[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 2.22 12/14] Add ChangeLog reference to bug 16750/CVE-2009-5064
From: Florian Weimer <fweimer@redhat.com>
(cherry picked from commit 403143e1df85dadd374f304bd891be0cd7573e3b)
---
ChangeLog | 2 ++
NEWS | 6 ++++++
2 files changed, 8 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 91a9fb9..05ef3fd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -77,6 +77,8 @@
2017-08-16 Andreas Schwab <schwab@suse.de>
+ [BZ #16750]
+ CVE-2009-5064
* elf/ldd.bash.in: Never run file directly.
2016-10-14 Carlos Eduardo Seo <cseo@linux.vnet.ibm.com>
diff --git a/NEWS b/NEWS
index e061583..2d703f2 100644
--- a/NEWS
+++ b/NEWS
@@ -94,6 +94,12 @@ Version 2.22.1
succeeds without returning an absolute path due to unexpected behaviour
of the Linux kernel getcwd syscall. Reported by halfdog.
+* CVE-2009-5064: The ldd script would sometimes run the program under
+ examination directly, without preventing code execution through the
+ dynamic linker. (The glibc project disputes that this is a security
+ vulnerability; only trusted binaries must be examined using the ldd
+ script.)
+
Version 2.22
--
1.8.3.1