CVE-2015-7547 glibc fix

Support for security such as Firewalls and securing linux
ewm76903
Posts: 1
Joined: 2016/02/16 20:49:27

CVE-2015-7547 glibc fix

Postby ewm76903 » 2016/02/16 20:51:59

Has anyone verified if the repos have a fix for the bug in glibc that is reference in CVE-2015-7547?

If so, can you tell me the version that glibc should be at to verify if the system has been fixed?

Thanks

User avatar
TrevorH
Forum Moderator
Posts: 19441
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: CVE-2015-7547 glibc fix

Postby TrevorH » 2016/02/16 21:15:47

Updates for the recent glibc CVE-2015-7547 are being built and will be pushed to the mirror network as soon as they are available. Please subscribe to the centos-announce mailing list to keep abreast of all updates. See http://wiki.centos.org/GettingHelp/ListInfo for more information.
CentOS 5 died in March 2017 - migrate NOW!
Full time Geek, part time moderator. Use the FAQ Luke

User avatar
avij
Forum Moderator
Posts: 1905
Joined: 2010/12/01 19:25:52
Location: Helsinki, Finland
Contact:

Re: CVE-2015-7547 glibc fix

Postby avij » 2016/02/16 21:46:15

For CentOS 6, the fixed glibc will be glibc-2.12-1.166.el6_7.7.

[edit: edited]

User avatar
avij
Forum Moderator
Posts: 1905
Joined: 2010/12/01 19:25:52
Location: Helsinki, Finland
Contact:

Re: CVE-2015-7547 glibc fix

Postby avij » 2016/02/17 05:13:51

OK, it's out now. I saw "Updated: glibc-2.12-1.166.el6_7.7.x86_64" in my yum.log this morning.

infosatheesh2020
Posts: 2
Joined: 2016/02/17 10:30:54

Re: CVE-2015-7547 glibc fix

Postby infosatheesh2020 » 2016/02/17 10:35:16

I see new patch as 2.12-1.166.el6_7.3

Is this the correct patch, because I see el6_7.3 instead of el6_7.7

User avatar
avij
Forum Moderator
Posts: 1905
Joined: 2010/12/01 19:25:52
Location: Helsinki, Finland
Contact:

Re: CVE-2015-7547 glibc fix

Postby avij » 2016/02/17 10:41:30

No, el6_7.3 was the previous version, released in September 2015. You will need el6_7.7 to fix CVE-2015-7547.

infosatheesh2020
Posts: 2
Joined: 2016/02/17 10:30:54

Re: CVE-2015-7547 glibc fix

Postby infosatheesh2020 » 2016/02/17 12:02:36

Can you help me find the correct package from the repo? I am not able find exact one in updates for http://vault.centos.org

User avatar
avij
Forum Moderator
Posts: 1905
Joined: 2010/12/01 19:25:52
Location: Helsinki, Finland
Contact:

Re: CVE-2015-7547 glibc fix

Postby avij » 2016/02/17 12:22:26

The vault only contains packages from older releases of CentOS. You should be able to get the new glibc by simply running yum update. If you for some reason need to fetch the packages manually, http://mirror.centos.org/centos/6/updates/x86_64/Packages/ has the files.

http://vault.centos.org/readme.txt wrote:This is _NOT_ an updated tree for installing CentOS Linux. It is a snapshot of the older trees that have been removed from the main CentOS servers as new point releases are released.

This is provided for reference and to provide access to older archived versions, and we do not put security updates into the trees on this server.

Please see this link for active versions of CentOS Linux: https://wiki.centos.org/Download

Unless you have a reason to use old, outdated and insecure software, you should instead be using http://mirror.centos.org/ or a mirror from https://www.centos.org/download/mirrors/

The Following External Vault mirrors (not monitored by the CentOS Infra team !) also provide direct downloads for all content, including isos and rsync access:

...

User avatar
TrevorH
Forum Moderator
Posts: 19441
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: CVE-2015-7547 glibc fix

Postby TrevorH » 2016/02/17 16:41:20

Just run yum update to get the fix. If it's not listed then try yum clean all and then repeat the update.
CentOS 5 died in March 2017 - migrate NOW!
Full time Geek, part time moderator. Use the FAQ Luke

gromitmpl
Posts: 1
Joined: 2016/02/17 23:20:54

Re: CVE-2015-7547 glibc fix

Postby gromitmpl » 2016/02/17 23:52:34

I am not getting this update.

I am running 6.5 and have my repository set to this:
[updates]
name=CentOS-$releasever - Updates
baseurl=http://mirror.centos.org/centos/6/os/$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6

I run yum update glibc but am not getting the update.

[root@xxxx]# rpm -q glibc
glibc-2.12-1.166.el6.x86_64


Return to “CentOS 6 - Security Support”

Who is online

Users browsing this forum: No registered users and 1 guest