Security update for glibc

SUSE Security Update: Security update for glibc
Announcement ID: SUSE-SU-2015:0551-1
Rating: moderate
References: #887022 #906371 #910599 #915526 #916222 #918233
Affected Products:
  • SUSE Linux Enterprise Server 11 SP2 LTSS
  • SUSE Linux Enterprise Server 11 SP1 LTSS

  • An update that solves four vulnerabilities and has two fixes is now available.

    Description:


    glibc has been updated to fix four security issues:

    * CVE-2014-0475: Directory traversal in locale environment handling
    (bnc#887022)
    * CVE-2014-7817: wordexp failed to honour WRDE_NOCMD (bsc#906371)
    * CVE-2014-9402: Avoid infinite loop in nss_dns getnetbyname
    (bsc#910599)
    * CVE-2015-1472: Fixed buffer overflow in wscanf (bsc#916222)
    * CVE-2013-7423: getaddrinfo() wrote DNS queries to random file
    descriptors under high load. (bnc#915526)

    This non-security issue was fixed:

    * Fix missing zero termination (bnc#918233)

    Security Issues:

    * CVE-2015-1472

    * CVE-2013-7423

    * CVE-2014-7817

    * CVE-2014-9402

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11 SP2 LTSS:
      zypper in -t patch slessp2-glibc=10401
    • SUSE Linux Enterprise Server 11 SP1 LTSS:
      zypper in -t patch slessp1-glibc=10382

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Server 11 SP2 LTSS (i586 i686 s390x x86_64):
      • glibc-2.11.3-17.45.59.1
      • glibc-devel-2.11.3-17.45.59.1
    • SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64):
      • glibc-html-2.11.3-17.45.59.1
      • glibc-i18ndata-2.11.3-17.45.59.1
      • glibc-info-2.11.3-17.45.59.1
      • glibc-locale-2.11.3-17.45.59.1
      • glibc-profile-2.11.3-17.45.59.1
      • nscd-2.11.3-17.45.59.1
    • SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64):
      • glibc-32bit-2.11.3-17.45.59.1
      • glibc-devel-32bit-2.11.3-17.45.59.1
      • glibc-locale-32bit-2.11.3-17.45.59.1
      • glibc-profile-32bit-2.11.3-17.45.59.1
    • SUSE Linux Enterprise Server 11 SP1 LTSS (i586 i686 s390x x86_64):
      • glibc-2.11.1-0.64.1
      • glibc-devel-2.11.1-0.64.1
    • SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64):
      • glibc-html-2.11.1-0.64.1
      • glibc-i18ndata-2.11.1-0.64.1
      • glibc-info-2.11.1-0.64.1
      • glibc-locale-2.11.1-0.64.1
      • glibc-profile-2.11.1-0.64.1
      • nscd-2.11.1-0.64.1
    • SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64):
      • glibc-32bit-2.11.1-0.64.1
      • glibc-devel-32bit-2.11.1-0.64.1
      • glibc-locale-32bit-2.11.1-0.64.1
      • glibc-profile-32bit-2.11.1-0.64.1

    References:

    • http://support.novell.com/security/cve/CVE-2013-7423.html
    • http://support.novell.com/security/cve/CVE-2014-7817.html
    • http://support.novell.com/security/cve/CVE-2014-9402.html
    • http://support.novell.com/security/cve/CVE-2015-1472.html
    • https://bugzilla.suse.com/887022
    • https://bugzilla.suse.com/906371
    • https://bugzilla.suse.com/910599
    • https://bugzilla.suse.com/915526
    • https://bugzilla.suse.com/916222
    • https://bugzilla.suse.com/918233
    • http://download.suse.com/patch/finder/?keywords=59aada66a6181e4fc79f7233887b7f74
    • http://download.suse.com/patch/finder/?keywords=68a9641d4061f4e1326d0bdc84774515