Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:2066-1

Опубликовано: 26 июл. 2018
Источник: suse-cvrf

Описание

Security update for util-linux

This update for util-linux fixes the following security issue:

  • CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name (bsc#1084300)

Список пакетов

SUSE Linux Enterprise Module for Basesystem 15
libblkid-devel-2.31.1-9.3.1
libblkid-devel-static-2.31.1-9.3.1
libblkid1-2.31.1-9.3.1
libblkid1-32bit-2.31.1-9.3.1
libfdisk-devel-2.31.1-9.3.1
libfdisk1-2.31.1-9.3.1
libmount-devel-2.31.1-9.3.1
libmount1-2.31.1-9.3.1
libmount1-32bit-2.31.1-9.3.1
libsmartcols-devel-2.31.1-9.3.1
libsmartcols1-2.31.1-9.3.1
libuuid-devel-2.31.1-9.3.1
libuuid-devel-static-2.31.1-9.3.1
libuuid1-2.31.1-9.3.1
libuuid1-32bit-2.31.1-9.3.1
util-linux-2.31.1-9.3.1
util-linux-lang-2.31.1-9.3.1
util-linux-systemd-2.31.1-9.3.1
SUSE Linux Enterprise Module for Server Applications 15
uuidd-2.31.1-9.3.1

Ссылки

Описание

In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.

Затронутые продукты
SUSE Linux Enterprise Module for Basesystem 15:libblkid-devel-2.31.1-9.3.1
SUSE Linux Enterprise Module for Basesystem 15:libblkid-devel-static-2.31.1-9.3.1
SUSE Linux Enterprise Module for Basesystem 15:libblkid1-2.31.1-9.3.1
SUSE Linux Enterprise Module for Basesystem 15:libblkid1-32bit-2.31.1-9.3.1
Ссылки