SUSE update for glibc

1) Data Handling

EUVDB-ID: #VU31436

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-8985

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Mitigation

Update the affected package glibc to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 9

SUSE Linux Enterprise Server for SAP: 12-SP4

SUSE Linux Enterprise Server: 12-SP4-LTSS

SUSE OpenStack Cloud: 9

glibc-info: before 2.22-114.22.1

glibc-i18ndata: before 2.22-114.22.1

glibc-html: before 2.22-114.22.1

nscd-debuginfo: before 2.22-114.22.1

nscd: before 2.22-114.22.1

glibc-profile-32bit: before 2.22-114.22.1

glibc-profile: before 2.22-114.22.1

glibc-locale-debuginfo-32bit: before 2.22-114.22.1

glibc-locale-debuginfo: before 2.22-114.22.1

glibc-locale-32bit: before 2.22-114.22.1

glibc-locale: before 2.22-114.22.1

glibc-devel-debuginfo-32bit: before 2.22-114.22.1

glibc-devel-debuginfo: before 2.22-114.22.1

glibc-devel-32bit: before 2.22-114.22.1

glibc-devel: before 2.22-114.22.1

glibc-debugsource: before 2.22-114.22.1

glibc-debuginfo-32bit: before 2.22-114.22.1

glibc-debuginfo: before 2.22-114.22.1

glibc-32bit: before 2.22-114.22.1

glibc: before 2.22-114.22.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20223942-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.