Bug 22375 - glibc new security issues CVE-2017-16997 and CVE-2018-1000001
Summary: glibc new security issues CVE-2017-16997 and CVE-2018-1000001
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-64-OK MGA6-32-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 22433
  Show dependency tree / graph
 
Reported: 2018-01-12 03:41 CET by David Walser
Modified: 2018-01-25 13:48 CET (History)
8 users (show)

See Also:
Source RPM: glibc-2.22-25.mga6.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2018-01-12 03:41:13 CET 
A security issue in glibc has been announced today (January 11):
http://openwall.com/lists/oss-security/2018/01/11/5

There's a suggested (mostly untested) patch, but it sounds like this issue was only reported upstream recently, so probably no patch has been committed there yet.

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-01-12 03:41:22 CET

Whiteboard: (none) => MGA6TOO

Comment 1 David Walser 2018-01-14 23:59:33 CET 
SUSE has issued an advisory for this on January 12:
https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00037.html

It also fixes CVE-2017-16997, which affects us.

RedHat noted that Fedora has a patch that makes them not vulnerable to that one:
https://bugzilla.redhat.com/show_bug.cgi?id=1526865

Severity: normal => major
Summary: glibc new security issue CVE-2018-1000001 => glibc new security issues CVE-2017-16997 and CVE-2018-1000001

Comment 2 David Walser 2018-01-16 12:13:59 CET 
openSUSE has issued an advisory for this on January 15:
https://lists.opensuse.org/opensuse-updates/2018-01/msg00033.html
Comment 3 David Walser 2018-01-17 17:52:26 CET 
Ubuntu has issued an advisory for this today (January 17):
https://usn.ubuntu.com/usn/usn-3534-1/

Note that you'll have to add that additional patch for CVE-2017-17426 if you upgrade to 2.26 in Cauldron.
Comment 4 Thomas Backlund 2018-01-21 01:21:32 CET 
both CVEs fixed, and added locales support for C.UTF8


SRPMS:
glibc-2.22-27.mga6.src.rpm
locales-2.22-7.mga6.src.rpm



i586:
glibc-2.22-27.mga6.i586.rpm
glibc-devel-2.22-27.mga6.i586.rpm
glibc-doc-2.22-27.mga6.noarch.rpm
glibc-i18ndata-2.22-27.mga6.i586.rpm
glibc-profile-2.22-27.mga6.i586.rpm
glibc-static-devel-2.22-27.mga6.i586.rpm
glibc-utils-2.22-27.mga6.i586.rpm
nscd-2.22-27.mga6.i586.rpm

