Security update for rpcbind

The update to rpcbind 1.2.9 fixes a stack buffer overflow vulnerability in rpcinfo's rpcbaddrlist() function, which could potentially lead to memory corruption. It also stops unauthenticated oversized memory allocations during PMAPPROC_CALLIT decode, mitigating a potential attack vector. Several memory leaks in read_warmstart(), network_init(), and init_transport() functions are fixed to improve stability and security. Additional hardening options were added to the systemd rpcbind service file, and configuration files were moved to more appropriate runtime directories. These fixes collectively enhance the security posture of rpcbind.

The fixed stack buffer overflow could have allowed an attacker to cause memory corruption, potentially leading to denial of service or code execution. The unauthenticated oversized allocation issue could have been exploited to cause resource exhaustion or other unintended behavior. Memory leaks could degrade service availability over time. Overall, these vulnerabilities could impact system stability and security if left unpatched.

Apply the update to rpcbind version 1.2.9 or later as provided by the SUSE Product Security Team. This update contains official fixes for the identified vulnerabilities and memory leaks. No additional mitigation steps are indicated beyond applying this security update.