CVE-2016-5746

libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.

libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.

libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.

libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.

This update for libstorage fixes the following issues:

• Use stdin, not tmp files for passwords (bsc#986971, CVE-2016-5746)

This update for yast2-storage provides the following fixes:

Security issues fixed:

• Use standard IPC, and not temporary files, to pass passwords between processes. (bsc#986971, CVE-2016-5746)

Non security bugs fixed:

• Fix usage of complete multipath disk as LVM physical volume. (bsc#984245)
• Load the correct multipath module (dm-multipath). (bsc#937942)
• Improve message for creating volumes with a filesystem but without a mount point. (bsc#996208)

This update for libstorage fixes the following issues:

• Use stdin, not tmp files for passwords (bsc#986971, CVE-2016-5746)