From: Florian Weimer Date: Sun, 22 Oct 2017 07:29:52 +0000 (+0200) Subject: Update NEWS and ChangeLog for CVE-2017-15671 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3b587362bd54a81528b36ff8e13ba9f7c233e995;p=thirdparty%2Fglibc.git Update NEWS and ChangeLog for CVE-2017-15671 (cherry picked from commit 914c9994d27b80bc3b71c483e801a4f04e269ba6) --- diff --git a/ChangeLog b/ChangeLog index f1666c8ed7e..c19862d8299 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ 2017-09-08 Adhemerval Zanella [BZ #1062] + CVE-2017-15671 * posix/Makefile (routines): Add globfree, globfree64, and glob_pattern_p. * posix/flexmember.h: New file. diff --git a/NEWS b/NEWS index 98aa362444d..c353ce6273e 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,11 @@ Security related changes: * The DNS stub resolver limits the advertised UDP buffer size to 1200 bytes, to avoid fragmentation-based spoofing attacks. + CVE-2017-15671: The glob function, when invoked with GLOB_TILDE, + would sometimes fail to free memory allocated during ~ operator + processing, leading to a memory leak and, potentially, to a denial + of service. + The following bugs are resolved with this release: [20257] sunrpc: clntudp_call does not enforce timeout when receiving data