Security update for util-linux SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3926-1 Final 1 1 2018-11-27T12:39:56Z current 2018-11-27T12:39:56Z 2018-11-27T12:39:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for util-linux This update for util-linux fixes the following issues: This non-security issue was fixed: - CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300). These non-security issues were fixed: - Fixed crash loop in lscpu (bsc#1072947). - Fixed possible segfault of umount -a - Fixed mount -a on NFS bind mounts (bsc#1080740). - Fixed lsblk on NVMe (bsc#1078662). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-1618,SUSE-SLE-SDK-12-SP3-2018-1618,SUSE-SLE-SERVER-12-SP3-2018-1618,SUSE-SLE-WE-12-SP3-2018-1618 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183926-1/ Link for SUSE-SU-2018:3926-1 https://lists.suse.com/pipermail/sle-security-updates/2018-November/004898.html E-Mail link for SUSE-SU-2018:3926-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1072947 SUSE Bug 1072947 https://bugzilla.suse.com/1078662 SUSE Bug 1078662 https://bugzilla.suse.com/1080740 SUSE Bug 1080740 https://bugzilla.suse.com/1084300 SUSE Bug 1084300 https://www.suse.com/security/cve/CVE-2018-7738/ SUSE CVE CVE-2018-7738 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Workstation Extension 12 SP3 libblkid1-2.29.2-3.12.1 libblkid1-32bit-2.29.2-3.12.1 libfdisk1-2.29.2-3.12.1 libmount1-2.29.2-3.12.1 libmount1-32bit-2.29.2-3.12.1 libsmartcols1-2.29.2-3.12.1 libuuid-devel-2.29.2-3.12.1 libuuid1-2.29.2-3.12.1 libuuid1-32bit-2.29.2-3.12.1 python-libmount-2.29.2-3.12.1 util-linux-2.29.2-3.12.1 util-linux-lang-2.29.2-3.12.1 util-linux-systemd-2.29.2-3.12.1 uuidd-2.29.2-3.12.1 libblkid-devel-2.29.2-3.12.1 libmount-devel-2.29.2-3.12.1 libsmartcols-devel-2.29.2-3.12.1 libblkid1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libblkid1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libfdisk1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libmount1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libmount1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libsmartcols1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libuuid-devel-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libuuid1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libuuid1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-libmount-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 util-linux-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 util-linux-lang-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 util-linux-systemd-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 uuidd-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libblkid1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libblkid1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libfdisk1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libmount1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libmount1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libsmartcols1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libuuid1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libuuid1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-libmount-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 util-linux-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 util-linux-lang-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 util-linux-systemd-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 uuidd-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libblkid1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libblkid1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libfdisk1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libmount1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libmount1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libsmartcols1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libuuid1-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libuuid1-32bit-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-libmount-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 util-linux-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 util-linux-lang-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 util-linux-systemd-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 uuidd-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libblkid-devel-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libmount-devel-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libsmartcols-devel-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libuuid-devel-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libuuid-devel-2.29.2-3.12.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP3 In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion. CVE-2018-7738 SUSE Linux Enterprise Desktop 12 SP3:libblkid1-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libblkid1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libfdisk1-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libmount1-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libmount1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libsmartcols1-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libuuid-devel-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libuuid1-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:libuuid1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-libmount-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:util-linux-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:util-linux-lang-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:util-linux-systemd-2.29.2-3.12.1 SUSE Linux Enterprise Desktop 12 SP3:uuidd-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libblkid1-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libblkid1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libfdisk1-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libmount1-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libmount1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libsmartcols1-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libuuid1-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:libuuid1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:python-libmount-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:util-linux-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:util-linux-lang-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:util-linux-systemd-2.29.2-3.12.1 SUSE Linux Enterprise Server 12 SP3:uuidd-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libblkid1-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libblkid1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libfdisk1-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libmount1-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libmount1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsmartcols1-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libuuid1-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libuuid1-32bit-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-libmount-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:util-linux-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:util-linux-lang-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:util-linux-systemd-2.29.2-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:uuidd-2.29.2-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libblkid-devel-2.29.2-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libmount-devel-2.29.2-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libsmartcols-devel-2.29.2-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libuuid-devel-2.29.2-3.12.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libuuid-devel-2.29.2-3.12.1 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183926-1/ https://www.suse.com/security/cve/CVE-2018-7738.html CVE-2018-7738 https://bugzilla.suse.com/1080740 SUSE Bug 1080740 https://bugzilla.suse.com/1084300 SUSE Bug 1084300 https://bugzilla.suse.com/1213865 SUSE Bug 1213865