locales-2.22-7.mga6.i586.rpm
locales-aa-2.22-7.mga6.i586.rpm
locales-af-2.22-7.mga6.i586.rpm
locales-ak-2.22-7.mga6.i586.rpm
locales-am-2.22-7.mga6.i586.rpm
locales-anp-2.22-7.mga6.i586.rpm
locales-ar-2.22-7.mga6.i586.rpm
locales-as-2.22-7.mga6.i586.rpm
locales-ast-2.22-7.mga6.i586.rpm
locales-ayc-2.22-7.mga6.i586.rpm
locales-az-2.22-7.mga6.i586.rpm
locales-be-2.22-7.mga6.i586.rpm
locales-bem-2.22-7.mga6.i586.rpm
locales-ber-2.22-7.mga6.i586.rpm
locales-bg-2.22-7.mga6.i586.rpm
locales-bhb-2.22-7.mga6.i586.rpm
locales-bho-2.22-7.mga6.i586.rpm
locales-bn-2.22-7.mga6.i586.rpm
locales-bo-2.22-7.mga6.i586.rpm
locales-br-2.22-7.mga6.i586.rpm
locales-brx-2.22-7.mga6.i586.rpm
locales-bs-2.22-7.mga6.i586.rpm
locales-ca-2.22-7.mga6.i586.rpm
locales-ce-2.22-7.mga6.i586.rpm
locales-crh-2.22-7.mga6.i586.rpm
locales-cs-2.22-7.mga6.i586.rpm
locales-csb-2.22-7.mga6.i586.rpm
locales-cv-2.22-7.mga6.i586.rpm
locales-cy-2.22-7.mga6.i586.rpm
locales-da-2.22-7.mga6.i586.rpm
locales-de-2.22-7.mga6.i586.rpm
locales-doi-2.22-7.mga6.i586.rpm
locales-dv-2.22-7.mga6.i586.rpm
locales-dz-2.22-7.mga6.i586.rpm
locales-el-2.22-7.mga6.i586.rpm
locales-en-2.22-7.mga6.i586.rpm
locales-eo-2.22-7.mga6.i586.rpm
locales-es-2.22-7.mga6.i586.rpm
locales-et-2.22-7.mga6.i586.rpm
locales-eu-2.22-7.mga6.i586.rpm
locales-fa-2.22-7.mga6.i586.rpm
locales-ff-2.22-7.mga6.i586.rpm
locales-fi-2.22-7.mga6.i586.rpm
locales-fo-2.22-7.mga6.i586.rpm
locales-fr-2.22-7.mga6.i586.rpm
locales-fur-2.22-7.mga6.i586.rpm
locales-fy-2.22-7.mga6.i586.rpm
locales-ga-2.22-7.mga6.i586.rpm
locales-gd-2.22-7.mga6.i586.rpm
locales-gl-2.22-7.mga6.i586.rpm
locales-gu-2.22-7.mga6.i586.rpm
locales-gv-2.22-7.mga6.i586.rpm
locales-ha-2.22-7.mga6.i586.rpm
locales-he-2.22-7.mga6.i586.rpm
locales-hi-2.22-7.mga6.i586.rpm
locales-hne-2.22-7.mga6.i586.rpm
locales-hr-2.22-7.mga6.i586.rpm
locales-hsb-2.22-7.mga6.i586.rpm
locales-ht-2.22-7.mga6.i586.rpm
locales-hu-2.22-7.mga6.i586.rpm
locales-hy-2.22-7.mga6.i586.rpm
locales-ia-2.22-7.mga6.i586.rpm
locales-id-2.22-7.mga6.i586.rpm
locales-ig-2.22-7.mga6.i586.rpm
locales-ik-2.22-7.mga6.i586.rpm
locales-is-2.22-7.mga6.i586.rpm
locales-it-2.22-7.mga6.i586.rpm
locales-iu-2.22-7.mga6.i586.rpm
locales-ja-2.22-7.mga6.i586.rpm
locales-ka-2.22-7.mga6.i586.rpm
locales-kk-2.22-7.mga6.i586.rpm
locales-kl-2.22-7.mga6.i586.rpm
locales-km-2.22-7.mga6.i586.rpm
locales-kn-2.22-7.mga6.i586.rpm
locales-ko-2.22-7.mga6.i586.rpm
locales-kok-2.22-7.mga6.i586.rpm
locales-ks-2.22-7.mga6.i586.rpm
locales-ku-2.22-7.mga6.i586.rpm
locales-kw-2.22-7.mga6.i586.rpm
locales-ky-2.22-7.mga6.i586.rpm
locales-lb-2.22-7.mga6.i586.rpm
locales-lg-2.22-7.mga6.i586.rpm
locales-li-2.22-7.mga6.i586.rpm
