diff options
| -rw-r--r-- | ChangeLog | 2 | ||||
| -rw-r--r-- | NEWS | 6 |
2 files changed, 8 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index dfacabe5ff..a01b406e42 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,8 @@ 2017-08-16 Andreas Schwab <schwab@suse.de> + [BZ #16750] + CVE-2009-5064 * elf/ldd.bash.in: Never run file directly. 2016-10-14 Carlos Eduardo Seo <cseo@linux.vnet.ibm.com> diff --git a/NEWS b/NEWS index ebebb402e1..d7c016c021 100644 --- a/NEWS +++ b/NEWS @@ -81,6 +81,12 @@ Version 2.22.1 to the allocation of too much memory. (This is not a security bug per se, it is mentioned here only because of the CVE assignment.) Reported by Qualys. + +* CVE-2009-5064: The ldd script would sometimes run the program under + examination directly, without preventing code execution through the + dynamic linker. (The glibc project disputes that this is a security + vulnerability; only trusted binaries must be examined using the ldd + script.) Version 2.22 |