Security update for sudo
SUSE Security Update: Security update for sudo
Announcement ID: | SUSE-SU-2015:0985-1 |
Rating: | moderate |
References: | #880764 #901145 #904694 #917806 |
Affected Products: |
An update that solves one vulnerability and has three fixes is now available.
Description:
This update for sudo provides the following fixes:
- Handle TZ environment variable safely. (CVE-2014-9680, bnc#917806)
- Do not truncate long commands (131072 or more characters) without any warning. (bnc#901145)
- Create log files with ownership set to user and group 'root'. (bnc#904694)
- Close PAM session properly. (bnc#880764)
Security Issues:
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP3 for VMware:
zypper in -t patch slessp3-sudo=10686
- SUSE Linux Enterprise Server 11 SP3:
zypper in -t patch slessp3-sudo=10686
- SUSE Linux Enterprise Desktop 11 SP3:
zypper in -t patch sledsp3-sudo=10686
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):
- sudo-1.7.6p2-0.23.1
- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):
- sudo-1.7.6p2-0.23.1
- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):
- sudo-1.7.6p2-0.23.1