Alerts This Week
Warning Icon 1 677
Alerts This Week
Warning Icon 1 677

openSUSE: 2019:2376-1 Important Update Addresses Procps Issues

opensuse
Calendar Grey October 26, 2019
Dist Opensuse Esm H88
openSUSE reveals a new security patch for procps addressing several vulnerabilities, notably critical buffer overflow threats.
An update that fixes 5 vulnerabilities is now available.

Description

This update for procps fixes the following issues:

procps was updated to 3.3.15. (bsc#1092100)

Following security issues were fixed:

- CVE-2018-1122: Prevent local privilege escalation in top. If a user ran

top with HOME unset in an attacker-controlled directory, the attacker

could have achieved privilege escalation by exploiting one of several

vulnerabilities in the config_file() function (bsc#1092100).

- CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow.

Inbuilt protection in ps maped a guard page at the end of the overflowed

buffer, ensuring that the impact of this flaw is limited to a crash

(temporary denial of service) (bsc#1092100).

- CVE-2018-1124: Prevent multiple integer overflows leading to a heap

corruption in file2strvec function. This allowed a privilege escalation

for a local attacker who can create entries in procfs by starting

processes, which could result in crashes or arbitrary...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-2376=1

Package List

- openSUSE Leap 15.1 (i586 x86_64):

libprocps7-3.3.15-lp151.6.3.1

libprocps7-debuginfo-3.3.15-lp151.6.3.1

procps-3.3.15-lp151.6.3.1

procps-debuginfo-3.3.15-lp151.6.3.1

procps-debugsource-3.3.15-lp151.6.3.1

procps-devel-3.3.15-lp151.6.3.1

References

https://www.suse.com/security/cve/CVE-2018-1122.html

https://www.suse.com/security/cve/CVE-2018-1123.html

https://www.suse.com/security/cve/CVE-2018-1124.html

https://www.suse.com/security/cve/CVE-2018-1125.html

https://www.suse.com/security/cve/CVE-2018-1126.html

https://bugzilla.suse.com/1092100

https://bugzilla.suse.com/1121753

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2019:2376-1
Rating: important
Affected Products: openSUSE Leap 15.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here