Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

SUSE Linux Enterprise: 2013:1520-1 Critical: IcedTea-Web Buffer Overflow

suse
Calendar Grey October 2, 2013
Scroller Suse
Urgent security patch released for icedtea-web addresses weaknesses in SUSE platforms. Instructions for applying the update are included.
An update that fixes two vulnerabilities is now available

Summary

This icedtea-web update adds a missing fix for an off-by-one heap-based buffer overflow. bnc#840572: CVE-2013-4349: icedtea-web 1.4.1 fixes the missing patch for CVE-2012-4540. Security Issues: * CVE-2012-4540 * CVE-2013-4349 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-icedtea-web-8358 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-icedtea-web-8357 To bring your system up-to-date, use "zypper patch". Package List:

Topics%20covered

Topics Covered

security advisory buffer overflow critical icedtea-web SUSE Linux Enterprise

References

#840572

Cross- CVE-2012-4540 CVE-2013-4349

Affected Products:

SUSE Linux Enterprise Desktop 11 SP3

SUSE Linux Enterprise Desktop 11 SP2

https://www.suse.com/security/cve/CVE-2012-4540.html

https://www.suse.com/security/cve/CVE-2013-4349.html

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2013:1520-1
Rating: critical

Topics%20covered

Topics Covered

security advisory buffer overflow critical icedtea-web SUSE Linux Enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.