Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:2756-1

Опубликовано: 05 авг. 2024
Источник: suse-cvrf

Описание

Security update for ksh

This update for ksh fixes the following issues:

  • CVE-2019-14868: Fixed code injection due to environment variables on startup interpreted as arithmetic expression (bsc#1160796)

Other fixes:

  • do not use posix_spawn as it lacks proper job handling (bsc#1224057)
  • fix segfault in variable substitution (bsc#1129288)

Список пакетов

Image SLES12-SP5-Azure-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-Azure-HPC-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-Azure-HPC-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-Azure-SAP-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-Azure-SAP-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-Azure-Standard-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-EC2-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-EC2-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-EC2-SAP-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-EC2-SAP-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-GCE-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-GCE-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-GCE-SAP-BYOS
ksh-93vu-19.3.2
Image SLES12-SP5-GCE-SAP-On-Demand
ksh-93vu-19.3.2
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
ksh-93vu-19.3.2
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
ksh-93vu-19.3.2
SUSE Linux Enterprise Module for Legacy 12
ksh-93vu-19.3.2
SUSE Linux Enterprise Software Development Kit 12 SP5
ksh-devel-93vu-19.3.2

Ссылки

Описание

In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:ksh-93vu-19.3.2
Image SLES12-SP5-Azure-HPC-BYOS:ksh-93vu-19.3.2
Image SLES12-SP5-Azure-HPC-On-Demand:ksh-93vu-19.3.2
Image SLES12-SP5-Azure-SAP-BYOS:ksh-93vu-19.3.2
Ссылки