SUSE-SU-2015:0526-1

Dashboard / Vulnerabilities / SUSE-SU-2015:0526-1

SUSE-SU-2015:0526-1

Summary: Security update for glibc

Details: glibc has been updated to fix four security issues. These security issues were fixed: - CVE-2014-7817: The wordexp function in GNU C Library (aka glibc) 2.21 did not enforce the WRDE_NOCMD flag, which allowed context-dependent attackers to execute arbitrary commands, as demonstrated by input containing '$((`...`))' (bnc#906371). - CVE-2015-1472: Heap buffer overflow in glibc swscanf (bnc#916222). - CVE-2014-9402: Denial of service in getnetbyname function (bnc#910599). - CVE-2013-7423: Getaddrinfo() writes DNS queries to random file descriptors under high load (bnc#915526). These non-security issues were fixed: - Fix infinite loop in check_pf (bsc#909053) - Restore warning about execution permission, it is still needed for noexec mounts (bsc#915985). - Don't touch user-controlled stdio locks in forked child (bsc#864081) - Don't use gcc extensions for non-gcc compilers (bsc#905313)

References: https://www.suse.com/support/update/announcement/2015/suse-su-20150526-1/, https://bugzilla.suse.com/864081, https://bugzilla.suse.com/905313, https://bugzilla.suse.com/906371, https://bugzilla.suse.com/909053, https://bugzilla.suse.com/910599, https://bugzilla.suse.com/915526, https://bugzilla.suse.com/915985, https://bugzilla.suse.com/916222, https://www.suse.com/security/cve/CVE-2013-7423, https://www.suse.com/security/cve/CVE-2014-7817, https://www.suse.com/security/cve/CVE-2014-9402, https://www.suse.com/security/cve/CVE-2015-1472