Hi, Anybody knows when will this be patched in buster (glibc 2.28)? Thanks, Liming
On Wed, 26 May 2021 21:57:12 +0200 Salvatore Bonaccorso <car...@debian.org<mailto:car...@debian.org>> wrote: > Source: glibc > Version: 2.31-12 > Severity: important > Tags: security upstream > Forwarded: https://sourceware.org/bugzilla/show_bug.cgi?id=27896 > X-Debbugs-Cc: car...@debian.org<mailto:car...@debian.org>, Debian Security > Team <t...@security.debian.org<mailto:t...@security.debian.org>> > > Hi, > > The following vulnerability was published for glibc, basically purely > to track the upstream issue and fix once coming downstream. > > CVE-2021-33574[0]: > | The mq_notify function in the GNU C Library (aka glibc) through 2.33 > | has a use-after-free. It may use the notification thread attributes > | object (passed through its struct sigevent parameter) after it has > | been freed by the caller, leading to a denial of service (application > | crash) or possibly unspecified other impact. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2021-33574 > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574 > [1] https://sourceware.org/bugzilla/show_bug.cgi?id=27896 > > Please adjust the affected versions in the BTS as needed. > > Regards, > Salvatore > >
