Security update for bash SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2872-1 Final 1 1 2016-11-22T11:12:17Z current 2016-11-22T11:12:17Z 2016-11-22T11:12:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bash This update for bash fixes the following issues: - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables (bsc#1001299) - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the prompt (bsc#1000396) - CVE-2014-6277: More troubles with functions (bsc#898812, bsc#1001759) - CVE-2014-6278: Code execution after original 6271 fix (bsc#898884) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2016-1681,SUSE-SLE-SDK-12-SP1-2016-1681,SUSE-SLE-SERVER-12-SP1-2016-1681,SUSE-SLE-WE-12-SP1-2016-1681 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162872-1/ Link for SUSE-SU-2016:2872-1 https://lists.suse.com/pipermail/sle-security-updates/2016-November/002410.html E-Mail link for SUSE-SU-2016:2872-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000396 SUSE Bug 1000396 https://bugzilla.suse.com/1001299 SUSE Bug 1001299 https://bugzilla.suse.com/1001759 SUSE Bug 1001759 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://www.suse.com/security/cve/CVE-2014-6277/ SUSE CVE CVE-2014-6277 page https://www.suse.com/security/cve/CVE-2014-6278/ SUSE CVE CVE-2014-6278 page https://www.suse.com/security/cve/CVE-2016-0634/ SUSE CVE CVE-2016-0634 page https://www.suse.com/security/cve/CVE-2016-7543/ SUSE CVE CVE-2016-7543 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Workstation Extension 12 SP1 bash-4.2-82.1 bash-doc-4.2-82.1 bash-lang-4.2-82.1 libreadline6-6.2-82.1 libreadline6-32bit-6.2-82.1 readline-doc-6.2-82.1 bash-devel-4.2-82.1 readline-devel-6.2-82.1 bash-4.2-82.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 bash-doc-4.2-82.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 bash-lang-4.2-82.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libreadline6-6.2-82.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libreadline6-32bit-6.2-82.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 readline-doc-6.2-82.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 bash-4.2-82.1 as a component of SUSE Linux Enterprise Server 12 SP1 bash-doc-4.2-82.1 as a component of SUSE Linux Enterprise Server 12 SP1 libreadline6-6.2-82.1 as a component of SUSE Linux Enterprise Server 12 SP1 libreadline6-32bit-6.2-82.1 as a component of SUSE Linux Enterprise Server 12 SP1 readline-doc-6.2-82.1 as a component of SUSE Linux Enterprise Server 12 SP1 bash-4.2-82.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 bash-doc-4.2-82.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libreadline6-6.2-82.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libreadline6-32bit-6.2-82.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 readline-doc-6.2-82.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 bash-devel-4.2-82.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 readline-devel-6.2-82.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 bash-lang-4.2-82.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. CVE-2014-6277 SUSE Linux Enterprise Desktop 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-lang-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:bash-devel-4.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:readline-devel-6.2-82.1 SUSE Linux Enterprise Workstation Extension 12 SP1:bash-lang-4.2-82.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162872-1/ https://www.suse.com/security/cve/CVE-2014-6277.html CVE-2014-6277 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/900127 SUSE Bug 900127 https://bugzilla.suse.com/900454 SUSE Bug 900454 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. CVE-2014-6278 SUSE Linux Enterprise Desktop 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-lang-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:bash-devel-4.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:readline-devel-6.2-82.1 SUSE Linux Enterprise Workstation Extension 12 SP1:bash-lang-4.2-82.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162872-1/ https://www.suse.com/security/cve/CVE-2014-6278.html CVE-2014-6278 https://bugzilla.suse.com/898604 SUSE Bug 898604 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/900127 SUSE Bug 900127 The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. CVE-2016-0634 SUSE Linux Enterprise Desktop 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-lang-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:bash-devel-4.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:readline-devel-6.2-82.1 SUSE Linux Enterprise Workstation Extension 12 SP1:bash-lang-4.2-82.1 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162872-1/ https://www.suse.com/security/cve/CVE-2016-0634.html CVE-2016-0634 https://bugzilla.suse.com/1000396 SUSE Bug 1000396 https://bugzilla.suse.com/1001299 SUSE Bug 1001299 https://bugzilla.suse.com/1159416 SUSE Bug 1159416 https://bugzilla.suse.com/1188388 SUSE Bug 1188388 Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. CVE-2016-7543 SUSE Linux Enterprise Desktop 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:bash-lang-4.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Desktop 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-doc-4.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-32bit-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-6.2-82.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:readline-doc-6.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:bash-devel-4.2-82.1 SUSE Linux Enterprise Software Development Kit 12 SP1:readline-devel-6.2-82.1 SUSE Linux Enterprise Workstation Extension 12 SP1:bash-lang-4.2-82.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162872-1/ https://www.suse.com/security/cve/CVE-2016-7543.html CVE-2016-7543 https://bugzilla.suse.com/1001299 SUSE Bug 1001299 https://bugzilla.suse.com/1159416 SUSE Bug 1159416