Security update for glibc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0071-1 Final 1 1 2018-01-12T08:46:45Z current 2018-01-12T08:46:45Z 2018-01-12T08:46:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for glibc This update for glibc fixes the following issues: - A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2018-56,SUSE-SLE-SAP-12-SP1-2018-56,SUSE-SLE-SERVER-12-SP1-2018-56 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180071-1/ Link for SUSE-SU-2018:0071-1 https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00035.html E-Mail link for SUSE-SU-2018:0071-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1074293 SUSE Bug 1074293 https://www.suse.com/security/cve/CVE-2018-1000001/ SUSE CVE CVE-2018-1000001 page SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE OpenStack Cloud 6 glibc-2.19-40.9.5 glibc-32bit-2.19-40.9.5 glibc-devel-2.19-40.9.5 glibc-devel-32bit-2.19-40.9.5 glibc-html-2.19-40.9.5 glibc-i18ndata-2.19-40.9.5 glibc-info-2.19-40.9.5 glibc-locale-2.19-40.9.5 glibc-locale-32bit-2.19-40.9.5 glibc-profile-2.19-40.9.5 glibc-profile-32bit-2.19-40.9.5 nscd-2.19-40.9.5 glibc-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-devel-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-devel-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-html-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-i18ndata-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-info-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-locale-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-locale-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-profile-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-profile-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS nscd-2.19-40.9.5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS glibc-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-devel-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-devel-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-html-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-i18ndata-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-info-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-locale-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-locale-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-profile-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-profile-32bit-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 nscd-2.19-40.9.5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 glibc-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-32bit-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-devel-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-devel-32bit-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-html-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-i18ndata-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-info-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-locale-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-locale-32bit-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-profile-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 glibc-profile-32bit-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 nscd-2.19-40.9.5 as a component of SUSE OpenStack Cloud 6 In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. CVE-2018-1000001 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-32bit-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-devel-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-devel-32bit-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-html-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-i18ndata-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-info-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-locale-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-locale-32bit-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-profile-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:glibc-profile-32bit-2.19-40.9.5 SUSE Linux Enterprise Server 12 SP1-LTSS:nscd-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-32bit-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-devel-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-devel-32bit-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-html-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-i18ndata-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-info-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-locale-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-locale-32bit-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-profile-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:glibc-profile-32bit-2.19-40.9.5 SUSE Linux Enterprise Server for SAP Applications 12 SP1:nscd-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-32bit-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-devel-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-devel-32bit-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-html-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-i18ndata-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-info-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-locale-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-locale-32bit-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-profile-2.19-40.9.5 SUSE OpenStack Cloud 6:glibc-profile-32bit-2.19-40.9.5 SUSE OpenStack Cloud 6:nscd-2.19-40.9.5 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180071-1/ https://www.suse.com/security/cve/CVE-2018-1000001.html CVE-2018-1000001 https://bugzilla.suse.com/1074293 SUSE Bug 1074293 https://bugzilla.suse.com/1099047 SUSE Bug 1099047 https://bugzilla.suse.com/1123874 SUSE Bug 1123874