locales-lij-2.22-7.mga6.i586.rpm
locales-lo-2.22-7.mga6.i586.rpm
locales-lt-2.22-7.mga6.i586.rpm
locales-lv-2.22-7.mga6.i586.rpm
locales-mag-2.22-7.mga6.i586.rpm
locales-mai-2.22-7.mga6.i586.rpm
locales-mg-2.22-7.mga6.i586.rpm
locales-mhr-2.22-7.mga6.i586.rpm
locales-mi-2.22-7.mga6.i586.rpm
locales-mk-2.22-7.mga6.i586.rpm
locales-ml-2.22-7.mga6.i586.rpm
locales-mn-2.22-7.mga6.i586.rpm
locales-mni-2.22-7.mga6.i586.rpm
locales-mr-2.22-7.mga6.i586.rpm
locales-ms-2.22-7.mga6.i586.rpm
locales-mt-2.22-7.mga6.i586.rpm
locales-my-2.22-7.mga6.i586.rpm
locales-nds-2.22-7.mga6.i586.rpm
locales-ne-2.22-7.mga6.i586.rpm
locales-nhn-2.22-7.mga6.i586.rpm
locales-niu-2.22-7.mga6.i586.rpm
locales-nl-2.22-7.mga6.i586.rpm
locales-no-2.22-7.mga6.i586.rpm
locales-nr-2.22-7.mga6.i586.rpm
locales-nso-2.22-7.mga6.i586.rpm
locales-oc-2.22-7.mga6.i586.rpm
locales-or-2.22-7.mga6.i586.rpm
locales-os-2.22-7.mga6.i586.rpm
locales-pa-2.22-7.mga6.i586.rpm
locales-pap-2.22-7.mga6.i586.rpm
locales-pl-2.22-7.mga6.i586.rpm
locales-ps-2.22-7.mga6.i586.rpm
locales-pt-2.22-7.mga6.i586.rpm
locales-quz-2.22-7.mga6.i586.rpm
locales-raj-2.22-7.mga6.i586.rpm
locales-ro-2.22-7.mga6.i586.rpm
locales-ru-2.22-7.mga6.i586.rpm
locales-rw-2.22-7.mga6.i586.rpm
locales-sa-2.22-7.mga6.i586.rpm
locales-sat-2.22-7.mga6.i586.rpm
locales-sc-2.22-7.mga6.i586.rpm
locales-sd-2.22-7.mga6.i586.rpm
locales-se-2.22-7.mga6.i586.rpm
locales-shs-2.22-7.mga6.i586.rpm
locales-si-2.22-7.mga6.i586.rpm
locales-sk-2.22-7.mga6.i586.rpm
locales-sl-2.22-7.mga6.i586.rpm
locales-so-2.22-7.mga6.i586.rpm
locales-sq-2.22-7.mga6.i586.rpm
locales-sr-2.22-7.mga6.i586.rpm
locales-ss-2.22-7.mga6.i586.rpm
locales-st-2.22-7.mga6.i586.rpm
locales-sv-2.22-7.mga6.i586.rpm
locales-sw-2.22-7.mga6.i586.rpm
locales-szl-2.22-7.mga6.i586.rpm
locales-ta-2.22-7.mga6.i586.rpm
locales-tcy-2.22-7.mga6.i586.rpm
locales-te-2.22-7.mga6.i586.rpm
locales-tg-2.22-7.mga6.i586.rpm
locales-th-2.22-7.mga6.i586.rpm
locales-the-2.22-7.mga6.i586.rpm
locales-tk-2.22-7.mga6.i586.rpm
locales-tl-2.22-7.mga6.i586.rpm
locales-tn-2.22-7.mga6.i586.rpm
locales-tr-2.22-7.mga6.i586.rpm
locales-ts-2.22-7.mga6.i586.rpm
locales-tt-2.22-7.mga6.i586.rpm
locales-ug-2.22-7.mga6.i586.rpm
locales-uk-2.22-7.mga6.i586.rpm
locales-unm-2.22-7.mga6.i586.rpm
locales-ur-2.22-7.mga6.i586.rpm
locales-uz-2.22-7.mga6.i586.rpm
locales-ve-2.22-7.mga6.i586.rpm
locales-vi-2.22-7.mga6.i586.rpm
locales-wa-2.22-7.mga6.i586.rpm
locales-wae-2.22-7.mga6.i586.rpm
locales-wo-2.22-7.mga6.i586.rpm
locales-xh-2.22-7.mga6.i586.rpm
locales-yi-2.22-7.mga6.i586.rpm
locales-yo-2.22-7.mga6.i586.rpm
locales-yue-2.22-7.mga6.i586.rpm
locales-zh-2.22-7.mga6.i586.rpm
locales-zu-2.22-7.mga6.i586.rpm



