{"affected":[{"ecosystem_specific":{"binaries":[{"libprocps3":"3.3.9-11.18.1","procps":"3.3.9-11.18.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","name":"procps","purl":"purl:rpm/suse/procps&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.3.9-11.18.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"\n  \nThis update for procps fixes the following security issues:\n\n- CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top\n  with HOME unset in an attacker-controlled directory, the attacker could have\n  achieved privilege escalation by exploiting one of several vulnerabilities in\n  the config_file() function (bsc#1092100).\n- CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow.\n  Inbuilt protection in ps maped a guard page at the end of the overflowed\n  buffer, ensuring that the impact of this flaw is limited to a crash (temporary\n  denial of service) (bsc#1092100).\n- CVE-2018-1124: Prevent multiple integer overflows leading to a heap\n  corruption in file2strvec function. This allowed a privilege escalation for a\n  local attacker who can create entries in procfs by starting processes, which\n  could result in crashes or arbitrary code execution in proc utilities run by\n  other users (bsc#1092100).\n- CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was\n  mitigated by FORTIFY limiting the impact to a crash (bsc#1092100).\n- CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent\n  truncation/integer overflow issues (bsc#1092100).\n\n(These issues were previously released for SUSE Linux Enterprise 12 SP3 and SP4.)\n\nAlso the following non-security issue was fixed:\n\n- Fix CPU summary showing old data. (bsc#1121753)\n","id":"SUSE-SU-2019:0450-2","modified":"2019-04-27T13:16:38Z","published":"2019-04-27T13:16:38Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190450-2/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1092100"},{"type":"REPORT","url":"https://bugzilla.suse.com/1121753"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-1122"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-1123"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-1124"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-1125"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-1126"}],"related":["CVE-2018-1122","CVE-2018-1123","CVE-2018-1124","CVE-2018-1125","CVE-2018-1126"],"summary":"Security update for procps"}