[El-errata] New glibc updates available via Ksplice (ELSA-2021-1585)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2021-1585 can now be patched using Ksplice
CVEs: CVE-2016-10228 CVE-2019-25013 CVE-2019-9169 CVE-2020-27618 CVE-2021-3326

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2021-1585.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 8 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
glibc RPMs and statically linked applications using
glibc should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages.  Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details.  Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* Note: Oracle will not provide an update for CVE-2016-10228, CVE-2020-27618.

Oracle has determined that patching CVE-2016-10228, CVE-2020-27618 on a
running system would not be safe and recommends to restart affected
processes. The vulnerability could lead to a denial-of-service if an
application is using iconv.


* Note: Oracle will not provide an update for CVE-2019-25013.

Oracle has determined that patching CVE-2019-25013 on a running system
would not be safe and recommends to restart affected processes. The
vulnerability could lead to a privilege escalation if an application is
using EUC-KR encoding.


* Note: Oracle will not provide an update for CVE-2021-3326.

Oracle has determined that patching CVE-2021-3326 on a running system
would not be safe and recommends to restart affected processes. The
vulnerability could lead to a denial-of-service if an application is
using ISO-2022-JP-3 encoding.


* CVE-2019-9169: Out-of-bounds access when processing regex.

A logic error when processing regular expressions could lead to an
out-of-bounds access. A local attacker could use this flaw to cause a
denial-of-service or escalate privileges.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.