SCIENTIFIC-LINUX-ERRATA Archives

April 2017

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Moderate: bash on SL6.x i386/x86_64
From:
Pat Riehecky <[log in to unmask]>
Reply To:
[log in to unmask]
Date:
Wed, 5 Apr 2017 15:25:32 -0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (38 lines) 
Synopsis:          Moderate: bash security and bug fix update
Advisory ID:       SLSA-2017:0725-1
Issue Date:        2017-03-21
CVE Numbers:       CVE-2016-0634
                   CVE-2016-7543
                   CVE-2016-9401
--

Security Fix(es):

* An arbitrary command injection flaw was found in the way bash processed
the hostname value. A malicious DHCP server could use this flaw to execute
arbitrary commands on the DHCP client machines running bash under specific
circumstances. (CVE-2016-0634)

* An arbitrary command injection flaw was found in the way bash processed
the SHELLOPTS and PS4 environment variables. A local, authenticated
attacker could use this flaw to exploit poorly written setuid programs to
elevate their privileges under certain circumstances. (CVE-2016-7543)

* A denial of service flaw was found in the way bash handled popd
commands. A poorly written shell script could cause bash to crash
resulting in a local denial of service limited to a specific bash session.
(CVE-2016-9401)
--

SL6
  x86_64
    bash-4.1.2-48.el6.x86_64.rpm
    bash-debuginfo-4.1.2-48.el6.x86_64.rpm
    bash-doc-4.1.2-48.el6.x86_64.rpm
  i386
    bash-4.1.2-48.el6.i686.rpm
    bash-debuginfo-4.1.2-48.el6.i686.rpm
    bash-doc-4.1.2-48.el6.i686.rpm

- Scientific Linux Development Team

ATOM RSS1 RSS2