CVE-2017-1000366

Upstream information

CVE-2017-1000366 at MITRE

Description

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

---

SUSE information

CVSS v2 Scores

	SUSE
Base Score	6.89
Vector	AV:L/AC:M/Au:N/C:C/I:C/A:C
Access Vector	Local
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

CVSS v3 Scores

	SUSE
Base Score	8.4
Vector	AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Access Vector	Local
Access Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High

This issue is currently rated as having important severity.

SUSE Bugzilla entry: 1039357 [NEW]

SUSE Security Advisories:

• SUSE-SU-2017:1611-1, published Mon, 19 Jun 2017 21:10:14 +0200 (CEST)
• SUSE-SU-2017:1614-1, published Mon, 19 Jun 2017 21:12:36 +0200 (CEST)
• SUSE-SU-2017:1619-1, published Mon, 19 Jun 2017 21:16:12 +0200 (CEST)
• SUSE-SU-2017:1621-1, published Tue, 20 Jun 2017 03:09:24 +0200 (CEST)
• openSUSE-SU-2017:1629-1, published Wed, 21 Jun 2017 03:09:06 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
Openstack Cloud Magnum Orchestration 7	glibc >= 2.22-61.3 glibc-locale >= 2.22-61.3	Patchnames: SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-990
SUSE Linux Enterprise Desktop 12 SP2	glibc >= 2.22-61.3 glibc-32bit >= 2.22-61.3 glibc-devel >= 2.22-61.3 glibc-devel-32bit >= 2.22-61.3 glibc-i18ndata >= 2.22-61.3 glibc-locale >= 2.22-61.3 glibc-locale-32bit >= 2.22-61.3 nscd >= 2.22-61.3	Patchnames: SUSE-SLE-DESKTOP-12-SP2-2017-990
SUSE Linux Enterprise Point of Sale 11 SP3	glibc >= 2.11.3-17.109.1 glibc-devel >= 2.11.3-17.109.1 glibc-html >= 2.11.3-17.109.1 glibc-i18ndata >= 2.11.3-17.109.1 glibc-info >= 2.11.3-17.109.1 glibc-locale >= 2.11.3-17.109.1 glibc-profile >= 2.11.3-17.109.1 nscd >= 2.11.3-17.109.1	Patchnames: sleposp3-glibc-13158
SUSE Linux Enterprise Server 11 SP3-LTSS	glibc >= 2.11.3-17.109.1 glibc-32bit >= 2.11.3-17.109.1 glibc-devel >= 2.11.3-17.109.1 glibc-devel-32bit >= 2.11.3-17.109.1 glibc-html >= 2.11.3-17.109.1 glibc-i18ndata >= 2.11.3-17.109.1 glibc-info >= 2.11.3-17.109.1 glibc-locale >= 2.11.3-17.109.1 glibc-locale-32bit >= 2.11.3-17.109.1 glibc-profile >= 2.11.3-17.109.1 glibc-profile-32bit >= 2.11.3-17.109.1 nscd >= 2.11.3-17.109.1	Patchnames: slessp3-glibc-13158
SUSE Linux Enterprise Server 11 SP4	glibc >= 2.11.3-17.109.1 glibc-32bit >= 2.11.3-17.109.1 glibc-devel >= 2.11.3-17.109.1 glibc-devel-32bit >= 2.11.3-17.109.1 glibc-html >= 2.11.3-17.109.1 glibc-i18ndata >= 2.11.3-17.109.1 glibc-info >= 2.11.3-17.109.1 glibc-locale >= 2.11.3-17.109.1 glibc-locale-32bit >= 2.11.3-17.109.1 glibc-locale-x86 >= 2.11.3-17.109.1 glibc-profile >= 2.11.3-17.109.1 glibc-profile-32bit >= 2.11.3-17.109.1 glibc-profile-x86 >= 2.11.3-17.109.1 glibc-x86 >= 2.11.3-17.109.1 nscd >= 2.11.3-17.109.1	Patchnames: slessp4-glibc-13158
SUSE Linux Enterprise Server 12 SP1-LTSS	glibc >= 2.19-40.6.1 glibc-32bit >= 2.19-40.6.1 glibc-devel >= 2.19-40.6.1 glibc-devel-32bit >= 2.19-40.6.1 glibc-html >= 2.19-40.6.1 glibc-i18ndata >= 2.19-40.6.1 glibc-info >= 2.19-40.6.1 glibc-locale >= 2.19-40.6.1 glibc-locale-32bit >= 2.19-40.6.1 glibc-profile >= 2.19-40.6.1 glibc-profile-32bit >= 2.19-40.6.1 nscd >= 2.19-40.6.1	Patchnames: SUSE-SLE-SERVER-12-SP1-2017-989
SUSE Linux Enterprise Server 12 SP2	glibc >= 2.22-61.3 glibc-32bit >= 2.22-61.3 glibc-devel >= 2.22-61.3 glibc-devel-32bit >= 2.22-61.3 glibc-html >= 2.22-61.3 glibc-i18ndata >= 2.22-61.3 glibc-info >= 2.22-61.3 glibc-locale >= 2.22-61.3 glibc-locale-32bit >= 2.22-61.3 glibc-profile >= 2.22-61.3 glibc-profile-32bit >= 2.22-61.3 nscd >= 2.22-61.3	Patchnames: SUSE-SLE-SERVER-12-SP2-2017-990
