SB2018011721 - Fedora 27 update for glibc
Published: January 17, 2018 Updated: April 24, 2025
Security Bulletin ID
SB2018011721
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Insecure DLL loading (CVE-ID: CVE-2017-16997)
The vulnerability allows a local attacker to compromise vulnerable system.
The weakness exists in elf/dl-load.c due to insecure .dll loading mechanism when opening files. Alocal attacker can place a file along with specially crafted .dll file on a remote SBM or WebDAV share and execute arbitrary code on the target system with elevated privileges.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Privilege escalation (CVE-ID: CVE-2018-1000001)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The weakness exists in due to a change in the processing of pathnames in the getcwd() command introduced in Linux kernel. A local attacker can use a specially crafted application, trigger buffer underflow in the __realpath() function in 'stdlib/canonicalize.c' and execute arbitrary code with root privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.