USN-6409-1: GNU C Library vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.04 LTS

Packages

• glibc - GNU C Library

Details

It was discovered that the GNU C Library incorrectly handled the
GLIBC_TUNABLES environment variable. An attacker could possibly use this
issue to perform a privilege escalation attack. (CVE-2023-4911)

It was discovered that the GNU C Library incorrectly handled certain DNS
responses when the system was configured in no-aaaa mode. A remote attacker
could possibly use this issue to cause the GNU C Library to crash,
resulting in a denial of service. This issue only affected Ubuntu 23.04.
(CVE-2023-4527)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• libc6 - 2.37-0ubuntu2.1

Ubuntu 22.04

• libc6 - 2.35-0ubuntu3.4

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

• CVE-2023-4911
• CVE-2023-4527