It was reported [1] that when processing certain malformed patterns, fnmatch can skip over the NUL byte terminating the pattern. This can potentially result in an application crash if fnmatch hits an unmapped page before encountering a NUL byte. Upstream bug report: https://sourceware.org/bugzilla/show_bug.cgi?id=18032 The fix is here: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4a28f4d55a6cc33474c0792fe93b5942d81bf185 [1]: http://seclists.org/oss-sec/2015/q1/689
Created glibc tracking bugs for this issue: Affects: fedora-all [bug 1197732]
There are two other related bugs in fnmatch that have been fixed upstream and that need to be backported if 18032 is to be because the test in 18032 depends on those fixes: http://sourceware.org/bugzilla/show_bug.cgi?id=17062 and http://sourceware.org/bugzilla/show_bug.cgi?id=18036
(In reply to Martin Sebor from comment #3) > There are two other related bugs in fnmatch that have been fixed upstream > and that need to be backported if 18032 is to be because the test in 18032 > depends on those fixes: > http://sourceware.org/bugzilla/show_bug.cgi?id=17062 > and > http://sourceware.org/bugzilla/show_bug.cgi?id=18036 Both of those look good to me.
CVE request via: http://openwall.com/lists/oss-security/2015/09/08/2
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2199 https://rhn.redhat.com/errata/RHSA-2015-2199.html
CVE assignment: http://seclists.org/oss-sec/2017/q1/437