|
Hi, Anybody knows when will this be patched in buster (glibc 2.28)? Thanks, Liming On Wed, 26 May 2021 21:57:12 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote: > Source: glibc > Version: 2.31-12 > Severity: important > Tags: security upstream > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> > > Hi, > > The following vulnerability was published for glibc, basically purely > to track the upstream issue and fix once coming downstream. > > CVE-2021-33574[0]: > | The mq_notify function in the GNU C Library (aka glibc) through 2.33 > | has a use-after-free. It may use the notification thread attributes > | object (passed through its struct sigevent parameter) after it has > | been freed by the caller, leading to a denial of service (application > | crash) or possibly unspecified other impact. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > > Please adjust the affected versions in the BTS as needed. > > Regards, > Salvatore > > |