This update for sccache fixes the following issues: Update to version 0.4.2. CVE-2021-45710: Fixed a segmentation fault due to data race in tokio crate.. # Security update for sccache Announcement ID: SUSE-SU-2023:3526-1 Rating: important References: * #1181400 * #1194119 * #1196972 * #1208553 * #1212407 Cross-References: * CVE-2021-45710 * CVE-2022-24713 * CVE-2022-31394 * CVE-2023-1521 CVSS scores: * CVE-2021-45710 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2021-45710 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2022-24713 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2022-24713 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-31394 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2022-31394 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-1521 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves four vulnerabilities and has one security fix can now be installed. ## Description: This update for sccache fixes the following issues: * Update to version 0.4.2. * CVE-2021-45710: Fixed a segmentation fault due to data race in tokio crate. (bsc#1194119) * CVE-2022-24713: Fixed aReDoS issue due to vulnerable regex crate. (bsc#1196972) * CVE-2022-31394: Fixed a DoS issue due to the max header list size not settable. (bsc#1208553) * CVE-2023-1521: Fixed a local privilege escalation. (bsc#1212407) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3526=1 openSUSE-SLE-15.4-2023-3526=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3526=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3526=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3526=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * sccache-0.4.2~3-150400.3.3.1 * sccache-debuginfo-0.4.2~3-150400.3.3.1 * openSUSE Leap 15.5 (aarch64 x86_64) * sccache-0.4.2~3-150400.3.3.1 * sccache-debuginfo-0.4.2~3-150400.3.3.1 * Development Tools Module 15-SP4 (aarch64 x86_64) * sccache-0.4.2~3-150400.3.3.1 * sccache-debuginfo-0.4.2~3-150400.3.3.1 * Development Tools Module 15-SP5 (aarch64 x86_64) * sccache-0.4.2~3-150400.3.3.1 * sccache-debuginfo-0.4.2~3-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2021-45710.html * https://www.suse.com/security/cve/CVE-2022-24713.html * https://www.suse.com/security/cve/CVE-2022-31394.html * https://www.suse.com/security/cve/CVE-2023-1521.html * https://bugzilla.suse.com/show_bug.cgi?id=1181400 * https://bugzilla.suse.com/show_bug.cgi?id=1194119 * https://bugzilla.suse.com/show_bug.cgi?id=1196972 * https://bugzilla.suse.com/show_bug.cgi?id=1208553 * https://bugzilla.suse.com/show_bug.cgi?id=1212407 . The latest security advisory for sccache highlights urgent vulnerabilities, notably a segmentation fault and an escalation of localprivileges that demand immediate attention.. sccache Issues, SUSE Update, Important Security Fixes. . Severity: Important. LinuxSecurity.com Team
Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2013:1166-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2013:1166.html Issue date: 2013-08-20 CVE Names: CVE-2013-2147 CVE-2013-2164 CVE-2013-2206 CVE-2013-2224 CVE-2013-2232 CVE-2013-2234 CVE-2013-2237 ==================================================================== 1. Summary: Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * A flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled duplicate cookies. If a local user queried SCTP connection information at the same time a remote attacker has initialized a crafted SCTP connection to the system, it could trigger a NULL pointer dereference, causing the system to crash. (CVE-2013-2206, Important) * It was found that the fix for CVE-2012-3552 released via RHSA-2012:1540 introduced an invalid free flaw in the Linuxkernel's TCP/IP protocol suite implementation. A local, unprivileged user could use this flaw to corrupt kernel memory via crafted sendmsg() calls, allowing them to cause a denial of service or, potentially, escalate their privileges on the system. (CVE-2013-2224, Important) * An invalid pointer dereference flaw was found in the Linux kernel's TCP/IP protocol suite implementation. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system by using sendmsg() with an IPv6 socket connected to an IPv4 destination. (CVE-2013-2232, Moderate) * Information leak flaws in the Linux kernel could allow a privileged, local user to leak kernel memory to user-space. (CVE-2013-2164, CVE-2013-2147, CVE-2013-2234, CVE-2013-2237, Low) This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section. Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. 5. Bugs fixed (http://bugzilla.redhat.com/): 971242 - CVE-2013-2147 Kernel: cpqarray/cciss: information leak via ioctl 973100 - CVE-2013-2164 Kernel: information leak in cdrom driver 976562 - CVE-2013-2206 kernel: sctp: duplicate cookie handling NULL pointer dereference 979936 - CVE-2013-2224 kernel: net: IP_REPOPTS invalid free 980995 -CVE-2013-2234 Kernel: net: information leak in AF_KEY notify 981220 - CVE-2013-2237 Kernel: net: af_key: initialize satype in key_notify_policy_flush 981552 - CVE-2013-2232 Kernel: ipv6: using ipv4 vs ipv6 structure during routing lookup in sendmsg 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: kernel-2.6.18-348.16.1.el5.i686.rpm kernel-PAE-2.6.18-348.16.1.el5.i686.rpm kernel-PAE-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-PAE-devel-2.6.18-348.16.1.el5.i686.rpm kernel-debug-2.6.18-348.16.1.el5.i686.