x86_64:
glibc-2.22-27.mga6.x86_64.rpm
glibc-devel-2.22-27.mga6.x86_64.rpm
glibc-doc-2.22-27.mga6.noarch.rpm
glibc-i18ndata-2.22-27.mga6.x86_64.rpm
glibc-profile-2.22-27.mga6.x86_64.rpm
glibc-static-devel-2.22-27.mga6.x86_64.rpm
glibc-utils-2.22-27.mga6.x86_64.rpm
nscd-2.22-27.mga6.x86_64.rpm

locales-2.22-7.mga6.x86_64.rpm
locales-aa-2.22-7.mga6.x86_64.rpm
locales-af-2.22-7.mga6.x86_64.rpm
locales-ak-2.22-7.mga6.x86_64.rpm
locales-am-2.22-7.mga6.x86_64.rpm
locales-anp-2.22-7.mga6.x86_64.rpm
locales-ar-2.22-7.mga6.x86_64.rpm
locales-as-2.22-7.mga6.x86_64.rpm
locales-ast-2.22-7.mga6.x86_64.rpm
locales-ayc-2.22-7.mga6.x86_64.rpm
locales-az-2.22-7.mga6.x86_64.rpm
locales-be-2.22-7.mga6.x86_64.rpm
locales-bem-2.22-7.mga6.x86_64.rpm
locales-ber-2.22-7.mga6.x86_64.rpm
locales-bg-2.22-7.mga6.x86_64.rpm
locales-bhb-2.22-7.mga6.x86_64.rpm
locales-bho-2.22-7.mga6.x86_64.rpm
locales-bn-2.22-7.mga6.x86_64.rpm
locales-bo-2.22-7.mga6.x86_64.rpm
locales-br-2.22-7.mga6.x86_64.rpm
locales-brx-2.22-7.mga6.x86_64.rpm
locales-bs-2.22-7.mga6.x86_64.rpm
locales-ca-2.22-7.mga6.x86_64.rpm
locales-ce-2.22-7.mga6.x86_64.rpm
locales-crh-2.22-7.mga6.x86_64.rpm
locales-cs-2.22-7.mga6.x86_64.rpm
locales-csb-2.22-7.mga6.x86_64.rpm
locales-cv-2.22-7.mga6.x86_64.rpm
locales-cy-2.22-7.mga6.x86_64.rpm
locales-da-2.22-7.mga6.x86_64.rpm
locales-de-2.22-7.mga6.x86_64.rpm
locales-doi-2.22-7.mga6.x86_64.rpm
locales-dv-2.22-7.mga6.x86_64.rpm
locales-dz-2.22-7.mga6.x86_64.rpm
locales-el-2.22-7.mga6.x86_64.rpm
locales-en-2.22-7.mga6.x86_64.rpm
locales-eo-2.22-7.mga6.x86_64.rpm
locales-es-2.22-7.mga6.x86_64.rpm
locales-et-2.22-7.mga6.x86_64.rpm
locales-eu-2.22-7.mga6.x86_64.rpm
locales-fa-2.22-7.mga6.x86_64.rpm
locales-ff-2.22-7.mga6.x86_64.rpm
locales-fi-2.22-7.mga6.x86_64.rpm
locales-fo-2.22-7.mga6.x86_64.rpm
locales-fr-2.22-7.mga6.x86_64.rpm
locales-fur-2.22-7.mga6.x86_64.rpm
locales-fy-2.22-7.mga6.x86_64.rpm
locales-ga-2.22-7.mga6.x86_64.rpm
locales-gd-2.22-7.mga6.x86_64.rpm
locales-gl-2.22-7.mga6.x86_64.rpm
locales-gu-2.22-7.mga6.x86_64.rpm
locales-gv-2.22-7.mga6.x86_64.rpm
locales-ha-2.22-7.mga6.x86_64.rpm
locales-he-2.22-7.mga6.x86_64.rpm
locales-hi-2.22-7.mga6.x86_64.rpm
locales-hne-2.22-7.mga6.x86_64.rpm
locales-hr-2.22-7.mga6.x86_64.rpm
locales-hsb-2.22-7.mga6.x86_64.rpm
locales-ht-2.22-7.mga6.x86_64.rpm
locales-hu-2.22-7.mga6.x86_64.rpm
locales-hy-2.22-7.mga6.x86_64.rpm
locales-ia-2.22-7.mga6.x86_64.rpm
locales-id-2.22-7.mga6.x86_64.rpm
locales-ig-2.22-7.mga6.x86_64.rpm
locales-ik-2.22-7.mga6.x86_64.rpm
locales-is-2.22-7.mga6.x86_64.rpm
locales-it-2.22-7.mga6.x86_64.rpm
locales-iu-2.22-7.mga6.x86_64.rpm
locales-ja-2.22-7.mga6.x86_64.rpm
locales-ka-2.22-7.mga6.x86_64.rpm
locales-kk-2.22-7.mga6.x86_64.rpm
locales-kl-2.22-7.mga6.x86_64.rpm
locales-km-2.22-7.mga6.x86_64.rpm
locales-kn-2.22-7.mga6.x86_64.rpm
locales-ko-2.22-7.mga6.x86_64.rpm
locales-kok-2.22-7.mga6.x86_64.rpm
locales-ks-2.22-7.mga6.x86_64.rpm
locales-ku-2.22-7.mga6.x86_64.rpm
locales-kw-2.22-7.mga6.x86_64.rpm
