Stay Secure with the Latest Linux Advisories

security advisorysecurity issuecritical

SUSE: 2015:0487-1 Critical: Shell Injection in osc Tool

An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available.. SUSE Security Update: Security update for osc ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0487-1 Rating: important References: #901643 Cross-References: CVE-2015-0778 Affected Products: SUSE Linux Enterprise Software Development Kit 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: osc was updated to fix a security issue and some non-security bugs. osc was updated to 0.151.0, fixing the following vulnerability: * fixed shell command injection via crafted _service files CVE-2015-0778 boo#901643 The following non-security bugs were fixed: * fix times when data comes from OBS backend * support updateing the link in target package for submit requests * various minor bugfixes Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-119=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (noarch): osc-0.151.0-8.1 References: https://www.suse.com/security/cve/CVE-2015-0778.html https://bugzilla.suse.com/show_bug.cgi?id=901643 . Crucial SUSE update enhances security for osc, addressing vulnerabilities related to shell command injection, thus fortifying system integrity.. SUSE Security Update, Shell Injection Issue, osc Tool Fix. . Severity: Important. LinuxSecurity.com Team

Mar 12, 2015 •Important SuSE