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-debug-devel-2.6.18-348.16.1.el5.i686.rpm kernel-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.i686.rpm kernel-devel-2.6.18-348.16.1.el5.i686.rpm kernel-headers-2.6.18-348.16.1.el5.i386.rpm kernel-xen-2.6.18-348.16.1.el5.i686.rpm kernel-xen-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-xen-devel-2.6.18-348.16.1.el5.i686.rpm noarch: kernel-doc-2.6.18-348.16.1.el5.noarch.rpm x86_64: kernel-2.6.18-348.16.1.el5.x86_64.rpm kernel-debug-2.6.18-348.16.1.el5.x86_64.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.x86_64.rpm kernel-debug-devel-2.6.18-348.16.1.el5.x86_64.rpm kernel-debuginfo-2.6.18-348.16.1.el5.x86_64.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.x86_64.rpm kernel-devel-2.6.18-348.16.1.el5.x86_64.rpm kernel-headers-2.6.18-348.16.1.el5.x86_64.rpm kernel-xen-2.6.18-348.16.1.el5.x86_64.rpm kernel-xen-debuginfo-2.6.18-348.16.1.el5.x86_64.rpm kernel-xen-devel-2.6.18-348.16.1.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: kernel-2.6.18-348.16.1.el5.i686.rpm kernel-PAE-2.6.18-348.16.1.el5.i686.rpm kernel-PAE-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-PAE-devel-2.6.18-348.16.1.el5.i686.rpm kernel-debug-2.6.18-348.16.1.el5.i686.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-debug-devel-2.6.18-348.16.1.el5.i686.rpm kernel-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.i686.rpm kernel-devel-2.6.18-348.16.1.el5.i686.rpm kernel-headers-2.6.18-348.16.1.el5.i386.rpm kernel-xen-2.6.18-348.16.1.el5.i686.rpm kernel-xen-debuginfo-2.6.18-348.16.1.el5.i686.rpm kernel-xen-devel-2.6.18-348.16.1.el5.i686.rpm ia64: kernel-2.6.18-348.16.1.el5.ia64.rpm kernel-debug-2.6.18-348.16.1.el5.ia64.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.ia64.rpm kernel-debug-devel-2.6.18-348.16.1.el5.ia64.rpm kernel-debuginfo-2.6.18-348.16.1.el5.ia64.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.ia64.rpm kernel-devel-2.6.18-348.16.1.el5.ia64.rpm kernel-headers-2.6.18-348.16.1.el5.ia64.rpm kernel-xen-2.6.18-348.16.1.el5.ia64.rpm kernel-xen-debuginfo-2.6.18-348.16.1.el5.ia64.rpm kernel-xen-devel-2.6.18-348.16.1.el5.ia64.rpm noarch: kernel-doc-2.6.18-348.16.1.el5.noarch.rpm ppc: kernel-2.6.18-348.16.1.el5.ppc64.rpm kernel-debug-2.6.18-348.16.1.el5.ppc64.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.ppc64.rpm kernel-debug-devel-2.6.18-348.16.1.el5.ppc64.rpm kernel-debuginfo-2.6.18-348.16.1.el5.ppc64.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.ppc64.rpm kernel-devel-2.6.18-348.16.1.el5.ppc64.rpm kernel-headers-2.6.18-348.16.1.el5.ppc.rpm kernel-headers-2.6.18-348.16.1.el5.ppc64.rpm kernel-kdump-2.6.18-348.16.1.el5.ppc64.rpm kernel-kdump-debuginfo-2.6.18-348.16.1.el5.ppc64.rpm kernel-kdump-devel-2.6.18-348.16.1.el5.ppc64.rpm s390x: kernel-2.6.18-348.16.1.el5.s390x.rpm kernel-debug-2.6.18-348.16.1.el5.s390x.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.s390x.rpm kernel-debug-devel-2.6.18-348.16.1.el5.s390x.rpm kernel-debuginfo-2.6.18-348.16.1.el5.s390x.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.s390x.rpm kernel-devel-2.6.18-348.16.1.el5.s390x.rpm kernel-headers-2.6.18-348.16.1.el5.s390x.rpm kernel-kdump-2.6.18-348.16.1.el5.s390x.rpm kernel-kdump-debuginfo-2.6.18-348.16.1.el5.s390x.rpm kernel-kdump-devel-2.6.18-348.16.1.el5.s390x.rpm x86_64: kernel-2.6.18-348.16.1.el5.x86_64.rpm kernel-debug-2.6.18-348.16.1.el5.x86_64.rpm kernel-debug-debuginfo-2.6.18-348.16.1.el5.x86_64.rpm kernel-debug-devel-2.6.18-348.16.1.el5.x86_64.rpm kernel-debuginfo-2.6.18-348.16.1.el5.x86_64.rpm kernel-debuginfo-common-2.6.18-348.16.1.el5.x86_64.rpm kernel-devel-2.6.18-348.16.1.el5.x86_64.rpm kernel-headers-2.6.18-348.16.1.el5.x86_64.rpm kernel-xen-2.6.18-348.16.1.el5.x86_64.rpm kernel-xen-debuginfo-2.6.18-348.16.1.el5.x86_64.rpm kernel-xen-devel-2.6.18-348.16.1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2013-2147 https://access.redhat.com/security/cve/CVE-2013-2164 https://access.redhat.com/security/cve/CVE-2013-2206 https://access.redhat.com/security/cve/CVE-2013-2224 https://access.redhat.com/security/cve/CVE-2013-2232 https://access.redhat.com/security/cve/CVE-2013-2234 https://access.redhat.com/security/cve/CVE-2013-2237 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/errata/RHSA-2012:1540.html https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/5.9_Technical_Notes/kernel.html 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. . Kernel updates for Red Hat address vulnerabilities and various bugs. Information on serious threats and the process for updating is provided.. Red Hat Security Advisory, Kernel Package Update, Critical System Fixes. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.