locales-ky-2.22-7.mga6.x86_64.rpm
locales-lb-2.22-7.mga6.x86_64.rpm
locales-lg-2.22-7.mga6.x86_64.rpm
locales-li-2.22-7.mga6.x86_64.rpm
locales-lij-2.22-7.mga6.x86_64.rpm
locales-lo-2.22-7.mga6.x86_64.rpm
locales-lt-2.22-7.mga6.x86_64.rpm
locales-lv-2.22-7.mga6.x86_64.rpm
locales-mag-2.22-7.mga6.x86_64.rpm
locales-mai-2.22-7.mga6.x86_64.rpm
locales-mg-2.22-7.mga6.x86_64.rpm
locales-mhr-2.22-7.mga6.x86_64.rpm
locales-mi-2.22-7.mga6.x86_64.rpm
locales-mk-2.22-7.mga6.x86_64.rpm
locales-ml-2.22-7.mga6.x86_64.rpm
locales-mn-2.22-7.mga6.x86_64.rpm
locales-mni-2.22-7.mga6.x86_64.rpm
locales-mr-2.22-7.mga6.x86_64.rpm
locales-ms-2.22-7.mga6.x86_64.rpm
locales-mt-2.22-7.mga6.x86_64.rpm
locales-my-2.22-7.mga6.x86_64.rpm
locales-nds-2.22-7.mga6.x86_64.rpm
locales-ne-2.22-7.mga6.x86_64.rpm
locales-nhn-2.22-7.mga6.x86_64.rpm
locales-niu-2.22-7.mga6.x86_64.rpm
locales-nl-2.22-7.mga6.x86_64.rpm
locales-no-2.22-7.mga6.x86_64.rpm
locales-nr-2.22-7.mga6.x86_64.rpm
locales-nso-2.22-7.mga6.x86_64.rpm
locales-oc-2.22-7.mga6.x86_64.rpm
locales-or-2.22-7.mga6.x86_64.rpm
locales-os-2.22-7.mga6.x86_64.rpm
locales-pa-2.22-7.mga6.x86_64.rpm
locales-pap-2.22-7.mga6.x86_64.rpm
locales-pl-2.22-7.mga6.x86_64.rpm
locales-ps-2.22-7.mga6.x86_64.rpm
locales-pt-2.22-7.mga6.x86_64.rpm
locales-quz-2.22-7.mga6.x86_64.rpm
locales-raj-2.22-7.mga6.x86_64.rpm
locales-ro-2.22-7.mga6.x86_64.rpm
locales-ru-2.22-7.mga6.x86_64.rpm
locales-rw-2.22-7.mga6.x86_64.rpm
locales-sa-2.22-7.mga6.x86_64.rpm
locales-sat-2.22-7.mga6.x86_64.rpm
locales-sc-2.22-7.mga6.x86_64.rpm
locales-sd-2.22-7.mga6.x86_64.rpm
locales-se-2.22-7.mga6.x86_64.rpm
locales-shs-2.22-7.mga6.x86_64.rpm
locales-si-2.22-7.mga6.x86_64.rpm
locales-sk-2.22-7.mga6.x86_64.rpm
locales-sl-2.22-7.mga6.x86_64.rpm
locales-so-2.22-7.mga6.x86_64.rpm
locales-sq-2.22-7.mga6.x86_64.rpm
locales-sr-2.22-7.mga6.x86_64.rpm
locales-ss-2.22-7.mga6.x86_64.rpm
locales-st-2.22-7.mga6.x86_64.rpm
locales-sv-2.22-7.mga6.x86_64.rpm
locales-sw-2.22-7.mga6.x86_64.rpm
locales-szl-2.22-7.mga6.x86_64.rpm
locales-ta-2.22-7.mga6.x86_64.rpm
locales-tcy-2.22-7.mga6.x86_64.rpm
locales-te-2.22-7.mga6.x86_64.rpm
locales-tg-2.22-7.mga6.x86_64.rpm
locales-th-2.22-7.mga6.x86_64.rpm
locales-the-2.22-7.mga6.x86_64.rpm
locales-tk-2.22-7.mga6.x86_64.rpm
locales-tl-2.22-7.mga6.x86_64.rpm
locales-tn-2.22-7.mga6.x86_64.rpm
locales-tr-2.22-7.mga6.x86_64.rpm
locales-ts-2.22-7.mga6.x86_64.rpm
locales-tt-2.22-7.mga6.x86_64.rpm
locales-ug-2.22-7.mga6.x86_64.rpm
locales-uk-2.22-7.mga6.x86_64.rpm
locales-unm-2.22-7.mga6.x86_64.rpm
locales-ur-2.22-7.mga6.x86_64.rpm
locales-uz-2.22-7.mga6.x86_64.rpm
locales-ve-2.22-7.mga6.x86_64.rpm
locales-vi-2.22-7.mga6.x86_64.rpm
locales-wa-2.22-7.mga6.x86_64.rpm
locales-wae-2.22-7.mga6.x86_64.rpm
locales-wo-2.22-7.mga6.x86_64.rpm
locales-xh-2.22-7.mga6.x86_64.rpm
locales-yi-2.22-7.mga6.x86_64.rpm
locales-yo-2.22-7.mga6.x86_64.rpm
locales-yue-2.22-7.mga6.x86_64.rpm
locales-zh-2.22-7.mga6.x86_64.rpm
locales-zu-2.22-7.mga6.x86_64.rpm

