Security update for glibc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1958-2 Final 1 1 2019-07-23T11:18:34Z current 2019-07-23T11:18:34Z 2019-07-23T11:18:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for glibc This update for glibc fixes the following issues: Security issues fixed: - CVE-2019-9169: Fixed a heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308). - CVE-2009-5155: Fixed a denial of service in parse_reg_exp() (bsc#1127223). Non-security issues fixed: - Added cfi information for start routines in order to stop unwinding on S390 (bsc#1128574). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/nginx-ingress-controller:beta1-2019-1958,Container suse/sles12sp3:latest-2019-1958,HPE-Helion-OpenStack-8-2019-1958,SUSE-2019-1958,SUSE-OpenStack-Cloud-Crowbar-8-2019-1958,SUSE-SLE-SERVER-12-SP3-2019-1958,SUSE-SLE-SERVER-12-SP3-BCL-2019-1958,SUSE-Storage-5-2019-1958 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191958-2/ Link for SUSE-SU-2019:1958-2 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005821.html E-Mail link for SUSE-SU-2019:1958-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1127223 SUSE Bug 1127223 https://bugzilla.suse.com/1127308 SUSE Bug 1127308 https://bugzilla.suse.com/1128574 SUSE Bug 1128574 https://www.suse.com/security/cve/CVE-2009-5155/ SUSE CVE CVE-2009-5155 page https://www.suse.com/security/cve/CVE-2019-9169/ SUSE CVE CVE-2019-9169 page Container caasp/v4/nginx-ingress-controller:beta1 Container suse/sles12sp3:latest HPE Helion OpenStack 8 SUSE Enterprise Storage 5 SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE OpenStack Cloud Crowbar 8 glibc-2.22-62.22.5 glibc-32bit-2.22-62.22.5 glibc-devel-2.22-62.22.5 glibc-devel-32bit-2.22-62.22.5 glibc-html-2.22-62.22.5 glibc-i18ndata-2.22-62.22.5 glibc-info-2.22-62.22.5 glibc-locale-2.22-62.22.5 glibc-locale-32bit-2.22-62.22.5 glibc-profile-2.22-62.22.5 glibc-profile-32bit-2.22-62.22.5 nscd-2.22-62.22.5 glibc-64bit-2.22-62.22.5 glibc-devel-64bit-2.22-62.22.5 glibc-devel-static-2.22-62.22.5 glibc-devel-static-32bit-2.22-62.22.5 glibc-devel-static-64bit-2.22-62.22.5 glibc-extra-2.22-62.22.5 glibc-locale-64bit-2.22-62.22.5 glibc-obsolete-2.22-62.22.5 glibc-profile-64bit-2.22-62.22.5 glibc-utils-2.22-62.22.3 glibc-utils-32bit-2.22-62.22.3 glibc-utils-64bit-2.22-62.22.3 glibc-2.22-62.22.5 as a component of Container caasp/v4/nginx-ingress-controller:beta1 glibc-2.22-62.22.5 as a component of Container suse/sles12sp3:latest glibc-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-32bit-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-devel-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-devel-32bit-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-html-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-i18ndata-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-info-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-locale-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-locale-32bit-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-profile-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-profile-32bit-2.22-62.22.5 as a component of HPE Helion OpenStack 8 nscd-2.22-62.22.5 as a component of HPE Helion OpenStack 8 glibc-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-32bit-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-devel-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-devel-32bit-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-html-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-i18ndata-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-info-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-locale-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-locale-32bit-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-profile-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-profile-32bit-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 nscd-2.22-62.22.5 as a component of SUSE Enterprise Storage 5 glibc-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-devel-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-devel-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-html-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-i18ndata-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-info-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-locale-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-locale-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-profile-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-profile-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL nscd-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-BCL glibc-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-devel-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-devel-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-html-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-i18ndata-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-info-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-locale-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-locale-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-profile-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-profile-32bit-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS nscd-2.22-62.22.5 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS glibc-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-32bit-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-devel-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-devel-32bit-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-html-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-i18ndata-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-info-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-locale-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-locale-32bit-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-profile-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 glibc-profile-32bit-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 nscd-2.22-62.22.5 as a component of SUSE OpenStack Cloud Crowbar 8 In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match. CVE-2009-5155 Container caasp/v4/nginx-ingress-controller:beta1:glibc-2.22-62.22.5 Container suse/sles12sp3:latest:glibc-2.22-62.22.5 HPE Helion OpenStack 8:glibc-2.22-62.22.5 HPE Helion OpenStack 8:glibc-32bit-2.22-62.22.5 HPE Helion OpenStack 8:glibc-devel-2.22-62.22.5 HPE Helion OpenStack 8:glibc-devel-32bit-2.22-62.22.5 