Stay Secure with the Latest Linux Advisories

security advisorycriticalsoftware update

SUSE: 2017:1815-1 Critical: Ncurses RCE Vulnerabilities Resolved

An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.. SUSE Security Update: Recommended update for ncurses ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1815-1 Rating: important References: #1000662 #1046853 #1046858 Cross-References: CVE-2017-10684 CVE-2017-10685 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-10684: Possible RCE via stack-based buffer overflow in the fmt_entry function. (bsc#1046858) - CVE-2017-10685: Possible RCE with format string vulnerability in the fmt_entry function. (bsc#1046853) Bugfixes: - Drop patch ncurses-5.9-environment.dif as YaST2 ncurses GUI does not need it anymore and as well as it causes bug bsc#1000662 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1119=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1119=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1119=1 - SUSE Linux Enterprise Desktop 12-SP2: zypperin -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1119=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1119=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): ncurses-debugsource-5.9-44.1 ncurses-devel-5.9-44.1 ncurses-devel-debuginfo-5.9-44.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libncurses5-5.9-44.1 libncurses5-debuginfo-5.9-44.1 libncurses6-5.9-44.1 libncurses6-debuginfo-5.9-44.1 ncurses-debugsource-5.9-44.1 ncurses-devel-5.9-44.1 ncurses-devel-debuginfo-5.9-44.1 ncurses-utils-5.9-44.1 ncurses-utils-debuginfo-5.9-44.1 tack-5.9-44.1 tack-debuginfo-5.9-44.1 terminfo-5.9-44.1 terminfo-base-5.9-44.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): libncurses5-5.9-44.1 libncurses5-debuginfo-5.9-44.1 libncurses6-5.9-44.1 libncurses6-debuginfo-5.9-44.1 ncurses-debugsource-5.9-44.1 ncurses-devel-5.9-44.1 ncurses-devel-debuginfo-5.9-44.1 ncurses-utils-5.9-44.1 ncurses-utils-debuginfo-5.9-44.1 tack-5.9-44.1 tack-debuginfo-5.9-44.1 terminfo-5.9-44.1 terminfo-base-5.9-44.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libncurses5-32bit-5.9-44.1 libncurses5-debuginfo-32bit-5.9-44.1 libncurses6-32bit-5.9-44.1 libncurses6-debuginfo-32bit-5.9-44.1 ncurses-devel-32bit-5.9-44.1 ncurses-devel-debuginfo-32bit-5.9-44.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libncurses5-32bit-5.9-44.1 libncurses5-5.9-44.1 libncurses5-debuginfo-32bit-5.9-44.1 libncurses5-debuginfo-5.9-44.1 libncurses6-32bit-5.9-44.1 libncurses6-5.9-44.1 libncurses6-debuginfo-32bit-5.9-44.1 libncurses6-debuginfo-5.9-44.1 ncurses-debugsource-5.9-44.1 ncurses-devel-5.9-44.1 ncurses-devel-debuginfo-5.9-44.1 ncurses-utils-5.9-44.1 ncurses-utils-debuginfo-5.9-44.1 tack-5.9-44.1 tack-debuginfo-5.9-44.1 terminfo-5.9-44.1 terminfo-base-5.9-44.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): libncurses5-5.9-44.1 libncurses5-debuginfo-5.9-44.1 libncurses6-5.9-44.1 libncurses6-debuginfo-5.9-44.1 ncurses-debugsource-5.9-44.1 ncurses-utils-5.9-44.1 ncurses-utils-debuginfo-5.9-44.1 terminfo-base-5.9-44.1 References: https://www.suse.com/security/cve/CVE-2017-10684.html https://www.suse.com/security/cve/CVE-2017-10685.html https://bugzilla.suse.com/1000662 https://bugzilla.suse.com/1046853 https://bugzilla.suse.com/1046858 . Enhance ncurses on SUSE Linux to fix vulnerabilities that may result in remote code execution.. SUSE Linux, ncurses update, critical security, remote coding, software stability. . Severity: Critical. LinuxSecurity.com Team

Jul 07, 2017 •Critical SuSE