SCIENTIFIC-LINUX-ERRATA Archives

August 2017

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Moderate: bash on SL7.x x86_64
From:
Pat Riehecky <[log in to unmask]>
Reply To:
[log in to unmask]
Date:
Mon, 21 Aug 2017 15:50:22 -0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (34 lines) 
Synopsis:          Moderate: bash security and bug fix update
Advisory ID:       SLSA-2017:1931-1
Issue Date:        2017-08-01
CVE Numbers:       CVE-2016-0634
                   CVE-2016-7543
                   CVE-2016-9401
--

Security Fix(es):

* An arbitrary command injection flaw was found in the way bash processed
the hostname value. A malicious DHCP server could use this flaw to execute
arbitrary commands on the DHCP client machines running bash under specific
circumstances. (CVE-2016-0634)

* An arbitrary command injection flaw was found in the way bash processed
the SHELLOPTS and PS4 environment variables. A local, authenticated
attacker could use this flaw to exploit poorly written setuid programs to
elevate their privileges under certain circumstances. (CVE-2016-7543)

* A denial of service flaw was found in the way bash handled popd
commands. A poorly written shell script could cause bash to crash
resulting in a local denial of service limited to a specific bash session.
(CVE-2016-9401)
--

SL7
  x86_64
    bash-4.2.46-28.el7.x86_64.rpm
    bash-debuginfo-4.2.46-28.el7.x86_64.rpm
    bash-doc-4.2.46-28.el7.x86_64.rpm

- Scientific Linux Development Team

ATOM RSS1 RSS2