openSUSE Security Update: Security update for glibc
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2015:1387-1
Rating:             important
References:         #882600 
Cross-References:   CVE-2014-4043
Affected Products:
                    openSUSE 13.1
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   glibc was updated to fix one security issue.

   This security issue was fixed:
   - CVE-2014-4043: The posix_spawn_file_actions_addopen function in glibc
     did not copy its path argument in accordance with the POSIX
     specification, which allowed context-dependent attackers to trigger
     use-after-free vulnerabilities (bsc#882600).


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 13.1:

      zypper in -t patch openSUSE-2015-544=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 13.1 (i586 x86_64):

      glibc-2.18-4.38.1
      glibc-debuginfo-2.18-4.38.1
      glibc-debugsource-2.18-4.38.1
      glibc-devel-2.18-4.38.1
      glibc-devel-debuginfo-2.18-4.38.1
      glibc-devel-static-2.18-4.38.1
      glibc-extra-2.18-4.38.1
      glibc-extra-debuginfo-2.18-4.38.1
      glibc-locale-2.18-4.38.1
      glibc-locale-debuginfo-2.18-4.38.1
      glibc-profile-2.18-4.38.1
      glibc-utils-2.18-4.38.2
      glibc-utils-debuginfo-2.18-4.38.2
      glibc-utils-debugsource-2.18-4.38.2
      nscd-2.18-4.38.1
      nscd-debuginfo-2.18-4.38.1

   - openSUSE 13.1 (x86_64):

      glibc-32bit-2.18-4.38.2
      glibc-debuginfo-32bit-2.18-4.38.2
      glibc-devel-32bit-2.18-4.38.2
      glibc-devel-debuginfo-32bit-2.18-4.38.2
      glibc-devel-static-32bit-2.18-4.38.2
      glibc-locale-32bit-2.18-4.38.2
      glibc-locale-debuginfo-32bit-2.18-4.38.2
      glibc-profile-32bit-2.18-4.38.2
      glibc-utils-32bit-2.18-4.38.2
      glibc-utils-debuginfo-32bit-2.18-4.38.2

   - openSUSE 13.1 (noarch):

      glibc-html-2.18-4.38.1
      glibc-i18ndata-2.18-4.38.1
      glibc-i18ndata-2.18-4.38.2
      glibc-info-2.18-4.38.1
      glibc-info-2.18-4.38.2

   - openSUSE 13.1 (i686):

      glibc-2.18-4.38.2
      glibc-debuginfo-2.18-4.38.2
      glibc-debugsource-2.18-4.38.2
      glibc-devel-2.18-4.38.2
      glibc-devel-debuginfo-2.18-4.38.2
      glibc-devel-static-2.18-4.38.2
      glibc-extra-2.18-4.38.2
      glibc-extra-debuginfo-2.18-4.38.2
      glibc-locale-2.18-4.38.2
      glibc-locale-debuginfo-2.18-4.38.2
      glibc-obsolete-2.18-4.38.2
      glibc-obsolete-debuginfo-2.18-4.38.2
      glibc-profile-2.18-4.38.2
      nscd-2.18-4.38.2
      nscd-debuginfo-2.18-4.38.2

   - openSUSE 13.1 (i586):

      glibc-obsolete-2.18-4.38.1
      glibc-obsolete-debuginfo-2.18-4.38.1


References:

   https://www.suse.com/security/cve/CVE-2014-4043.html
   https://bugzilla.suse.com/882600