Security update for glibc

SUSE Security Update: Security update for glibc
Announcement ID: SUSE-SU-2014:1129-1
Rating: important
References: #836746 #844309 #892073 #894553 #894556
Affected Products:
  • SUSE Linux Enterprise Server 11 SP2 LTSS

  • An update that solves four vulnerabilities and has one errata is now available.


    This glibc update fixes a critical privilege escalation problem and two
    additional issues:

    * bnc#892073: An off-by-one error leading to a heap-based buffer
    overflow was found in __gconv_translit_find(). An exploit that
    targets the problem is publicly available. (CVE-2014-5119)
    * bnc#836746: Avoid race between {, __de}allocate_stack and
    __reclaim_stacks during fork.
    * bnc#844309: Fixed various overflows, reading large /etc/hosts or
    long names. (CVE-2013-4357)
    * bnc#894553, bnc#894556: Fixed various crashes on invalid input in
    IBM gconv modules. (CVE-2014-6040, CVE-2012-6656)

    Security Issues:

    * CVE-2012-6656

    * CVE-2013-4357

    * CVE-2014-5119

    * CVE-2014-6040

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11 SP2 LTSS:
      zypper in -t patch slessp2-glibc-9721

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Server 11 SP2 LTSS (i586 i686 s390x x86_64):
      • glibc-2.11.3-
      • glibc-devel-2.11.3-
    • SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64):
      • glibc-html-2.11.3-
      • glibc-i18ndata-2.11.3-
      • glibc-info-2.11.3-
      • glibc-locale-2.11.3-
      • glibc-profile-2.11.3-
      • nscd-2.11.3-
    • SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64):
      • glibc-32bit-2.11.3-
      • glibc-devel-32bit-2.11.3-
      • glibc-locale-32bit-2.11.3-
      • glibc-profile-32bit-2.11.3-