Security update for tcmu-runner SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2601-1 Final 1 1 2017-09-29T12:45:48Z current 2017-09-29T12:45:48Z 2017-09-29T12:45:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tcmu-runner This update for tcmu-runner fixes the following issues: Security issues fixed: - CVE-2017-1000198: The glfs handler allowed local DoS via crafted CheckConfig strings (bsc#1049485) - CVE-2017-1000199: The qcow handler leaked information via the CheckConfig D-Bus method (bsc#1049491) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-RPI-12-SP2-2017-1611,SUSE-SLE-SDK-12-SP2-2017-1611,SUSE-SLE-SERVER-12-SP2-2017-1611 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172601-1/ Link for SUSE-SU-2017:2601-1 https://lists.suse.com/pipermail/sle-security-updates/2017-September/003265.html E-Mail link for SUSE-SU-2017:2601-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1049485 SUSE Bug 1049485 https://bugzilla.suse.com/1049491 SUSE Bug 1049491 https://www.suse.com/security/cve/CVE-2017-1000198/ SUSE CVE CVE-2017-1000198 page https://www.suse.com/security/cve/CVE-2017-1000199/ SUSE CVE CVE-2017-1000199 page SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 tcmu-runner-1.0.4-3.3.10 tcmu-runner-devel-1.0.4-3.3.10 tcmu-runner-1.0.4-3.3.10 as a component of SUSE Linux Enterprise Server 12 SP2 tcmu-runner-1.0.4-3.3.10 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 tcmu-runner-1.0.4-3.3.10 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 tcmu-runner-devel-1.0.4-3.3.10 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service CVE-2017-1000198 SUSE Linux Enterprise Server 12 SP2:tcmu-runner-1.0.4-3.3.10 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tcmu-runner-1.0.4-3.3.10 SUSE Linux Enterprise Server for SAP Applications 12 SP2:tcmu-runner-1.0.4-3.3.10 SUSE Linux Enterprise Software Development Kit 12 SP2:tcmu-runner-devel-1.0.4-3.3.10 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172601-1/ https://www.suse.com/security/cve/CVE-2017-1000198.html CVE-2017-1000198 https://bugzilla.suse.com/1049485 SUSE Bug 1049485 tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges. CVE-2017-1000199 SUSE Linux Enterprise Server 12 SP2:tcmu-runner-1.0.4-3.3.10 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tcmu-runner-1.0.4-3.3.10 SUSE Linux Enterprise Server for SAP Applications 12 SP2:tcmu-runner-1.0.4-3.3.10 SUSE Linux Enterprise Software Development Kit 12 SP2:tcmu-runner-devel-1.0.4-3.3.10 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172601-1/ https://www.suse.com/security/cve/CVE-2017-1000199.html CVE-2017-1000199 https://bugzilla.suse.com/1049491 SUSE Bug 1049491