Security update for coreutils

Announcement ID:	SUSE-SU-2015:1637-1
Rating:	moderate
References:	bsc#866010 bsc#901905 bsc#907290 bsc#921559 bsc#928749 bsc#930565 bsc#933396
Cross-References:	CVE-2015-4041 CVE-2015-4042
CVSS scores:	CVE-2015-4041 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2015-4042 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12

An update that solves two vulnerabilities and has five security fixes can now be installed.

Description:

This update for coreutils provides the following fixes:

• Fix memory handling error with case insensitive sort using UTF-8. (CVE-2015-4041, CVE-2015-4042)
• Ensure "df -a" shows all remote file system entries.
• Only suppress remote mounts of separate exports with "df --total".
• Document that "df -a" might list duplicated file systems.
• Adjust references to info nodes in man pages.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12
  zypper in -t patch SUSE-SLE-DESKTOP-12-2015-599=1
• SUSE Linux Enterprise Server 12
  zypper in -t patch SUSE-SLE-SERVER-12-2015-599=1
• SUSE Linux Enterprise Server for SAP Applications 12
  zypper in -t patch SUSE-SLE-SERVER-12-2015-599=1

Package List:

• SUSE Linux Enterprise Desktop 12 (x86_64)
  • coreutils-debuginfo-8.22-9.1
  • coreutils-8.22-9.1
  • coreutils-debugsource-8.22-9.1
• SUSE Linux Enterprise Desktop 12 (noarch)
  • coreutils-lang-8.22-9.1
• SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64)
  • coreutils-debuginfo-8.22-9.1
  • coreutils-8.22-9.1
  • coreutils-debugsource-8.22-9.1
• SUSE Linux Enterprise Server 12 (noarch)
  • coreutils-lang-8.22-9.1
• SUSE Linux Enterprise Server for SAP Applications 12 (x86_64)
  • coreutils-debuginfo-8.22-9.1
  • coreutils-8.22-9.1
  • coreutils-debugsource-8.22-9.1
• SUSE Linux Enterprise Server for SAP Applications 12 (noarch)
  • coreutils-lang-8.22-9.1

References:

• https://www.suse.com/security/cve/CVE-2015-4041.html
• https://www.suse.com/security/cve/CVE-2015-4042.html
• https://bugzilla.suse.com/show_bug.cgi?id=866010
• https://bugzilla.suse.com/show_bug.cgi?id=901905
• https://bugzilla.suse.com/show_bug.cgi?id=907290
• https://bugzilla.suse.com/show_bug.cgi?id=921559
• https://bugzilla.suse.com/show_bug.cgi?id=928749
• https://bugzilla.suse.com/show_bug.cgi?id=930565
• https://bugzilla.suse.com/show_bug.cgi?id=933396