Security update for glibc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0470-1 Final 1 1 2016-02-16T15:37:56Z current 2016-02-16T15:37:56Z 2016-02-16T15:37:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for glibc This update for glibc fixes the following issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) - CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal (bsc#830257) - CVE-2013-4458: Stack (frame) overflow in getaddrinfo() when called with AF_INET6 (bsc#847227) - CVE-2014-8121: denial of service issue in the NSS backends (bsc#918187) - bsc#920338: Read past end of pattern in fnmatch - CVE-2015-1781: buffer overflow in nss_dns (bsc#927080) The following non-security bugs were fixed: - bnc#892065: SIGSEV tst-setlocale3 in glibc-2.11.3-17.68.1 - bnc#863499: Memory leak in getaddrinfo when many RRs are returned - bsc#892065: Avoid unbound alloca in setenv - bsc#945779: Properly reread entry after failure in nss_files getent function The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp2-glibc-12405 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ Link for SUSE-SU-2016:0470-1 https://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html E-Mail link for SUSE-SU-2016:0470-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/830257 SUSE Bug 830257 https://bugzilla.suse.com/847227 SUSE Bug 847227 https://bugzilla.suse.com/863499 SUSE Bug 863499 https://bugzilla.suse.com/892065 SUSE Bug 892065 https://bugzilla.suse.com/918187 SUSE Bug 918187 https://bugzilla.suse.com/920338 SUSE Bug 920338 https://bugzilla.suse.com/927080 SUSE Bug 927080 https://bugzilla.suse.com/945779 SUSE Bug 945779 https://bugzilla.suse.com/950944 SUSE Bug 950944 https://bugzilla.suse.com/961721 SUSE Bug 961721 https://bugzilla.suse.com/962736 SUSE Bug 962736 https://bugzilla.suse.com/962737 SUSE Bug 962737 https://bugzilla.suse.com/962738 SUSE Bug 962738 https://bugzilla.suse.com/962739 SUSE Bug 962739 https://www.suse.com/security/cve/CVE-2013-2207/ SUSE CVE CVE-2013-2207 page https://www.suse.com/security/cve/CVE-2013-4458/ SUSE CVE CVE-2013-4458 page https://www.suse.com/security/cve/CVE-2014-8121/ SUSE CVE CVE-2014-8121 page https://www.suse.com/security/cve/CVE-2014-9761/ SUSE CVE CVE-2014-9761 page https://www.suse.com/security/cve/CVE-2015-1781/ SUSE CVE CVE-2015-1781 page https://www.suse.com/security/cve/CVE-2015-7547/ SUSE CVE CVE-2015-7547 page https://www.suse.com/security/cve/CVE-2015-8776/ SUSE CVE CVE-2015-8776 page https://www.suse.com/security/cve/CVE-2015-8777/ SUSE CVE CVE-2015-8777 page https://www.suse.com/security/cve/CVE-2015-8778/ SUSE CVE CVE-2015-8778 page https://www.suse.com/security/cve/CVE-2015-8779/ SUSE CVE CVE-2015-8779 page SUSE Linux Enterprise Server 11 SP2-LTSS glibc-2.11.3-17.45.66.1 glibc-32bit-2.11.3-17.45.66.1 glibc-devel-2.11.3-17.45.66.1 glibc-devel-32bit-2.11.3-17.45.66.1 glibc-html-2.11.3-17.45.66.1 glibc-i18ndata-2.11.3-17.45.66.1 glibc-info-2.11.3-17.45.66.1 glibc-locale-2.11.3-17.45.66.1 glibc-locale-32bit-2.11.3-17.45.66.1 glibc-profile-2.11.3-17.45.66.1 glibc-profile-32bit-2.11.3-17.45.66.1 nscd-2.11.3-17.45.66.1 glibc-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-32bit-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-devel-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-devel-32bit-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-html-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-i18ndata-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-info-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-locale-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-locale-32bit-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-profile-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS glibc-profile-32bit-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS nscd-2.11.3-17.45.66.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system. CVE-2013-2207 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 moderate 4 AV:N/AC:H/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2013-2207.html CVE-2013-2207 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/830257 SUSE Bug 830257 https://bugzilla.suse.com/979109 SUSE Bug 979109 Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914. CVE-2013-4458 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2013-4458.html CVE-2013-4458 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/847227 SUSE Bug 847227 https://bugzilla.suse.com/883217 SUSE Bug 883217 https://bugzilla.suse.com/941444 SUSE Bug 941444 https://bugzilla.suse.com/955181 SUSE Bug 955181 https://bugzilla.suse.com/967023 SUSE Bug 967023 https://bugzilla.suse.com/980483 SUSE Bug 980483 DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset. CVE-2014-8121 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2014-8121.html CVE-2014-8121 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/918187 SUSE Bug 918187 https://bugzilla.suse.com/945779 SUSE Bug 945779 Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function. CVE-2014-9761 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2014-9761.html CVE-2014-9761 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/962738 SUSE Bug 962738 https://bugzilla.suse.com/986086 SUSE Bug 986086 Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer. CVE-2015-1781 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2015-1781.html CVE-2015-1781 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/927080 SUSE Bug 927080 https://bugzilla.suse.com/979109 SUSE Bug 979109 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. CVE-2015-7547 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2015-7547.html CVE-2015-7547 https://bugzilla.suse.com/1077097 SUSE Bug 1077097 https://bugzilla.suse.com/847227 SUSE Bug 847227 https://bugzilla.suse.com/961721 SUSE Bug 961721 https://bugzilla.suse.com/967023 SUSE Bug 967023 https://bugzilla.suse.com/967061 SUSE Bug 967061 https://bugzilla.suse.com/967072 SUSE Bug 967072 https://bugzilla.suse.com/967496 SUSE Bug 967496 https://bugzilla.suse.com/969216 SUSE Bug 969216 https://bugzilla.suse.com/969241 SUSE Bug 969241 https://bugzilla.suse.com/969591 SUSE Bug 969591 https://bugzilla.suse.com/986086 SUSE Bug 986086 The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value. CVE-2015-8776 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2015-8776.html CVE-2015-8776 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/962736 SUSE Bug 962736 https://bugzilla.suse.com/986086 SUSE Bug 986086 The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable. CVE-2015-8777 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 important 3.5 AV:L/AC:H/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2015-8777.html CVE-2015-8777 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/950944 SUSE Bug 950944 https://bugzilla.suse.com/962735 SUSE Bug 962735 Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access. CVE-2015-8778 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2015-8778.html CVE-2015-8778 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/962737 SUSE Bug 962737 https://bugzilla.suse.com/986086 SUSE Bug 986086 Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name. CVE-2015-8779 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-devel-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-html-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-i18ndata-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-info-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-locale-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:glibc-profile-32bit-2.11.3-17.45.66.1 SUSE Linux Enterprise Server 11 SP2-LTSS:nscd-2.11.3-17.45.66.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/ https://www.suse.com/security/cve/CVE-2015-8779.html CVE-2015-8779 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/962739 SUSE Bug 962739 https://bugzilla.suse.com/965453 SUSE Bug 965453 https://bugzilla.suse.com/986086 SUSE Bug 986086