SUSE-SU-2024:2756-1

Details

Description of the patch:

This update for ksh fixes the following issues:

CVE-2019-14868: Fixed code injection due to environment variables on startup interpreted as arithmetic expression (bsc#1160796)

Other fixes:

do not use posix_spawn as it lacks proper job handling (bsc#1224057)
fix segfault in variable substitution (bsc#1129288)

Affected Packages

ksh

SUSE Linux Enterprise High Performance Computing 12SUSE Linux Enterprise Module for Legacy 12SUSE Linux Enterprise Server 12SUSE Linux Enterprise Server 12 SP3SUSE Linux Enterprise Server 12 SP4

Fixed in:

93vu-19.3.2

ksh-devel

SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

93vu-19.3.2

References

ADVISORY

https://bugzilla.suse.com/1129288

ADVISORY

https://bugzilla.suse.com/1160796

ADVISORY

https://bugzilla.suse.com/1224057

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2024-August/036291.html

ADVISORY

https://www.suse.com/security/cve/CVE-2019-14868/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2024/suse-su-20242756-1/