Описание
Security update for glibc
This update for glibc fixes the following issues:
-
A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293]
-
A buffer manipulation vulnerability in nscd has been fixed that could possibly have lead to an nscd daemon crash or code execution as the user running nscd. [CVE-2014-9984, bsc#1043984]
Список пакетов
SUSE Linux Enterprise Server 12-LTSS
Ссылки
- Link for SUSE-SU-2018:0076-1
- E-Mail link for SUSE-SU-2018:0076-1
- SUSE Security Ratings
- SUSE Bug 1043984
- SUSE Bug 1074293
- SUSE CVE CVE-2014-9984 page
- SUSE CVE CVE-2018-1000001 page
Описание
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
Затронутые продукты
Ссылки
- CVE-2014-9984
- SUSE Bug 1043984
- SUSE Bug 1123874
Описание
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
Затронутые продукты
Ссылки
- CVE-2018-1000001
- SUSE Bug 1074293
- SUSE Bug 1099047
- SUSE Bug 1123874