Whiteboard: MGA6TOO => (none)
CC: (none) => tmb
Version: Cauldron => 6
Assignee: tmb => qa-bugs

David Walser 2018-01-21 02:00:54 CET

Blocks: (none) => 22433

Comment 5 David Walser 2018-01-21 15:04:48 CET 
Advisory:
========================

Updated glibc packages fix security vulnerabilities:

An issue in the code handling RPATHs was fixed that could have been
exploited by an attacker to execute code loaded from arbitrary
libraries (CVE-2017-16997).

A privilege escalation bug in the realpath() function when the getcwd()
system call doesn't return a valid absolute pathname (CVE-2018-1000001).

Also, support for the C.UTF-8 locale has been added in the locales package.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16997
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10000001
https://lists.opensuse.org/opensuse-updates/2018-01/msg00033.html
Comment 6 Thomas Backlund 2018-01-21 20:41:49 CET 
advisory added to svn

Keywords: (none) => advisory

Comment 7 Thomas Backlund 2018-01-22 16:57:28 CET 
Note that theese packages are in cauldron too, so it's already being tested by every cauldron user...
Comment 8 Len Lawrence 2018-01-22 18:26:54 CET 
Mageia 6 :: x86_64

Cannot find anything useful as a POC except this one, for CVE-2017-16997.
# ln -snf /dev/null libc.so.6 && rm -rf d && mkdir -m0700 d && cd d && echo 'int main(){}' |gcc -xc - -Wl,-rpath,'$ORIGIN' && chgrp -h apache a.out && chmod 02710 a.out && cd .. && d/a.out
d/a.out: error while loading shared libraries: libc.so.6: file too short
# ll d
total 12
-rwx--s--- 1 root apache 12288 Jan 22 15:56 a.out*

There are about six more CVEs which treat various issues, four of which Suse considers low severity.

