mirror of
https://git.yoctoproject.org/poky
synced 2026-03-29 23:02:20 +02:00
278d77034e
Take the patch from the source for Debian's glibc 2.31-13+deb11u7
package, the changelog for which starts with:
glibc (2.31-13+deb11u7) bullseye-security; urgency=medium
* debian/patches/any/local-CVE-2023-4911.patch: Fix a buffer overflow in the
dynamic loader's processing of the GLIBC_TUNABLES environment variable
(CVE-2023-4911).
This addresses the "Looney Tunables" vulnerability described at
https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
(From OE-Core rev: 9a800a2e2c2b14eab8c1f83cb4ac3b94a70dd23c)
Signed-off-by: Mike Crowe <mac@mcrowe.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>