Test ID:	1.3.6.1.4.1.25623.1.1.2.2021.1790
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2021-1790)
Summary:	The remote host is missing an update for the Huawei EulerOS 'glibc' package(s) announced via the EulerOS-SA-2021-1790 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'glibc' package(s) announced via the EulerOS-SA-2021-1790 advisory. Vulnerability Insight: GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate 'this is being treated as a non-security bug and no real threat.'(CVE-2019-1010023) Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.(CVE-2016-3706) The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.(CVE-2019-25013) The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.(CVE-2021-3326) The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.(CVE-2020-27618) The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.(CVE-2016-6323) Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.(CVE-2017-12133) Affected Software/OS: 'glibc' package(s) on Huawei EulerOS V2.0SP3. Solution: Please install the updated package(s). CVSS Score: 7.1 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-3706 BugTraq ID: 102073 http://www.securityfocus.com/bid/102073 BugTraq ID: 88440 http://www.securityfocus.com/bid/88440 SuSE Security Announcement: openSUSE-SU-2016:1527 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html SuSE Security Announcement: openSUSE-SU-2016:1779 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html Common Vulnerability Exposure (CVE) ID: CVE-2016-6323 BugTraq ID: 92532 http://www.securityfocus.com/bid/92532 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVWSAZVBTLALXF4SCBPDV3FY6J22DXLZ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTXSOVCRDGBIB4WCIDAGYYUBESXZ4IGK/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WO7IMEYWZ2WTXGGMZBWWSDCUMFN63XOB/ https://security.gentoo.org/glsa/201706-19 http://www.openwall.com/lists/oss-security/2016/08/18/12 SuSE Security Announcement: openSUSE-SU-2016:2443 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-10/msg00009.html Common Vulnerability Exposure (CVE) ID: CVE-2021-3326 https://security.gentoo.org/glsa/202107-07 https://sourceware.org/bugzilla/show_bug.cgi?id=27256 https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888 http://www.openwall.com/lists/oss-security/2021/01/28/2
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.