For your convenience:

The researchers pointed out that the vulnerability cannot be exploited remotely. An attacker can trigger the issue by providing crafted inputs to applications that employ these [syslog] logging functions [in apps that allow the user to feed crafted data to those functions].

This is a privilege escalation.

"A qsort vulnerability is due to a missing bounds check and can lead to memory corruption. It has been present in all versions of glibc since 1992. "

This one amazes me. Imagine how many vulnerabilities future researchers will discover in ancient software that persisted/persist for decades.

Security-critical C and memory safety bugs. Name a more iconic duo...

I'd have kinda preferred for public disclosure to have happened after the fix propagated to distros. Now we get to hurry the patch to end-users which isn't always easily possible. Could we at least have a coordinated disclosure time each month? That'd be great.

glibc is great, but holy shit the source code is obscured into oblivion, so hard to understand, with hardcoded optimizations, and compiler optimizations. I understand how difficult is to find vulnerabilities. A bit sad that the only C lib truely free software is so hard to actually read its code or even contribute to it.

Debian (versions 12 and 13), Ubuntu (23.04 and 23.10), and Fedora (37 to 39). Other distributions are probably also impacted.

Imagine all the vulnerabilities that privative and low reviewed code has...

Let's go Musl!

Yikes.

I'd switch to musl on all of my boxes if it weren't that nearly all precompiled software (closed source, games mainly) are compiled against glibc.

That's why you need to rock and roll

(Arch btw.)

I replied to another comment with this, but Debian 12(stable, bookworm) and 13(testing, trixie) are affected by this but 12(stable, bookworm) has a patch out in the security repo.

If you wanna know wether or not you’re affected,

apt list libc

will show your version and the one you want is 2.36-9+deb12u4

If you don’t have that,

apt update && apt upgrade

will straighten you out

13(testing, trixie) has 2.37, but it’s not fixed yet.

E: Edited to use apt list instead of apt show.

RedHat and related: https://access.redhat.com/security/cve/CVE-2023-6246

Not affected

Not affected

Not affected

etc.

Local attacker

Important detail

as i said on reddit