SUSE Linux Enterprise Server 12-LTSS	glibc >= 2.19-22.21.1 glibc-32bit >= 2.19-22.21.1 glibc-devel >= 2.19-22.21.1 glibc-devel-32bit >= 2.19-22.21.1 glibc-html >= 2.19-22.21.1 glibc-i18ndata >= 2.19-22.21.1 glibc-info >= 2.19-22.21.1 glibc-locale >= 2.19-22.21.1 glibc-locale-32bit >= 2.19-22.21.1 glibc-profile >= 2.19-22.21.1 glibc-profile-32bit >= 2.19-22.21.1 nscd >= 2.19-22.21.1	Patchnames: SUSE-SLE-SERVER-12-2017-988
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2	glibc >= 2.22-61.3 glibc-devel >= 2.22-61.3 glibc-html >= 2.22-61.3 glibc-i18ndata >= 2.22-61.3 glibc-info >= 2.22-61.3 glibc-locale >= 2.22-61.3 glibc-profile >= 2.22-61.3 nscd >= 2.22-61.3	Patchnames: SUSE-SLE-RPI-12-SP2-2017-990
SUSE Linux Enterprise Software Development Kit 11 SP4	glibc >= 2.11.3-17.109.1 glibc-html >= 2.11.3-17.109.1 glibc-info >= 2.11.3-17.109.1	Patchnames: sdksp4-glibc-13158
SUSE Linux Enterprise Software Development Kit 12 SP2	glibc >= 2.22-61.3 glibc-devel-static >= 2.22-61.3 glibc-info >= 2.22-61.3	Patchnames: SUSE-SLE-SDK-12-SP2-2017-990
SUSE Linux Enterprise for SAP 12	glibc >= 2.19-22.21.1 glibc-32bit >= 2.19-22.21.1 glibc-devel >= 2.19-22.21.1 glibc-devel-32bit >= 2.19-22.21.1 glibc-html >= 2.19-22.21.1 glibc-i18ndata >= 2.19-22.21.1 glibc-info >= 2.19-22.21.1 glibc-locale >= 2.19-22.21.1 glibc-locale-32bit >= 2.19-22.21.1 glibc-profile >= 2.19-22.21.1 glibc-profile-32bit >= 2.19-22.21.1 nscd >= 2.19-22.21.1	Patchnames: SUSE-SLE-SAP-12-2017-988
SUSE Linux Enterprise for SAP 12 SP1	glibc >= 2.19-40.6.1 glibc-32bit >= 2.19-40.6.1 glibc-devel >= 2.19-40.6.1 glibc-devel-32bit >= 2.19-40.6.1 glibc-html >= 2.19-40.6.1 glibc-i18ndata >= 2.19-40.6.1 glibc-info >= 2.19-40.6.1 glibc-locale >= 2.19-40.6.1 glibc-locale-32bit >= 2.19-40.6.1 glibc-profile >= 2.19-40.6.1 glibc-profile-32bit >= 2.19-40.6.1 nscd >= 2.19-40.6.1	Patchnames: SUSE-SLE-SAP-12-SP1-2017-989
SUSE OpenStack Cloud 6	glibc >= 2.19-40.6.1 glibc-32bit >= 2.19-40.6.1 glibc-devel >= 2.19-40.6.1 glibc-devel-32bit >= 2.19-40.6.1 glibc-html >= 2.19-40.6.1 glibc-i18ndata >= 2.19-40.6.1 glibc-info >= 2.19-40.6.1 glibc-locale >= 2.19-40.6.1 glibc-locale-32bit >= 2.19-40.6.1 glibc-profile >= 2.19-40.6.1 glibc-profile-32bit >= 2.19-40.6.1 nscd >= 2.19-40.6.1	Patchnames: SUSE-OpenStack-Cloud-6-2017-989
openSUSE Leap 42.2	glibc >= 2.22-4.9.1 glibc-32bit >= 2.22-4.9.1 glibc-debuginfo >= 2.22-4.9.1 glibc-debuginfo-32bit >= 2.22-4.9.1 glibc-debugsource >= 2.22-4.9.1 glibc-devel >= 2.22-4.9.1 glibc-devel-32bit >= 2.22-4.9.1 glibc-devel-debuginfo >= 2.22-4.9.1 glibc-devel-debuginfo-32bit >= 2.22-4.9.1 glibc-devel-static >= 2.22-4.9.1 glibc-devel-static-32bit >= 2.22-4.9.1 glibc-extra >= 2.22-4.9.1 glibc-extra-debuginfo >= 2.22-4.9.1 glibc-html >= 2.22-4.9.1 glibc-i18ndata >= 2.22-4.9.1 glibc-info >= 2.22-4.9.1 glibc-locale >= 2.22-4.9.1 glibc-locale-32bit >= 2.22-4.9.1 glibc-locale-debuginfo >= 2.22-4.9.1 glibc-locale-debuginfo-32bit >= 2.22-4.9.1 glibc-obsolete >= 2.22-4.9.1 glibc-obsolete-debuginfo >= 2.22-4.9.1 glibc-profile >= 2.22-4.9.1 glibc-profile-32bit >= 2.22-4.9.1 glibc-testsuite >= 2.22-4.9.2 glibc-utils >= 2.22-4.9.1 glibc-utils-32bit >= 2.22-4.9.1 glibc-utils-debuginfo >= 2.22-4.9.1 glibc-utils-debuginfo-32bit >= 2.22-4.9.1 glibc-utils-debugsource >= 2.22-4.9.1 nscd >= 2.22-4.9.1 nscd-debuginfo >= 2.22-4.9.1	Patchnames: openSUSE-2017-715