Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 508
Alerts This Week
Warning Icon 1 508

openSUSE Leap 42.1: 2016:0490-1 Important: glibc Critical Flaws

opensuse
Calendar Grey February 17, 2016
Scroller Opensuse
Patch release for glibc on openSUSE tackling multiple severe vulnerabilities and numerous enhancements, safeguarding system stability.
An update that solves 6 vulnerabilities and has three fixes An update that solves 6 vulnerabilities and has three fixes An update that solves 6 vulnerabilities and has three fixes ...

Description

This update for glibc fixes the following security issues:

- CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed

remote attackers to cause a crash or execute arbitrary code via crafted

and timed DNS responses (bsc#961721)

- CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment

variable allowed local attackers to bypass the pointer guarding

protection of the dynamic loader on set-user-ID and set-group-ID

programs (bsc#950944)

- CVE-2015-8776: Out-of-range time values passed to the strftime function

may cause it to crash, leading to a denial of service, or potentially

disclosure information (bsc#962736)

- CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have

caused an out-of-bound memory access. leading to application crashes or,

potentially, arbitrary code execution (bsc#962737)

- CVE-2014-9761: A stack overflow (unbounded alloca) could have caused

applications which...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow critical system update glibc openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2016-224=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.1 (i586 i686 x86_64):

glibc-2.19-19.1

glibc-debuginfo-2.19-19.1

glibc-debugsource-2.19-19.1

glibc-devel-2.19-19.1

glibc-devel-debuginfo-2.19-19.1

glibc-devel-static-2.19-19.1

glibc-locale-2.19-19.1

glibc-locale-debuginfo-2.19-19.1

glibc-profile-2.19-19.1

- openSUSE Leap 42.1 (i586 x86_64):

glibc-extra-2.19-19.1

glibc-extra-debuginfo-2.19-19.1

glibc-utils-2.19-19.1

glibc-utils-debuginfo-2.19-19.1

glibc-utils-debugsource-2.19-19.1

nscd-2.19-19.1

nscd-debuginfo-2.19-19.1

- openSUSE Leap 42.1 (x86_64):

glibc-32bit-2.19-19.1

glibc-debuginfo-32bit-2.19-19.1

glibc-devel-32bit-2.19-19.1

glibc-devel-debuginfo-32bit-2.19-19.1

glibc-devel-static-32bit-2.19-19.1

glibc-locale-32bit-2.19-19.1

glibc-locale-debuginfo-32bit-2.19-19.1

glibc-profile-32bit-2.19-19.1

glibc-utils-32bit-2.19-19.1

glibc-utils-debuginfo-32bit-2.19-19.1

- openSUSE Leap 42.1 (noarch):

glibc-html-2.19-19.1

glibc-i18ndata-2.19-19.1

glibc-info-2.19-19.1

- openSUSE Leap 42.1 (i586):

glibc-obsolete-2.19-19.1

glibc-obsolete-debuginfo-2.19-19.1

References

https://www.suse.com/security/cve/CVE-2014-9761.html

https://www.suse.com/security/cve/CVE-2015-7547.html

https://www.suse.com/security/cve/CVE-2015-8776.html

https://www.suse.com/security/cve/CVE-2015-8777.html

https://www.suse.com/security/cve/CVE-2015-8778.html

https://www.suse.com/security/cve/CVE-2015-8779.html

https://bugzilla.suse.com/950944

https://bugzilla.suse.com/955647

https://bugzilla.suse.com/956716

https://bugzilla.suse.com/958315

https://bugzilla.suse.com/961721

https://bugzilla.suse.com/962736

https://bugzilla.suse.com/962737

https://bugzilla.suse.com/962738

https://bugzilla.suse.com/962739

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:0490-1
Rating: important
Affected Products: openSUSE Leap 42.1

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow critical system update glibc openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.