SUSE: 2018:1130-1 Important: Corosync Integer Overflow Critical Threat
suse
May 2, 2018
An update that solves one vulnerability and has three fixes is now available.
Summary
This update for corosync provides the following fixes: - CVE-2018-1084: Integer overflow in totemcrypto:authenticate_nss_2_3() could lead to command execution (bsc#1089346) - Providing an empty uid or gid results in coroparse adding uid 0. (bsc#1066585) - Fix a problem that was causing corosync memory to increase on ring breakup. (bsc#1083030) - Fix a problem with configuration file incompatibilities that was causing corosync to not work after upgrading from SLE-11-SP4-HA to SLE-12/15-HA. (bsc#1083561) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Availability 12-SP2:
Topics Covered
References
#1066585 #1083030 #1083561 #1089346
Cross- CVE-2018-1084
Affected Products:
SUSE Linux Enterprise High Availability 12-SP2
https://www.suse.com/security/cve/CVE-2018-1084.html
https://bugzilla.suse.com/1066585
https://bugzilla.suse.com/1083030
https://bugzilla.suse.com/1083561
https://bugzilla.suse.com/1089346
--
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Announcement ID: SUSE-SU-2018:1130-1
Rating: important
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!