SIZE_MAX, would return a pointer to a buffer which is too + small, instead of NULL. + The following bugs are resolved with this release: [866] glob: glob should match dangling symlinks