openSUSE Leap 42.3: 2019:0291-1 Important: Procps Security Advisory

This update for procps fixes the following security issues:

- CVE-2018-1122: Prevent local privilege escalation in top. If a user ran

top with HOME unset in an attacker-controlled directory, the attacker

could have achieved privilege escalation by exploiting one of several

vulnerabilities in the config_file() function (bsc#1092100).

- CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow.

Inbuilt protection in ps maped a guard page at the end of the overflowed

buffer, ensuring that the impact of this flaw is limited to a crash

(temporary denial of service) (bsc#1092100).

- CVE-2018-1124: Prevent multiple integer overflows leading to a heap

corruption in file2strvec function. This allowed a privilege escalation

for a local attacker who can create entries in procfs by starting

processes, which could result in crashes or arbitrary code execution in

proc utilities run by

other users (bsc#1092100).

...