Security update for util-linux SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:2203-1 Final 1 1 2018-08-06T08:45:16Z current 2018-08-06T08:45:16Z 2018-08-06T08:45:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for util-linux This update for util-linux fixes the following issues: This non-security issue was fixed: - CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300). These non-security issues were fixed: - Fixed crash loop in lscpu (bsc#1072947). - Fixed possible segfault of umount -a - Fixed mount -a on NFS bind mounts (bsc#1080740). - Fixed lsblk on NVMe (bsc#1078662). This update was imported from the SUSE:SLE-12-SP3:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00006.html E-Mail link for openSUSE-SU-2018:2203-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libblkid-devel-2.29.2-8.1 libblkid-devel-32bit-2.29.2-8.1 libblkid-devel-static-2.29.2-8.1 libblkid1-2.29.2-8.1 libblkid1-32bit-2.29.2-8.1 libfdisk-devel-2.29.2-8.1 libfdisk-devel-static-2.29.2-8.1 libfdisk1-2.29.2-8.1 libmount-devel-2.29.2-8.1 libmount-devel-32bit-2.29.2-8.1 libmount-devel-static-2.29.2-8.1 libmount1-2.29.2-8.1 libmount1-32bit-2.29.2-8.1 libsmartcols-devel-2.29.2-8.1 libsmartcols-devel-static-2.29.2-8.1 libsmartcols1-2.29.2-8.1 libuuid-devel-2.29.2-8.1 libuuid-devel-32bit-2.29.2-8.1 libuuid-devel-static-2.29.2-8.1 libuuid1-2.29.2-8.1 libuuid1-32bit-2.29.2-8.1 python-libmount-2.29.2-8.1 util-linux-2.29.2-8.1 util-linux-lang-2.29.2-8.1 util-linux-systemd-2.29.2-8.1 uuidd-2.29.2-8.1 libblkid-devel-2.29.2-8.1 as a component of openSUSE Leap 42.3 libblkid-devel-32bit-2.29.2-8.1 as a component of openSUSE Leap 42.3 libblkid-devel-static-2.29.2-8.1 as a component of openSUSE Leap 42.3 libblkid1-2.29.2-8.1 as a component of openSUSE Leap 42.3 libblkid1-32bit-2.29.2-8.1 as a component of openSUSE Leap 42.3 libfdisk-devel-2.29.2-8.1 as a component of openSUSE Leap 42.3 libfdisk-devel-static-2.29.2-8.1 as a component of openSUSE Leap 42.3 libfdisk1-2.29.2-8.1 as a component of openSUSE Leap 42.3 libmount-devel-2.29.2-8.1 as a component of openSUSE Leap 42.3 libmount-devel-32bit-2.29.2-8.1 as a component of openSUSE Leap 42.3 libmount-devel-static-2.29.2-8.1 as a component of openSUSE Leap 42.3 libmount1-2.29.2-8.1 as a component of openSUSE Leap 42.3 libmount1-32bit-2.29.2-8.1 as a component of openSUSE Leap 42.3 libsmartcols-devel-2.29.2-8.1 as a component of openSUSE Leap 42.3 libsmartcols-devel-static-2.29.2-8.1 as a component of openSUSE Leap 42.3 libsmartcols1-2.29.2-8.1 as a component of openSUSE Leap 42.3 libuuid-devel-2.29.2-8.1 as a component of openSUSE Leap 42.3 libuuid-devel-32bit-2.29.2-8.1 as a component of openSUSE Leap 42.3 libuuid-devel-static-2.29.2-8.1 as a component of openSUSE Leap 42.3 libuuid1-2.29.2-8.1 as a component of openSUSE Leap 42.3 libuuid1-32bit-2.29.2-8.1 as a component of openSUSE Leap 42.3 python-libmount-2.29.2-8.1 as a component of openSUSE Leap 42.3 util-linux-2.29.2-8.1 as a component of openSUSE Leap 42.3 util-linux-lang-2.29.2-8.1 as a component of openSUSE Leap 42.3 util-linux-systemd-2.29.2-8.1 as a component of openSUSE Leap 42.3 uuidd-2.29.2-8.1 as a component of openSUSE Leap 42.3 In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion. CVE-2018-7738 openSUSE Leap 42.3:libblkid-devel-2.29.2-8.1 openSUSE Leap 42.3:libblkid-devel-32bit-2.29.2-8.1 openSUSE Leap 42.3:libblkid-devel-static-2.29.2-8.1 openSUSE Leap 42.3:libblkid1-2.29.2-8.1 openSUSE Leap 42.3:libblkid1-32bit-2.29.2-8.1 openSUSE Leap 42.3:libfdisk-devel-2.29.2-8.1 openSUSE Leap 42.3:libfdisk-devel-static-2.29.2-8.1 openSUSE Leap 42.3:libfdisk1-2.29.2-8.1 openSUSE Leap 42.3:libmount-devel-2.29.2-8.1 openSUSE Leap 42.3:libmount-devel-32bit-2.29.2-8.1 openSUSE Leap 42.3:libmount-devel-static-2.29.2-8.1 openSUSE Leap 42.3:libmount1-2.29.2-8.1 openSUSE Leap 42.3:libmount1-32bit-2.29.2-8.1 openSUSE Leap 42.3:libsmartcols-devel-2.29.2-8.1 openSUSE Leap 42.3:libsmartcols-devel-static-2.29.2-8.1 openSUSE Leap 42.3:libsmartcols1-2.29.2-8.1 openSUSE Leap 42.3:libuuid-devel-2.29.2-8.1 openSUSE Leap 42.3:libuuid-devel-32bit-2.29.2-8.1 openSUSE Leap 42.3:libuuid-devel-static-2.29.2-8.1 openSUSE Leap 42.3:libuuid1-2.29.2-8.1 openSUSE Leap 42.3:libuuid1-32bit-2.29.2-8.1 openSUSE Leap 42.3:python-libmount-2.29.2-8.1 openSUSE Leap 42.3:util-linux-2.29.2-8.1 openSUSE Leap 42.3:util-linux-lang-2.29.2-8.1 openSUSE Leap 42.3:util-linux-systemd-2.29.2-8.1 openSUSE Leap 42.3:uuidd-2.29.2-8.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00006.html https://www.suse.com/security/cve/CVE-2018-7738.html CVE-2018-7738 https://bugzilla.suse.com/1080740 SUSE Bug 1080740 https://bugzilla.suse.com/1084300 SUSE Bug 1084300