Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1562 procps security update 23 May 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: procps Publisher: Debian Operating System: Debian GNU/Linux 9 Debian GNU/Linux 8 Impact/Access: Increased Privileges -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2018-1126 CVE-2018-1125 CVE-2018-1124 CVE-2018-1123 CVE-2018-1122 Original Bulletin: http://www.debian.org/security/2018/dsa-4208 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4208-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso May 22, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : procps CVE ID : CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Debian Bug : 899170 The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-1122 top read its configuration from the current working directory if no $HOME was configured. If top were started from a directory writable by the attacker (such as /tmp) this could result in local privilege escalation. CVE-2018-1123 Denial of service against the ps invocation of another user. CVE-2018-1124 An integer overflow in the file2strvec() function of libprocps could result in local privilege escalation. CVE-2018-1125 A stack-based buffer overflow in pgrep could result in denial of service for a user using pgrep for inspecting a specially crafted process. CVE-2018-1126 Incorrect integer size parameters used in wrappers for standard C allocators could cause integer truncation and lead to integer overflow issues. For the oldstable distribution (jessie), these problems have been fixed in version 2:3.3.9-9+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 2:3.3.12-3+deb9u1. We recommend that you upgrade your procps packages. For the detailed security status of procps please refer to its security tracker page at: https://security-tracker.debian.org/tracker/procps Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlsEOvJfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QQLA//cysJZC9QFcw9FipzNT3qTGvvGXI08EzA25AhNAkvRmP/QTfJe/xh+nKG pLFxy54BYCJfRP/mpVZXlr3i1/i5594xWoofDcvrVyhT+l2IoIXs4XhLlUalr6/+ MabPCEq2CBZ3gfJN6y6KILh/KYT4mAeMqXwqO6IcmnL2AkXI5CR4cwjaFyabheHn VrO0geWUA9YyUOrrEaBS4LJUxs1LXCMNVD3qLRNCn063lMj3U4XXWsFbtZCmCVgZ NMgiOm92gfTlwDRYXby7l4aWDvK5cuPhp+q7k6bepaUIElr5ijbtME7Xeqf/4peU r1Rawz3DcxSwag6WBsaQD1aeWoMY65BP366ghIsrfO28qZkeW4SPbe1iUaiZHBGd lmMYRkYEeJiOYvsd0XUms53pzym3AsF1IsNzzS9LgFYZvEp9DsO4M57e4UllYXiS gCEAwJsWYOeaggN07OfhV6qRrggdiBN1fPUEgiQ30IahzCg6NCDaIgLJ7OauHPBS xxN07Y+KnQ8oaPH3Lex1qzqKEeyUn9CV76nWbaWRtJwCyRmC3/SD5wJp94OUuAVE LyHstcL7QrfodcZ/Ff7++Q/zEhUo8IeCtA0kspXyzemN2dE80CBERB4T+5hi0oRi EHncQMzJ7J6DelBpUBS13TyXHrW1mVqtdtulwiWAwsScHXBY/Zo= =9bCU - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWwTQ4ox+lLeg9Ub1AQiLCg//TKBLCVetmcbuZjBp0uAHFLYd9NyreBot xi0pCYdbxyr6eu5Td8LSKJfFgyTsAJF+9ZldJFuyRKESdv3qIOaYJmP3GmH9EF4V wSwoOQiP3NjaE/cpetUwy20HdWZWPiyU8R9mWnrlWFGeWk+WqV2Ka37pcIu21Pl9 ToLoURowHh0QRZj6BsGgHWUjlpsVjL6KuMu674psxabgIDbJFFiIBjs31vupyluY VF5vcHOtJe4LZUlbkezj2QOZLDy57pRlsM9wulboU8GjZiYtayhGfhAyMS2fTjD8 7c12IMQiFuptR+0n060gVsaQargFjpQkPugP70L3/pL+M7/xK/IqzeR26cL9Km+4 LL7ywXAn3La3HvODdZNqc/FueaWCpyU3AYIIClIUnOYkvwDHgfD7bbgte2p7BNBl 7pnpUdrSuHoFQZfVbF5ainV/pyLMTKnWwf7PBSE0c6qvKV9NePGJHADnAw9zgQr8 suv0nxRmSfDDg713sIjJdlsJGvkLGQtnW575RhC5wr5qlSWK5xSd/JM/hHB1HGkp mDnecJL03Q6AkKhGIvNihuz99rSV3vcMFwtxRwQzQhgSxy8bhcP2Fjezlv+09rhS xg0MVKD0wZ6yBYv3FFTW0fCbODZ7WqwKKGVA+HPY0XDPKyCc/7rtZgVs/4hkXIAn ZAvIZW+M6Jg= =vRyk -----END PGP SIGNATURE-----