about summary refs log tree commit diff
path: root/NEWS
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2019-01-21 21:26:03 +0100
committerFlorian Weimer <fweimer@redhat.com>2019-01-21 21:26:03 +0100
commit108bc4049f8ae82710aec26a92ffdb4b439c83fd (patch)
tree8028ac534476871bac578df4435bf0bf7388f672 /NEWS
parent5165de69c0908e28a380cbd4bb054e55ea4abc95 (diff)
downloadglibc-108bc4049f8ae82710aec26a92ffdb4b439c83fd.tar.gz
glibc-108bc4049f8ae82710aec26a92ffdb4b439c83fd.tar.xz
glibc-108bc4049f8ae82710aec26a92ffdb4b439c83fd.zip
CVE-2016-10739: getaddrinfo: Fully parse IPv4 address strings [BZ #20018]
The IPv4 address parser in the getaddrinfo function is changed so that
it does not ignore trailing whitespace and all characters after it.
For backwards compatibility, the getaddrinfo function still recognizes
legacy name syntax, such as 192.000.002.010 interpreted as 192.0.2.8
(octal).

This commit does not change the behavior of inet_addr and inet_aton.
gethostbyname already had additional sanity checks (but is switched
over to the new __inet_aton_exact function for completeness as well).

To avoid sending the problematic query names over DNS, commit
6ca53a2453598804a2559a548a08424fca96434a ("resolv: Do not send queries
for non-host-names in nss_dns [BZ #24112]") is needed.
Diffstat (limited to 'NEWS')
-rw-r--r--NEWS4
1 files changed, 4 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 7b3af113bf..d863d80f3a 100644
--- a/NEWS
+++ b/NEWS
@@ -107,6 +107,10 @@ Security related changes:
   in the assembly string/memory functions would cause a buffer overflow.
   Reported by H.J. Lu.
 
+  CVE-2016-10739: The getaddrinfo function could successfully parse IPv4
+  addresses with arbitrary trailing characters, potentially leading to data
+  or command injection issues in applications.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by