[PATCH] CVE-2016-3075: Stack overflow in _nss_dns_getnetbyname_r [BZ #19879]

[Florian Weimer]

On 03/29/2016 11:41 PM, Joseph Myers wrote:
> On Tue, 29 Mar 2016, Florian Weimer wrote:
>
>> This is a minor security issue in nss_dns, triggered by a very long name
>> passed to getnetbyname.
>
> As a security issue it should have an entry in the "Security related
> changes" section of NEWS for 2.24.

I expected to wait with this until closer to the 2.24, but I guess there 
is no harm in adding these entries now.

I pushed the following NEWS entry:

* An unnecessary stack copy in _nss_dns_getnetbyname_r was removed.  It
   could result in a stack overflow when getnetbyname was called with an
   overly long name.  (CVE-2016-3075)

Thanks,
Florian