[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH 2.22 13/14] Record CVE-2018-6485 in ChangeLog and NEWS [BZ #22343]

From: Florian Weimer <fweimer@redhat.com>

(cherry picked from commit 4590634fd65162568b9f52fb4beb60aa25da37f2)
---
 ChangeLog | 1 +
 NEWS      | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 05ef3fd..162c5da 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,7 @@
 2018-01-18  Arjun Shankar  <arjun@redhat.com>
 
 	[BZ #22343]
+	CVE-2018-6485
 	* malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE
 	after padding.
 	(_int_memalign): check for integer overflow before calling
diff --git a/NEWS b/NEWS
index 2d703f2..d151e13 100644
--- a/NEWS
+++ b/NEWS
@@ -100,6 +100,10 @@ Version 2.22.1
   vulnerability; only trusted binaries must be examined using the ldd
   script.)
 
+* CVE-2018-6485: The posix_memalign and memalign functions, when called with
+  an object size near the value of SIZE_MAX, would return a pointer to a
+  buffer which is too small, instead of NULL.  Reported by Jakub Wilk.
+
 
 Version 2.22
 
-- 
1.8.3.1