CVE-2019-3688

This update for permissions fixes the following issues:

• CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid which could have allowed a squid user to gain persistence by changing the binary (bsc#1093414).
• CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic links (bsc#1150734).
• Fixed a regression which caused sagmentation fault (bsc#1157198).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for permissions fixes the following issues:

Update to version 20200127:

• Makefile: Leap 15.3 still uses /etc, so adjust the installation setup

Update to version 20181225:

• mgetty: faxq-helper now finally reside in /usr/libexec
• libksysguard5: Updated path for ksgrd_network_helper
• kdesu: Updated path for kdesud
• sbin_dirs cleanup: these binaries have already been moved to /usr/sbin
• mariadb: revert auth_pam_tool to /usr/lib{,64} again
• cleanup: revert virtualbox back to plain /usr/lib
• cleanup: remove deprecated /etc/ssh/sshd_config
• hawk_invoke is not part of newer hawk2 packages anymore
• cleanup: texlive-filesystem: public now resides in libexec
• cleanup: authbind: helper now resides in libexec
• cleanup: polkit: the agent now also resides in libexec
• libexec cleanup: 'inn' news binaries now reside in libexec
• whitelist please (boo#1183669)
• Fix enlightenment paths
• usbauth: drop compatibility variable for libexec
• usbauth: Updated path for usbauth-npriv
• profiles: finish usage of variable for polkit-agent-helper-1
• Makefile: fix custom flags support when using make command line variables
• added information about know limitations of this approach
• Makefile: compile with LFO support to fix 32-bit emulation on 64-bit hosts (boo#1178476)
• Makefile: support CXXFLAGS and LDFLAGS override / extension via make/env variables (boo#1178475)
• profiles: prepare /usr/sbin versions of profile entries (boo#1029961)
• profiles: use new variables feature to remove redundant entries
• profiles: remove now superfluous squid pinger paths (boo#1171569)
• tests: implement basic tests for new the new variable feature
• tests: avoid redundant specification of test names by using class names
• regtests: split up base types and actual test implementation
• man pages: add documentation about variables, update copyrights
• chkstat: implement support for variables in profile paths
• chkstat: prepare reuse of config file locations
• chkstat: fix some typos and whitespace
• etc/permissions: remove unnecessary, duplicate, outdated entries
• etc/permissions: remove trailing whitespace
• ksgrd_network_helper: remove obviously wrong path
• adjust squid pinger path (boo#1171569)
• mgetty: remove long dead (or never existing) locks directory (boo#1171882)
• squid: remove basic_pam_auth which doesn't need special perms (boo#1171569)
• cleanup now useless /usr/lib entries after move to /usr/libexec (boo#1171164)
• drop (f)ping capabilities in favor of ICMP_PROTO sockets (boo#1174504)
• whitelist Xorg setuid-root wrapper (boo#1175867)
• screen: remove /run/uscreens covered by systemd-tmpfiles (boo#1171879)
• Add /usr/libexec for cockpit-session as new path
• physlock: whitelist with tight restrictions (boo#1175720)
• mtr-packet: stop requiring dialout group
• etc/permissions: fix mtr permission
• list_permissions: improve output format
• list_permissions: support globbing in --path argument
• list_permissions: implement simplifications suggested in PR#92
• list_permissions: new tool for better path configuration overview
• regtest: support new getcap output format in libcap-2.42
• regtest: print individual test case errors to stderr
• etc/permissions: remove static /var/spool/* dirs
• etc/permissions: remove outdated entries
• etc/permissions: remove unnecessary static dirs and devices
• screen: remove now unused /var/run/uscreens
• Revert 'etc/permissions: remove entries for bind-chrootenv'
• rework permissions.local text (boo#1173221)
• dbus-1: adjust to new libexec dir location (boo#1171164)
• permission profiles: reinstate kdesud for kde5
• etc/permissions: remove entries for bind-chrootenv
• etc/permissions: remove traceroute entry
• VirtualBox: remove outdated entry which is only a symlink any more
• /bin/su: remove path refering to symlink
• etc/permissions: remove legacy RPM directory entries
• /etc/permissions: remove outdated sudo directories
• singularity: remove outdated setuid-binary entries
• chromium: remove…

These are all security issues fixed in the chkstat-1550_20210901-29.2 package on the GA media of openSUSE Tumbleweed.

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update for permissions fixes the following issues:

• CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid which could have allowed a squid user to gain persistence by changing the binary (bsc#1093414).
• CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic links (bsc#1150734).
• Fixed a regression which caused segmentation fault (bsc#1157198).

This update for permissions fixes the following issues:

• CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid which could have allowed a squid user to gain persistence by changing the binary (bsc#1093414).
• CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic links (bsc#1150734).
• Fixed a regression which caused sagmentation fault (bsc#1157198).

This update for permissions fixes the following issues:

Security issues fixed:

• CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid which could have allowed a squid user to gain persistence by changing the binary (bsc#1093414).
• CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic links (bsc#1150734).

Other issue addressed:

• Corrected a badly constracted file which could have allowed treating of the shell environment as permissions files (bsc#1097665,bsc#1047247).
• Fixed a regression which caused sagmentation fault (bsc#1157198).

This update for permissions fixes the following issues:

Security issue fixed:

• CVE-2020-8013: Fixed a local privilege escalation with mrsh and wodim (bsc#1163922).

Non-security issues fixed:

• Fixed regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
• Fixed capability handling when doing multiple permission changes at once (bsc#1161779)
• Fixed handling of relative directory symlinks in chkstat

This update for permissions fixes the following issues:

• Fork package for 12-SP5 (bsc#1155939)
• make btmp root:utmp (bsc#1050467, bsc#1182899)
• pcp: remove no longer needed / conflicting entries (bsc#1171883). Fixes a potential security issue.
• do not follow symlinks that are the final path element (CVE-2020-8013, bsc#1163922)
• fix handling of relative directory symlinks in chkstat
• whitelist postgres sticky directories (bsc#1123886)
• fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
• fix capability handling when doing multiple permission changes at once (bsc#1161779,
• fix invalid free() when permfiles points to argv (bsc#1157198)
• the eror should be reported for permfiles[i], not argv[i], as these are not the same files. (bsc#1047247, bsc#1097665)
• fix /usr/sbin/pinger ownership to root:squid (bsc#1093414, CVE-2019-3688)
• fix privilege escalation through untrusted symlinks (bsc#1150734, CVE-2019-3690)