SUSE-SU-2014:1214-1: critical: Security update for bash

sle-updates at lists.suse.com sle-updates at lists.suse.com
Wed Sep 24 17:05:37 MDT 2014


   SUSE Security Update: Security update for bash
______________________________________________________________________________

Announcement ID:    SUSE-SU-2014:1214-1
Rating:             critical
References:         #688469 #770795 #896776 
Cross-References:   CVE-2012-3410 CVE-2014-0475
Affected Products:
                    SUSE Linux Enterprise Server 10 SP3 LTSS
______________________________________________________________________________

   An update that solves two vulnerabilities and has one
   errata is now available.

Description:


   bash has been updated to fix a critical security issue.

   In some circumstances, the shell would evaluate shellcode in environment
   variables passed at startup time. This allowed code execution by local or
   remote attackers who could pass environment variables to bash scripts.
   (CVE-2014-6271)

   Additionally, the following bugs have been fixed:

       * Avoid possible buffer overflow when expanding the /dev/fd prefix
         with e.g. the test built-in. (CVE-2012-3410)
       * Enable workaround for changed behavior of sshd. (bnc#688469)

   Security Issues:

       * CVE-2014-6271
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271>
       * CVE-2012-3410
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3410>



Package List:

   - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64):

      bash-3.1-24.32.1
      readline-5.1-24.32.1
      readline-devel-5.1-24.32.1

   - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64):

      readline-32bit-5.1-24.32.1
      readline-devel-32bit-5.1-24.32.1


References:

   http://support.novell.com/security/cve/CVE-2012-3410.html
   http://support.novell.com/security/cve/CVE-2014-0475.html
   https://bugzilla.suse.com/688469
   https://bugzilla.suse.com/770795
   https://bugzilla.suse.com/896776
   http://download.suse.com/patch/finder/?keywords=fd9fa24daf4d325c609035f0c778a723



More information about the sle-updates mailing list