Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

SUSE Linux Enterprise 11 SP3 SUSE-SU-2014:1125-1 Critical Glibc Exploit

suse
Calendar Grey September 13, 2014
Scroller Suse
SUSE Security Update for openssl: crucial update tackling severe vulnerabilities and enhancing overall stability.
An update that solves one vulnerability and has two fixes An update that solves one vulnerability and has two fixes An update that solves one vulnerability and has two fixes is now...

Summary

This glibc update fixes a critical privilege escalation problem and two non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv. * bnc#888347: printf-multibyte-format.patch: Don't parse %s format argument as multi-byte string. Security Issues: * CVE-2014-5119 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-glibc-9669

Topics%20covered

Topics Covered

security advisory buffer overflow privilege escalation critical update SUSE Linux glibc exploit

References

#888347 #892065 #892073

Cross- CVE-2014-5119

Affected Products:

SUSE Linux Enterprise Software Development Kit 11 SP3

SUSE Linux Enterprise Server 11 SP3 for VMware

SUSE Linux Enterprise Server 11 SP3

SUSE Linux Enterprise Desktop 11 SP3

https://www.suse.com/security/cve/CVE-2014-5119.html

https://scc.suse.com:443/patches/

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2014:1125-1
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow privilege escalation critical update SUSE Linux glibc exploit

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.