Clean update of all packages, including locales-en.
Rebooted.

# ln -snf /dev/null libc.so.6 && rm -rf d && mkdir -m0700 d && cd d && echo 'int main(){}' |gcc -xc - -Wl,-rpath,'$ORIGIN' && chgrp -h apache a.out && chmod 02710 a.out && cd .. && d/a.out
# ll d
-rwx--s--- 1 root apache 12288 Jan 22 16:28 a.out*

Regarding this as a good outcome for the POC test on CVE-2017-16997.

Ran a minor utility test based on the example in the man page for memusage.
Cut and pasted the example into memorex.c and compiled it with gcc then ran it under memusage to compile memory use statistics.
$ memusage --data=memusage.dat ./memorex
malloc: 400
realloc: 440
.......................................
Memory usage summary: heap total: 45200, heap peak: 6440, stack peak: 208
         total calls   total memory   failed calls
 malloc|          1            400              0
realloc|         40          44800              0  (nomove:40, dec:19, free:0)
 calloc|          0              0              0
   free|          1            440
Histogram for block sizes:
  192-207             1   2% ================
............................

Tried generating a graphical image of the memory usage statistics using the --png option.  The graph displayed OK but was somewhat difficult to read because of the chequered background pattern representing transparency.

This update looks fine for 64 bits.

Whiteboard: (none) => MGA6-64-OK
CC: (none) => tarazed25

Comment 9 Brian Rockwell 2018-01-22 18:41:06 CET 
I picked this up as part of the firefox 52.6 testing.  Seems to be working on 64bit for me as well.

CC: (none) => brtians1

Comment 10 Thomas Andrews 2018-01-23 03:48:37 CET 
Like Brian, I picked this up as I was about to test Firefox on my 64-bit system. I didn't know about the locales packages until I read the bug, after which I installed those packages, too.

Seems to be working here, too.

CC: (none) => andrewsfarm

Comment 11 Thomas Andrews 2018-01-23 23:40:52 CET 
Real hardware, Athlon X2 7750, 8GB, nvidia340, Atheros wifi, 64-bit Plasma system with server kernel.

Looks good here, as far as I can tell.
Comment 12 Thomas Andrews 2018-01-24 00:34:25 CET 
Same hardware as Comment 11, this time on a 32-bit Xfce system, server kernel.

Looks good.
Comment 13 Lewis Smith 2018-01-24 21:27:00 CET 
M6/64
Having used for a short time this update, it is OK for me. Second the x64 OK.

CC: (none) => lewyssmith

Comment 14 PC LX 2018-01-25 00:13:40 CET 
Installed and tested without issues.

Tested for the last two days, using multiple applications, without noticeable regressions.

System: Mageia 6, x64_64, Plasma DE, LXQT DE, Intel CPU, nVidia GPU using nvidia340 proprietary driver.

$ uname -a
Linux marte 4.14.13-desktop-1.mga6 #1 SMP Wed Jan 10 12:48:53 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | egrep 'glibc|locales' | sort
glibc-2.22-27.mga6
glibc-devel-2.22-27.mga6
locales-2.22-7.mga6
locales-en-2.22-7.mga6
locales-pt-2.22-7.mga6

CC: (none) => mageia

Comment 15 Herman Viaene 2018-01-25 10:54:53 CET 
MGA6-32 on Dell Latitude D600 Mate Dutch
glibc-2.22-27.mga6 was already installed (due to other updates??). Installed other packages and rebooted.
Found no problems running usual operations, looks OK

CC: (none) => herman.viaene
Whiteboard: MGA6-64-OK => MGA6-64-OK MGA6-32-OK

Lewis Smith 2018-01-25 12:26:42 CET

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 16 Mageia Robot 2018-01-25 13:48:17 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0096.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.