Security update for glibc
SUSE Security Update: Security update for glibc
This glibc update fixes a critical privilege escalation problem and two
additional issues:
* bnc#892073: An off-by-one error leading to a heap-based buffer
overflow was found in __gconv_translit_find(). An exploit that
targets the problem is publicly available. (CVE-2014-5119)
* bnc#836746: Avoid race between {, __de}allocate_stack and
__reclaim_stacks during fork.
* bnc#844309: Fixed various overflows, reading large /etc/hosts or
long names. (CVE-2013-4357)
* bnc#894553, bnc#894556: Fixed various crashes on invalid input in
IBM gconv modules. (CVE-2014-6040, CVE-2012-6656)
Security Issues:
* CVE-2012-6656
* CVE-2013-4357
* CVE-2014-5119
* CVE-2014-6040
| Announcement ID: | SUSE-SU-2014:1129-1 |
| Rating: | important |
| References: | #836746 #844309 #892073 #894553 #894556 |
| Affected Products: |
An update that solves four vulnerabilities and has one errata is now available.
Description:
This glibc update fixes a critical privilege escalation problem and two
additional issues:
* bnc#892073: An off-by-one error leading to a heap-based buffer
overflow was found in __gconv_translit_find(). An exploit that
targets the problem is publicly available. (CVE-2014-5119)
* bnc#836746: Avoid race between {, __de}allocate_stack and
__reclaim_stacks during fork.
* bnc#844309: Fixed various overflows, reading large /etc/hosts or
long names. (CVE-2013-4357)
* bnc#894553, bnc#894556: Fixed various crashes on invalid input in
IBM gconv modules. (CVE-2014-6040, CVE-2012-6656)
Security Issues:
* CVE-2012-6656
* CVE-2013-4357
* CVE-2014-5119
* CVE-2014-6040
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP2 LTSS:
zypper in -t patch slessp2-glibc-9721
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP2 LTSS (i586 i686 s390x x86_64):
- glibc-2.11.3-17.45.53.1
- glibc-devel-2.11.3-17.45.53.1
- SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64):
- glibc-html-2.11.3-17.45.53.1
- glibc-i18ndata-2.11.3-17.45.53.1
- glibc-info-2.11.3-17.45.53.1
- glibc-locale-2.11.3-17.45.53.1
- glibc-profile-2.11.3-17.45.53.1
- nscd-2.11.3-17.45.53.1
- SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64):
- glibc-32bit-2.11.3-17.45.53.1
- glibc-devel-32bit-2.11.3-17.45.53.1
- glibc-locale-32bit-2.11.3-17.45.53.1
- glibc-profile-32bit-2.11.3-17.45.53.1
References:
- http://support.novell.com/security/cve/CVE-2012-6656.html
- http://support.novell.com/security/cve/CVE-2013-4357.html
- http://support.novell.com/security/cve/CVE-2014-5119.html
- http://support.novell.com/security/cve/CVE-2014-6040.html
- https://bugzilla.novell.com/836746
- https://bugzilla.novell.com/844309
- https://bugzilla.novell.com/892073
- https://bugzilla.novell.com/894553
- https://bugzilla.novell.com/894556
- http://download.suse.com/patch/finder/?keywords=cd8403453563e9d5a949d2219d62a993