{"id":"USN-3534-1","summary":"eglibc, glibc vulnerabilities","details":"It was discovered that the GNU C library did not properly handle all of\nthe possible return values from the kernel getcwd(2) syscall. A local\nattacker could potentially exploit this to execute arbitrary code in setuid\nprograms and gain administrative privileges. (CVE-2018-1000001)\n\nA memory leak was discovered in the _dl_init_paths() function in the GNU\nC library dynamic loader. A local attacker could potentially exploit this\nwith a specially crafted value in the LD_HWCAP_MASK environment variable,\nin combination with CVE-2017-1000409 and another vulnerability on a system\nwith hardlink protections disabled, in order to gain administrative\nprivileges. (CVE-2017-1000408)\n\nA heap-based buffer overflow was discovered in the _dl_init_paths()\nfunction in the GNU C library dynamic loader. A local attacker could\npotentially exploit this with a specially crafted value in the\nLD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408\nand another vulnerability on a system with hardlink protections disabled,\nin order to gain administrative privileges. (CVE-2017-1000409)\n\nAn off-by-one error leading to a heap-based buffer overflow was discovered\nin the GNU C library glob() implementation. An attacker could potentially\nexploit this to cause a denial of service or execute arbitrary code via a\nmaliciously crafted pattern. (CVE-2017-15670)\n\nA heap-based buffer overflow was discovered during unescaping of user names\nwith the ~ operator in the GNU C library glob() implementation. An attacker\ncould potentially exploit this to cause a denial of service or execute\narbitrary code via a maliciously crafted pattern. (CVE-2017-15804)\n\nIt was discovered that the GNU C library dynamic loader mishandles RPATH\nand RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE)\nprograms. A local attacker could potentially exploit this by providing a\nspecially crafted library in the current working directory in order to\ngain administrative privileges. (CVE-2017-16997)\n\nIt was discovered that the GNU C library malloc() implementation could\nreturn a memory block that is too small if an attempt is made to allocate\nan object whose size is close to SIZE_MAX, resulting in a heap-based\noverflow. An attacker could potentially exploit this to cause a denial of\nservice or execute arbitrary code. This issue only affected Ubuntu 17.10.\n(CVE-2017-17426)\n","modified":"2026-04-22T09:42:09.265621Z","published":"2018-01-17T12:57:11Z","related":["UBUNTU-CVE-2017-1000408","UBUNTU-CVE-2017-1000409","UBUNTU-CVE-2017-15670","UBUNTU-CVE-2017-15804","UBUNTU-CVE-2017-16997","UBUNTU-CVE-2018-1000001"],"upstream":["CVE-2017-1000408","CVE-2017-1000409","CVE-2017-15670","CVE-2017-15804","CVE-2017-16997","CVE-2017-17426","CVE-2018-1000001","UBUNTU-CVE-2017-1000408","UBUNTU-CVE-2017-1000409","UBUNTU-CVE-2017-15670","UBUNTU-CVE-2017-15804","UBUNTU-CVE-2017-16997","UBUNTU-CVE-2017-17426","UBUNTU-CVE-2018-1000001"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-3534-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-15670"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-15804"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-16997"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-17426"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-1000408"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-1000409"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-1000001"}],"affected":[{"package":{"name":"eglibc","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/eglibc@2.19-0ubuntu6.14?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.14"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"eglibc-source","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc-bin","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc-dev-bin","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6","binary_version":"2.19-0ubuntu6.14"},{"binary_version":"2.19-0ubuntu6.14","binary_name":"libc6-amd64"},{"binary_version":"2.19-0ubuntu6.14","binary_name":"libc6-armel"},{"binary_name":"libc6-dev-amd64","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-dev-armel","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-dev-i386","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-dev-ppc64","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-dev-x32","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-i386","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-pic","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-ppc64","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"libc6-prof","binary_version":"2.19-0ubuntu6.14"},{"binary_version":"2.19-0ubuntu6.14","binary_name":"libc6-x32"},{"binary_name":"multiarch-support","binary_version":"2.19-0ubuntu6.14"},{"binary_name":"nscd","binary_version":"2.19-0ubuntu6.14"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2017-15670","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}],"id":"CVE-2017-15804"},{"id":"CVE-2017-16997","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-1000408","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-1000409","severity":[{"score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2018-1000001","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"high","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:14.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3534-1.json"}},{"package":{"name":"glibc","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/glibc@2.23-0ubuntu10?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-0ubuntu10"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"glibc-source","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc-bin","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc-dev-bin","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-amd64","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-armel","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-dev-amd64","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-dev-armel","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-dev-i386","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-dev-ppc64","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-dev-s390","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-dev-x32","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-i386","binary_version":"2.23-0ubuntu10"},{"binary_version":"2.23-0ubuntu10","binary_name":"libc6-pic"},{"binary_name":"libc6-ppc64","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-s390","binary_version":"2.23-0ubuntu10"},{"binary_name":"libc6-x32","binary_version":"2.23-0ubuntu10"},{"binary_version":"2.23-0ubuntu10","binary_name":"locales"},{"binary_name":"locales-all","binary_version":"2.23-0ubuntu10"},{"binary_name":"multiarch-support","binary_version":"2.23-0ubuntu10"},{"binary_name":"nscd","binary_version":"2.23-0ubuntu10"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2017-15670","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2017-15804","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-16997","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-1000408","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2017-1000409","severity":[{"score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2018-1000001","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"high","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3534-1.json"}}],"schema_version":"1.7.5"}