openSUSE Security

Download

security@lists.opensuse.org

January 2018

3 participants
2 discussions

[opensuse-security] ***UNCHECKED*** clamav remote code injection
by Florian Gleixner 27 Jan '18

27 Jan '18

Hi, there are reports from email service providers, that there are attempts to exploit clamav using prepared pdf documents in mails. See (in german): https://www.heise.de/security/meldung/Jetzt-patchen-Angriffe-auf-Viren-Scan… I hope, the opensuse security team will release a update for clamav soon.

2 1

[opensuse-security] Security issue with Docker / namespaces?
by Jean-Christophe Baptiste 24 Jan '18

24 Jan '18

Hi guys, I am afraid of a security issue with Docker. Sorry but I have no other machines to test for now, so it might be a local issue only. I realized that today when running an Ubuntu container : % docker run -ti --rm --hostname=ubuntu --net=host ubuntu /bin/bash It runs a bash shell inside the Ubuntu container. But, from within the container (screenshot attached): % apt update # should fail, not finding the command % zypper refresh # unexpectedly, it would work and refresh the host repos! Of course, this is absolutely abnormal and I am still evaluating the exact impact. I can tell that the issue was not here one week ago (I have been a quite intensive Docker user for around 2 years). So I am not sure what is causing this behavior. Looking forward to reading some feedbacks. Best regards, -- Jean-Christophe

1 2