openSUSE-SU-2019:2607-1 Recommended update for openafs
OpenAFS server RPC handling flaws allow attackers to cause memory corruption, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2019:2607-1?
openSUSE-SU-2019:2607-1 is a memory corruption vulnerability in openafs, published on 1 Dec 2019. It can be exploited over the network, with no action from the victim.
Official description
This update for openafs fixes the following issues:
Update to security-release 1.8.5, adresses:
- OPENAFS-SA-2019-001: Skip server OUT args on error
- OPENAFS-SA-2019-002: Zero all server RPC args
- OPENAFS-SA-2019-003: ubik: Avoid unlocked ubik_currentTrans deref
update to official version 1.8.4
- support Linux-kernel 5.3
- Avoid non-dir ENOENT errors in afs_lookup
- fix parsing of fileservers with -vlruthresh, etc.
- other bugfixes
update to pre-release 1.8.4pre2
- fix builds for Linux-kernels 5.3
update to 1.8.3
- fix broken directory layout
- allow crypt to be set/unset on startup of client
update to pre-release 1.8.3pre1
- fix builds for Linux-kernels 4.20 and 5.0
- other fixes, see RELNOTES-1.8.3pre1
Which versions are affected by openSUSE-SU-2019:2607-1?
Linux distribution packages (1)
openafs openSUSE:Leap 15.1 | All versions | 1.8.5-lp151.2.3.1 |
How do I fix openSUSE-SU-2019:2607-1?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is openSUSE-SU-2019:2607-1 being exploited?
There is no known exploitation of openSUSE-SU-2019:2607-1 in the wild and no public exploit code.