Security update for glibc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1621-1 Final 1 1 2017-06-19T19:21:38Z current 2017-06-19T19:21:38Z 2017-06-19T19:21:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for glibc This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-glibc-13158,sleposp3-glibc-13158,slessp3-glibc-13158,slessp4-glibc-13158 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171621-1/ Link for SUSE-SU-2017:1621-1 https://lists.suse.com/pipermail/sle-security-updates/2017-June/002963.html E-Mail link for SUSE-SU-2017:1621-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1039357 SUSE Bug 1039357 https://www.suse.com/security/cve/CVE-2017-1000366/ SUSE CVE CVE-2017-1000366 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 glibc-html-2.11.3-17.109.1 glibc-info-2.11.3-17.109.1 glibc-2.11.3-17.109.1 glibc-devel-2.11.3-17.109.1 glibc-i18ndata-2.11.3-17.109.1 glibc-locale-2.11.3-17.109.1 glibc-profile-2.11.3-17.109.1 nscd-2.11.3-17.109.1 glibc-32bit-2.11.3-17.109.1 glibc-devel-32bit-2.11.3-17.109.1 glibc-locale-32bit-2.11.3-17.109.1 glibc-profile-32bit-2.11.3-17.109.1 glibc-locale-x86-2.11.3-17.109.1 glibc-profile-x86-2.11.3-17.109.1 glibc-x86-2.11.3-17.109.1 glibc-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-devel-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-html-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-i18ndata-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-info-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-locale-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-profile-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 nscd-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 glibc-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-devel-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-devel-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-html-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-i18ndata-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-info-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-locale-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-locale-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-profile-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-profile-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS nscd-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS glibc-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-devel-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-devel-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-html-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-i18ndata-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-info-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-locale-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-locale-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-profile-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-profile-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA nscd-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA glibc-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-devel-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-devel-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-html-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-i18ndata-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-info-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-locale-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-locale-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-locale-x86-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-profile-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-profile-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-profile-x86-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-x86-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 nscd-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server 11 SP4 glibc-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-devel-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-devel-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-html-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-i18ndata-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-info-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-locale-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-locale-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-locale-x86-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-profile-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-profile-32bit-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-profile-x86-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-x86-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 nscd-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 glibc-html-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 glibc-info-2.11.3-17.109.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. CVE-2017-1000366 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-devel-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-html-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-i18ndata-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-info-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-locale-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:glibc-profile-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11 SP3:nscd-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-devel-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-devel-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-html-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-i18ndata-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-info-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-locale-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-locale-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-profile-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:glibc-profile-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-LTSS:nscd-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-devel-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-devel-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-html-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-i18ndata-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-info-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-locale-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-locale-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-profile-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:glibc-profile-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:nscd-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-devel-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-devel-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-html-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-i18ndata-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-info-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-locale-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-locale-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-locale-x86-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-profile-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-profile-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-profile-x86-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:glibc-x86-2.11.3-17.109.1 SUSE Linux Enterprise Server 11 SP4:nscd-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-devel-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-devel-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-html-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-i18ndata-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-info-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-locale-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-locale-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-locale-x86-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-profile-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-profile-32bit-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-profile-x86-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:glibc-x86-2.11.3-17.109.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:nscd-2.11.3-17.109.1 SUSE Linux Enterprise Software Development Kit 11 SP4:glibc-html-2.11.3-17.109.1 SUSE Linux Enterprise Software Development Kit 11 SP4:glibc-info-2.11.3-17.109.1 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171621-1/ https://www.suse.com/security/cve/CVE-2017-1000366.html CVE-2017-1000366 https://bugzilla.suse.com/1037551 SUSE Bug 1037551 https://bugzilla.suse.com/1039357 SUSE Bug 1039357 https://bugzilla.suse.com/1063847 SUSE Bug 1063847 https://bugzilla.suse.com/1071319 SUSE Bug 1071319 https://bugzilla.suse.com/1123874 SUSE Bug 1123874