Security update for bash SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2976-1 Final 1 1 2019-11-14T17:46:44Z current 2019-11-14T17:46:44Z 2019-11-14T17:46:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bash This update for bash fixes the following issues: - CVE-2012-6711: Fixed a heap-based buffer overflow during echo of unsupported characters (bsc#1138676). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2976,SUSE-SLE-SAP-12-SP1-2019-2976,SUSE-SLE-SERVER-12-SP1-2019-2976 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192976-1/ Link for SUSE-SU-2019:2976-1 https://lists.suse.com/pipermail/sle-security-updates/2019-November/006142.html E-Mail link for SUSE-SU-2019:2976-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1138676 SUSE Bug 1138676 https://www.suse.com/security/cve/CVE-2012-6711/ SUSE CVE CVE-2012-6711 page SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP1 bash-4.2-83.6.1 bash-devel-4.2-83.6.1 bash-doc-4.2-83.6.1 bash-lang-4.2-83.6.1 bash-loadables-4.2-83.6.1 libreadline6-6.2-83.6.1 libreadline6-32bit-6.2-83.6.1 libreadline6-64bit-6.2-83.6.1 readline-devel-6.2-83.6.1 readline-devel-32bit-6.2-83.6.1 readline-devel-64bit-6.2-83.6.1 readline-doc-6.2-83.6.1 bash-4.2-83.6.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS bash-doc-4.2-83.6.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS libreadline6-6.2-83.6.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS libreadline6-32bit-6.2-83.6.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS readline-doc-6.2-83.6.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS bash-4.2-83.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 bash-doc-4.2-83.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libreadline6-6.2-83.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libreadline6-32bit-6.2-83.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 readline-doc-6.2-83.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv(). CVE-2012-6711 SUSE Linux Enterprise Server 12 SP1-LTSS:bash-4.2-83.6.1 SUSE Linux Enterprise Server 12 SP1-LTSS:bash-doc-4.2-83.6.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libreadline6-32bit-6.2-83.6.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libreadline6-6.2-83.6.1 SUSE Linux Enterprise Server 12 SP1-LTSS:readline-doc-6.2-83.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-4.2-83.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:bash-doc-4.2-83.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-32bit-6.2-83.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libreadline6-6.2-83.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:readline-doc-6.2-83.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192976-1/ https://www.suse.com/security/cve/CVE-2012-6711.html CVE-2012-6711 https://bugzilla.suse.com/1138676 SUSE Bug 1138676