1

My SoC vendor uses Yocto to create custom Embedded Linux distribution, that contains glibc 2.22.

As part of the distribution we have received patches till CVE-2016-4429. But, now there are some vulnerabilities which hasn't been addressed yet, such as:

  • CVE-2016-5417
  • CVE-2016-6323

Are there known patches for these CVEs that we can get?

2

Searching for CVE-2016-5417 points to nvd.nist.giv which has as resource listed a link to a patch.

Note that these source patches are usually only for versions still supported by the authors of the software, i.e. often only the latest versions. And it might also be that the patch includes not only a fix for this specific issue but for multiple issues. In such cases you either depend on your distributor to provide you with a fixed version of the software or you need to have the know-how to extract the essential patch from a bigger one, maybe modify it for your software version and apply it - i.e. do yourself what the distributor usually does for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.