SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1214-1 Rating: critical References: #688469 #770795 #896776 Cross-References: CVE-2012-3410 CVE-2014-0475 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Additionally, the following bugs have been fixed: * Avoid possible buffer overflow when expanding the /dev/fd prefix with e.g. the test built-in. (CVE-2012-3410) * Enable workaround for changed behavior of sshd. (bnc#688469) Security Issues: * CVE-2014-6271 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 * CVE-2012-3410 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3410 Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bash-3.1-24.32.1 readline-5.1-24.32.1 readline-devel-5.1-24.32.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): readline-32bit-5.1-24.32.1 readline-devel-32bit-5.1-24.32.1 References: http://support.novell.com/security/cve/CVE-2012-3410.html http://support.novell.com/security/cve/CVE-2014-0475.html https://bugzilla.suse.com/688469 https://bugzilla.suse.com/770795 https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=fd9fa24daf4d325c609035f0c778... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org