Описание
Security update for glibc
glibc was updated to fix the following issues:
Security issues fixed:
- CVE-2022-23219: Fixed Buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
- CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bsc#1194770)
- CVE-2021-3999: Fixed getcwd to set errno to ERANGE for size == 1 (bsc#1194640)
- CVE-2015-8985: Fixed Assertion failure in pop_fail_stack when executing a malformed regexp (bsc#1193625)
Also the following bug was fixed:
- Fix pthread_rwlock_try*lock stalls (bsc#1195560)
Список пакетов
Container caasp/v4/cilium-operator:1.6.6
Container caasp/v4/cilium:1.6.6
Container caasp/v4/helm-tiller:2.16.12
Container ses/6/cephcsi/cephcsi:latest
Container ses/6/rook/ceph:latest
Container ses/7/ceph/grafana:latest
Container ses/7/ceph/prometheus-alertmanager:latest
Container ses/7/ceph/prometheus-node-exporter:latest
Container ses/7/ceph/prometheus-server:latest
Container ses/7/cephcsi/cephcsi:latest
Container ses/7/cephcsi/csi-attacher:v3.3.0
Container ses/7/cephcsi/csi-livenessprobe:v1.1.0
Container ses/7/cephcsi/csi-node-driver-registrar:v2.3.0
Container ses/7/cephcsi/csi-provisioner:v3.0.0
Container ses/7/cephcsi/csi-resizer:v1.3.0
Container ses/7/cephcsi/csi-snapshotter:v4.2.0
Container ses/7/prometheus-webhook-snmp:latest
Container ses/7/rook/ceph:latest
Container suse/sle15:15.0
Container suse/sle15:15.1
Container suse/sle15:15.2
Image SLES15-Azure-BYOS
Image SLES15-SAP-Azure-BYOS
Image SLES15-SAP-Azure-LI-BYOS-Production
Image SLES15-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP1-Azure-BYOS
Image SLES15-SP1-Azure-HPC-BYOS
Image SLES15-SP1-CHOST-BYOS-Azure
Image SLES15-SP1-CHOST-BYOS-EC2
Image SLES15-SP1-CHOST-BYOS-GCE
Image SLES15-SP1-SAP-Azure-BYOS
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP1-SAPCAL-Azure
Image SLES15-SP1-SAPCAL-EC2-HVM
Image SLES15-SP1-SAPCAL-GCE
Image SLES15-SP2-BYOS-Azure
Image SLES15-SP2-BYOS-EC2-HVM
Image SLES15-SP2-BYOS-GCE
Image SLES15-SP2-CHOST-BYOS-Aliyun
Image SLES15-SP2-CHOST-BYOS-Azure
Image SLES15-SP2-CHOST-BYOS-EC2
Image SLES15-SP2-CHOST-BYOS-GCE
Image SLES15-SP2-HPC-BYOS-Azure
Image SLES15-SP2-HPC-BYOS-EC2-HVM
Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure
Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM
Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE
Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure
Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM
Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE
Image SLES15-SP2-SAP-Azure
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP2-SAP-BYOS-Azure
Image SLES15-SP2-SAP-BYOS-EC2-HVM
Image SLES15-SP2-SAP-BYOS-GCE
Image SLES15-SP2-SAP-EC2-HVM
Image SLES15-SP2-SAP-GCE
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise Micro 5.0
SUSE Linux Enterprise Real Time 15 SP2
SUSE Linux Enterprise Server 15 SP1-BCL
SUSE Linux Enterprise Server 15 SP1-LTSS
SUSE Linux Enterprise Server 15 SP2-BCL
SUSE Linux Enterprise Server 15 SP2-LTSS
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server for SAP Applications 15 SP1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
SUSE Manager Proxy 4.1
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
Ссылки
- Link for SUSE-SU-2022:0832-1
- E-Mail link for SUSE-SU-2022:0832-1
- SUSE Security Ratings
- SUSE Bug 1193625
- SUSE Bug 1194640
- SUSE Bug 1194768
- SUSE Bug 1194770
- SUSE Bug 1195560
- SUSE CVE CVE-2015-8985 page
- SUSE CVE CVE-2021-3999 page
- SUSE CVE CVE-2022-23218 page
- SUSE CVE CVE-2022-23219 page
Описание
The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
Затронутые продукты
Ссылки
- CVE-2015-8985
- SUSE Bug 1193625
- SUSE Bug 920169
- SUSE Bug 920338
Описание
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
Затронутые продукты
Ссылки
- CVE-2021-3999
- SUSE Bug 1194640
- SUSE Bug 1196024
- SUSE Bug 1196389
- SUSE Bug 1199869
- SUSE Bug 1200203
Описание
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Затронутые продукты
Ссылки
- CVE-2022-23218
- SUSE Bug 1194770
- SUSE Bug 1199869
- SUSE Bug 1200036
Описание
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Затронутые продукты
Ссылки
- CVE-2022-23219
- SUSE Bug 1194768
- SUSE Bug 1199869
- SUSE Bug 1200036