From patchwork Fri Jul 31 10:07:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 40196 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id C50153861016; Fri, 31 Jul 2020 10:07:35 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C50153861016 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1596190055; bh=lE8ZE92maTkC434aerMUB+3PDsac6wiHZ3KvPWaovLg=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=QoyBGZtBpO/RAby9pcJTrzLeA5F4HPfTMk654Hi5/wNa+U4NXQqBqn0vD2XUmK5ao 0iz2m2uR7KA9QHXSY+cGCcvQ6d4o3Tr7A4UNiFT5HRhwWoFguRd6vjsc5pYsIiGX/b eMoYLtcJVi56N9r3YdWKyT9DZRcCNjWP47Jqcobc= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) by sourceware.org (Postfix) with ESMTP id B8A213857C4C for ; Fri, 31 Jul 2020 10:07:31 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org B8A213857C4C Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-360-dophySutP7-2S_069MVFqg-1; Fri, 31 Jul 2020 06:07:28 -0400 X-MC-Unique: dophySutP7-2S_069MVFqg-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id BEA3859 for ; Fri, 31 Jul 2020 10:07:27 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-112-250.ams2.redhat.com [10.36.112.250]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 447DD1972A for ; Fri, 31 Jul 2020 10:07:27 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH] Move NEWS entry for CVE-2020-1751 to the 2.31 section Date: Fri, 31 Jul 2020 12:07:25 +0200 Message-ID: <87bljwdmle.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" It was fixed in commit d93769405996dfc11d216ddbe415946617b5a494 ("Fix array overflow in backtrace on PowerPC (bug 25423)"), which went into glibc 2.31. Reviewed-by: Carlos O'Donell --- NEWS | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index 7fb167e650..85f91b3ecb 100644 --- a/NEWS +++ b/NEWS @@ -171,9 +171,6 @@ Security related changes: corruption when they were passed a pseudo-zero argument. Reported by Guido Vranken / ForAllSecure Mayhem. - CVE-2020-1751: A defect in the PowerPC backtrace function could cause an - out-of-bounds write when executed in a signal frame context. - CVE-2020-1752: A use-after-free vulnerability in the glob function when expanding ~user has been fixed. @@ -325,6 +322,9 @@ Changes to build and runtime requirements: Security related changes: + CVE-2020-1751: A defect in the PowerPC backtrace function could cause an + out-of-bounds write when executed in a signal frame context. + CVE-2019-19126: ld.so failed to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping