QID 198685

Date Published: 2022-03-02

QID 198685: Ubuntu Security Notification for GNU C Library Vulnerabilities (USN-5310-1)

The gnu c libraryiconv feature incorrectly handled certain input sequences.
The gnu c libraryincorrectly handled signed comparisons on armv7 targets.
The gnu c library nscd daemon incorrectly handledcertain netgroup lookups.
The gnu c library wordexp function incorrectlyhandled certain patterns.
The gnu c library realpath function incorrectlyhandled return values.
The gnu c library getcwd function incorrectlyhandled buffers.
The gnu c library sunrpc module incorrectly handledbuffer lengths.

An attackercould possibly use this issue to cause the gnu c library to hang or crash,resulting in a denial of service.
A remote attackercould use this issue to cause the gnu c library to crash, resulting in adenial of service, or possibly execute arbitrary code.
An attacker could possibly use this issue tocause the gnu c library to crash, resulting in a denial of service.
An attacker could use this issue to cause thegnu c library to crash, resulting in a denial of service, or possiblyobtain sensitive information.
An attacker could possibly use this issue to obtainsensitive information.
An attacker could use this issue to cause the gnu clibrary to crash, resulting in a denial of service, or possibly executearbitrary code.
An attacker could possibly use this issue to cause the gnuc library to crash, resulting in a denial of service.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Refer to Ubuntu security advisory USN-5310-1 for updates and patch information.

Vendor References

USN-5310-1 - ubuntu.com/security/notices/USN-5310-1

CVEs related to QID 198685

CVE-2022-23218 | CVE-2022-23219 | CVE-2021-3998 | CVE-2016-10228 | CVE-2021-3326 | CVE-2020-6096 | CVE-2020-29562 | CVE-2020-27618 | CVE-2021-3999 | CVE-2021-27645 | CVE-2021-35942 | CVE-2019-25013 |

Software Advisories

Advisory ID	Software	Component	Link
USN-5310-1	Ubuntu Linux		ubuntu.com/security/notices/USN-5310-1

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].