RHSA-2010:0872: Important: glibc security and bug fix update

The glibc packages contain the standard C libraries used by multipleprograms on the system. These packages contain the standard C and thestandard math libraries. Without these two libraries, a Linux systemcannot function properly.It was discovered that the glibc dynamic linker/loader did not handle the$ORIGIN dynamic string token set in the LDAUDIT environment variablesecurely. A local attacker with write access to a file system containingsetuid or setgid binaries could use this flaw to escalate their privileges.(CVE-2010-3847)It was discovered that the glibc dynamic linker/loader did not performsufficient safety checks when loading dynamic shared objects (DSOs) toprovide callbacks for its auditing API during the execution of privilegedprograms. A local attacker could use this flaw to escalate their privilegesvia a carefully-chosen system DSO library containing unsafe constructors.(CVE-2010-3856)Red Hat would like to thank Tavis Ormandy for reporting the CVE-2010-3847issue, and Ben Hawkes and Tavis Ormandy for reporting the CVE-2010-3856issue.This update also fixes the following bugs: Previously, the generic implementation of the strstr() and memmem() functions did not handle certain periodic patterns correctly and could finda false positive match. This error has been fixed, and both functions nowwork as expected. (BZ#643341) The "TCBALIGNMENT" value has been increased to 32 bytes to prevent applications from crashing during symbol resolution on 64-bit systems withsupport for Intel AVX vector registers. (BZ#643343)All users are advised to upgrade to these updated packages, which containbackported patches to correct these issues.