coreutils-8.4-31.2.0.1.AXS4

エラータID: AXSA:2014-028:01

Release date: 
Tuesday, March 11, 2014 - 13:02
Subject: 
coreutils-8.4-31.2.0.1.AXS4
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

These are the GNU core utilities. This package is the combination of the old GNU fileutils, sh-utils, and textutils packages.

Security issues fixed with this release:

• CVE-2013-0221
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.

• CVE-2013-0222
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.

• CVE-2013-0223
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.

Solution: 

Update packages.

CVEs: 
CVE-2013-0221
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
CVE-2013-0222
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.
CVE-2013-0223
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.




Additional Info: 

N/A

Download: 

SRPMS
  1. coreutils-8.4-31.2.0.1.AXS4.src.rpm
    MD5: 79d89f1d9770e36b25d3f9c053344b8a
    SHA-256: 2c9c5f5032523e69b85b4768e5a9d395fe4f8776861a4519b9c2a84875427749
    Size: 4.43 MB

Asianux Server 4 for x86
  1. coreutils-8.4-31.2.0.1.AXS4.i686.rpm
    MD5: e04da91356f763fc9c8f07042ef73b80
    SHA-256: b2d45e48236458c05fa7b82de14334c7d40bf0123b81ffaf8b9d75443491613d
    Size: 3.00 MB
  2. coreutils-libs-8.4-31.2.0.1.AXS4.i686.rpm
    MD5: c8006d488e316a6522ab77ac94b10c42
    SHA-256: e4f40ad0f8c28ac30d67a5e0b1254ce0406d0b1b8e26be2220abe2278a3e4191
    Size: 48.98 kB

Asianux Server 4 for x86_64
  1. coreutils-8.4-31.2.0.1.AXS4.x86_64.rpm
    MD5: 30ec37dfb6aef7bad8e13611d724ba27
    SHA-256: 454e60f27c7d2b504d16fe77b1c14520d1486998e566abf13a0c4c0655e08942
    Size: 3.04 MB
  2. coreutils-libs-8.4-31.2.0.1.AXS4.x86_64.rpm
    MD5: ab6e576c5580aa125667103f9ac2490b
    SHA-256: 98d2ba150e67dbbdba859c81985e08fa81ef311cad430af15f0c8f5a86347f04
    Size: 48.59 kB