RHSA-2017:0680MediumCVSS 8.1

Red Hat Security Advisory: glibc security and bug fix update

Published
March 21, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (4)

CVE-2014-9761 →CVE-2015-8776 →CVE-2015-8778 →CVE-2015-8779 →

📋 Description

CVE-2014-9761 — glibc: Unbounded stack allocation in nan* functions CVE-2015-8776 — glibc: Segmentation fault caused by passing out-of-range data to strftime() CVE-2015-8778 — glibc: Integer overflow in hcreate and hcreate_r CVE-2015-8779 — glibc: Unbounded stack allocation in catopen function

🎯 Affected products132

  • Red Hat Enterprise Linux Desktop (v. 6)
  • Red Hat Enterprise Linux Desktop Optional (v. 6)
  • Red Hat Enterprise Linux HPC Node (v. 6)
  • Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Enterprise Linux Server Optional (v. 6)
  • Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Enterprise Linux Workstation Optional (v. 6)
  • glibc-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • glibc-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • glibc-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • glibc-0:2.12-1.209.el6.ppc as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.s390 as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.src as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • glibc-0:2.12-1.209.el6.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • glibc-0:2.12-1.209.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • glibc-0:2.12-1.209.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • glibc-0:2.12-1.209.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • glibc-0:2.12-1.209.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-0:2.12-1.209.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • glibc-common-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • glibc-common-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-common-0:2.12-1.209.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • glibc-common-0:2.12-1.209.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-common-0:2.12-1.209.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • glibc-common-0:2.12-1.209.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • +102 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted. Workaround: Do not use any applications which call the affected nan* functions. These functions are used only very rarely. Workaround: Check time values before they are passed to strftime, or call strftime only with struct tm values computed by gmtime or localtime. Workaround: Do not use any applications which call hcreate or hcreate_r with a large size argument. These functions are used only rarely, and most callers supply a constant argument. Other applications calculate the size argument in such a way that the error condition cannot be triggered. Workaround: Do not use applications which call catopen with unbounded strings. The catopen function is rarely used. Typical application usage involves passing a short, constant string to catopen, so most applications are not affect even if they call catopen.

🔗 References (14)