Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

[Hanno Böck <hanno () hboeck de>]

Hi,

the german IT news webpage heise mentions this: back in April 2014
Chrome OS applied the patch:
https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/7738d06627941a2119ba15f3472320c5cecc7be6%5E!/#F0

The comit message clearly states they were aware of the vulnerability
nature of this fix:
"glibc: backport an nss overflow patch.

This beckports a patch to fix a nss vulnerability inside glibc."

I'm CC-ing the committer. Maybe we can shed some light on this.

Two people having fixed this in different places without crying alarm -
it's worrying.

Here's the german article mentioning this:
http://www.heise.de/newsticker/meldung/Ghost-Uralte-Luecke-in-Glibc-bedroht-Linux-Server-2530159.html

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: _bin
Description: OpenPGP digital signature