Subject: bug#70581: closed (Re: bug#70581: PHP, glibc, and CVE-2024-2961)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 18 Dec 2024 07:33:02 +0000

Your bug report

#70581: PHP, glibc, and CVE-2024-2961

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
70581: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=70581
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#70581: PHP, glibc, and CVE-2024-2961
From: Maxim Cournoyer <[email-masked]>
To: [email-masked]
Cc: Ludovic Courtès <[email-masked]>, [email-masked], Liliana Marie Prikler <[email-masked]>, Andreas Enge <[email-masked]>, McSinyx <[email-masked]>, Janneke Nieuwenhuizen <[email-masked]>
Date: Wed, 18 Dec 2024 16:31:37 +0900
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi

Maxim Cournoyer <[email-masked]> writes:

> * gnu/packages/base.scm (%glibc-patches): New variable.
> (glibc) [source]: Use it.
> [properties]: Mark CVE-2024-2961 as hidden (resolved).
> [replacement]: Add field to graft with...
> (glibc/fixed): ... this new package.
>
> Fixes: <https://issues.guix.gnu.org/70581>
> Change-Id: I6dd70b0e157283925824348f180c466c2f6387c9

Applied.

-- 
Thanks,
Maxim

Subject: PHP, glibc, and CVE-2024-2961
From: "McSinyx" <[email-masked]>
To: <[email-masked]>
Date: Fri, 26 Apr 2024 15:44:50 +0900
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello Guix,

Last week, an overflow bug in glibc's iconv(3) was discovered:
https://www.openwall.com/lists/oss-security/2024/04/17/9

It may enable remove code execution through PHP.  Due to
the immutable nature of Guix, is it possible to hotpatch
this using graft, or do we need to rebuild to world?
https://rockylinux.org/news/glibc-vulnerability-april-2024/

Kind regards,
McSinyx