openSUSE Security Update : glibc (openSUSE-SU-2013:1510-1)

High Nessus Plugin ID 75154

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.7

Synopsis

The remote openSUSE host is missing a security update.

Description

This update fixes the following issues in glibc :

 - CVE-2012-4412: glibc: buffer overflow in strcoll

 - CVE-2013-0242: glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters

 - CVE-2013-1914: glibc: stack overflow in getaddrinfo() sorting

 - CVE-2013-2207: glibc: pt_chown tricked into granting access to another users pseudo-terminal

 - CVE-2013-4237: glibc: Buffer overwrite - NAME_MAX not enforced by readdir_r()

 - bnc#805054: man 1 locale mentions non-existent file

 - bnc#813306: glibc 2.17 fprintf(stderr, ...) triggers write of undefined values if stderr is closed

 - bnc#819383: pldd a process multiple times can freeze the process

 - bnc#819524: nscd segfault

 - bnc#824046: glibc: blacklist code in bindresvport doesn't release lock, results in double-lock

 - bnc#839870: glibc: three integer overflows in memory allocator

 - ARM: Support loading unmarked objects from cache

Solution

Update the affected glibc packages.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=779320

https://bugzilla.novell.com/show_bug.cgi?id=801246

https://bugzilla.novell.com/show_bug.cgi?id=805054

https://bugzilla.novell.com/show_bug.cgi?id=813121

https://bugzilla.novell.com/show_bug.cgi?id=813306

https://bugzilla.novell.com/show_bug.cgi?id=819383

https://bugzilla.novell.com/show_bug.cgi?id=819524

https://bugzilla.novell.com/show_bug.cgi?id=824046

https://bugzilla.novell.com/show_bug.cgi?id=830257

https://bugzilla.novell.com/show_bug.cgi?id=834594

https://bugzilla.novell.com/show_bug.cgi?id=839870

https://lists.opensuse.org/opensuse-updates/2013-09/msg00072.html

Plugin Details

Severity: High

ID: 75154

File Name: openSUSE-2013-723.nasl

Version: 1.6

Type: local

Agent: unix

Published: 2014/06/13

Updated: 2020/06/04

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:glibc, p-cpe:/a:novell:opensuse:glibc-32bit, p-cpe:/a:novell:opensuse:glibc-debuginfo, p-cpe:/a:novell:opensuse:glibc-debuginfo-32bit, p-cpe:/a:novell:opensuse:glibc-debugsource, p-cpe:/a:novell:opensuse:glibc-devel, p-cpe:/a:novell:opensuse:glibc-devel-32bit, p-cpe:/a:novell:opensuse:glibc-devel-debuginfo, p-cpe:/a:novell:opensuse:glibc-devel-debuginfo-32bit, p-cpe:/a:novell:opensuse:glibc-devel-static, p-cpe:/a:novell:opensuse:glibc-devel-static-32bit, p-cpe:/a:novell:opensuse:glibc-extra, p-cpe:/a:novell:opensuse:glibc-extra-debuginfo, p-cpe:/a:novell:opensuse:glibc-html, p-cpe:/a:novell:opensuse:glibc-i18ndata, p-cpe:/a:novell:opensuse:glibc-info, p-cpe:/a:novell:opensuse:glibc-locale, p-cpe:/a:novell:opensuse:glibc-locale-32bit, p-cpe:/a:novell:opensuse:glibc-locale-debuginfo, p-cpe:/a:novell:opensuse:glibc-locale-debuginfo-32bit, p-cpe:/a:novell:opensuse:glibc-obsolete, p-cpe:/a:novell:opensuse:glibc-obsolete-debuginfo, p-cpe:/a:novell:opensuse:glibc-profile, p-cpe:/a:novell:opensuse:glibc-profile-32bit, p-cpe:/a:novell:opensuse:glibc-utils, p-cpe:/a:novell:opensuse:glibc-utils-32bit, p-cpe:/a:novell:opensuse:glibc-utils-debuginfo, p-cpe:/a:novell:opensuse:glibc-utils-debuginfo-32bit, p-cpe:/a:novell:opensuse:glibc-utils-debugsource, p-cpe:/a:novell:opensuse:nscd, p-cpe:/a:novell:opensuse:nscd-debuginfo, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/09/18

Reference Information

CVE: CVE-2012-4412, CVE-2013-0242, CVE-2013-1914, CVE-2013-2207, CVE-2013-4237, CVE-2013-4332