HPE Helion OpenStack 8:glibc-html-2.22-62.22.5 HPE Helion OpenStack 8:glibc-i18ndata-2.22-62.22.5 HPE Helion OpenStack 8:glibc-info-2.22-62.22.5 HPE Helion OpenStack 8:glibc-locale-2.22-62.22.5 HPE Helion OpenStack 8:glibc-locale-32bit-2.22-62.22.5 HPE Helion OpenStack 8:glibc-profile-2.22-62.22.5 HPE Helion OpenStack 8:glibc-profile-32bit-2.22-62.22.5 HPE Helion OpenStack 8:nscd-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-devel-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-devel-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-html-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-i18ndata-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-info-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-locale-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-locale-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-profile-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-profile-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:nscd-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-devel-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-devel-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-html-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-i18ndata-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-info-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-locale-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-locale-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-profile-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-profile-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:nscd-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-devel-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-devel-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-html-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-i18ndata-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-info-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-locale-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-locale-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-profile-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-profile-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:nscd-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-devel-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-devel-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-html-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-i18ndata-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-info-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-locale-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-locale-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-profile-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-profile-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:nscd-2.22-62.22.5 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191958-2/ https://www.suse.com/security/cve/CVE-2009-5155.html CVE-2009-5155 https://bugzilla.suse.com/1127223 SUSE Bug 1127223 In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. CVE-2019-9169 Container caasp/v4/nginx-ingress-controller:beta1:glibc-2.22-62.22.5 Container suse/sles12sp3:latest:glibc-2.22-62.22.5 HPE Helion OpenStack 8:glibc-2.22-62.22.5 HPE Helion OpenStack 8:glibc-32bit-2.22-62.22.5 HPE Helion OpenStack 8:glibc-devel-2.22-62.22.5 HPE Helion OpenStack 8:glibc-devel-32bit-2.22-62.22.5 HPE Helion OpenStack 8:glibc-html-2.22-62.22.5 HPE Helion OpenStack 8:glibc-i18ndata-2.22-62.22.5 HPE Helion OpenStack 8:glibc-info-2.22-62.22.5 HPE Helion OpenStack 8:glibc-locale-2.22-62.22.5 HPE Helion OpenStack 8:glibc-locale-32bit-2.22-62.22.5 HPE Helion OpenStack 8:glibc-profile-2.22-62.22.5 HPE Helion OpenStack 8:glibc-profile-32bit-2.22-62.22.5 HPE Helion OpenStack 8:nscd-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-devel-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-devel-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-html-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-i18ndata-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-info-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-locale-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-locale-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-profile-2.22-62.22.5 SUSE Enterprise Storage 5:glibc-profile-32bit-2.22-62.22.5 SUSE Enterprise Storage 5:nscd-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-devel-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-devel-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-html-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-i18ndata-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-info-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-locale-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-locale-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-profile-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:glibc-profile-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-BCL:nscd-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-devel-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-devel-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-html-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-i18ndata-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-info-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-locale-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-locale-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-profile-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:glibc-profile-32bit-2.22-62.22.5 SUSE Linux Enterprise Server 12 SP3-LTSS:nscd-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-devel-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-devel-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-html-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-i18ndata-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-info-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-locale-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-locale-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-profile-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:glibc-profile-32bit-2.22-62.22.5 SUSE OpenStack Cloud Crowbar 8:nscd-2.22-62.22.5 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191958-2/ https://www.suse.com/security/cve/CVE-2019-9169.html CVE-2019-9169 https://bugzilla.suse.com/1127308 SUSE Bug 1127308 https://bugzilla.suse.com/1146392 SUSE Bug 1146392