shield Security update for sudo

SUSE-SLE-SERVER-12-SP1-2016-1692

This update for sudo fixes the following security issues: - Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality: * noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766] * noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501] - Fix unsafe handling of TZ environment variable. [CVE-2014-9680, bsc#917806] Additionally, these non-security fixes are included in the update: - Fix "ignoring time stamp from the future" message after each boot with !tty_tickets. [bsc#899252] - Enable support for SASL-based authentication. [bsc#979531]

• Release Date
  Nov 24 2016
• References
  Bugzilla: 917806, 1007766, 1007501, 899252, 979531
  CVEs: CVE-2014-9680, CVE-2016-7032, CVE-2016-7076
• Type
  security
• Severity
  moderate

cloud_download Downloads

SUSE Linux Enterprise Server 12.1 ppc64le

• Packages
  sudo
  Execute some commands as root

  1.8.10p3-2.6.1 lock rpm lock src

SUSE Linux Enterprise Server 12.1 s390x

• Packages
  sudo
  Execute some commands as root

  1.8.10p3-2.6.1 lock rpm lock src

SUSE Linux Enterprise Server for SAP Applications 12.1 x86_64

• Packages
  sudo
  Execute some commands as root

  1.8.10p3-2.6.1 lock rpm lock src