Security update for memcached

Announcement ID:	SUSE-SU-2018:0807-1
Rating:	important
References:	bsc#1007869 bsc#1007870 bsc#1007871 bsc#1056865 bsc#798458 bsc#817781 bsc#857188 bsc#858676 bsc#858677
Cross-References:	CVE-2011-4971 CVE-2013-0179 CVE-2013-7239 CVE-2013-7290 CVE-2013-7291 CVE-2016-8704 CVE-2016-8705 CVE-2016-8706 CVE-2017-9951
CVSS scores:	CVE-2016-8704 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8705 ( SUSE ): 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2016-8705 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8706 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-9951 ( SUSE ): 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2017-9951 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Server 12 SP1 SUSE OpenStack Cloud 6

An update that solves nine vulnerabilities can now be installed.

Description:

This update for memcached fixes the following issues:

Security issues fixed:

• CVE-2011-4971: remote DoS (bsc#817781).
• CVE-2013-0179: DoS when printing out keys to be deleted in verbose mode (bsc#798458).
• CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).
• CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).
• CVE-2013-7291: remote DoS (crash) via a request that triggers "unbounded key print" (bsc#858676).
• CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).
• CVE-2016-8705: Server update remote code execution (bsc#1007870).
• CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).
• CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE OpenStack Cloud 6
  zypper in -t patch SUSE-OpenStack-Cloud-6-2018-545=1

Package List:

• SUSE OpenStack Cloud 6 (x86_64)
  • memcached-1.4.39-3.3.1
  • memcached-debugsource-1.4.39-3.3.1
  • memcached-debuginfo-1.4.39-3.3.1

References:

• https://www.suse.com/security/cve/CVE-2011-4971.html
• https://www.suse.com/security/cve/CVE-2013-0179.html
• https://www.suse.com/security/cve/CVE-2013-7239.html
• https://www.suse.com/security/cve/CVE-2013-7290.html
• https://www.suse.com/security/cve/CVE-2013-7291.html
• https://www.suse.com/security/cve/CVE-2016-8704.html
• https://www.suse.com/security/cve/CVE-2016-8705.html
• https://www.suse.com/security/cve/CVE-2016-8706.html
• https://www.suse.com/security/cve/CVE-2017-9951.html
• https://bugzilla.suse.com/show_bug.cgi?id=1007869
• https://bugzilla.suse.com/show_bug.cgi?id=1007870
• https://bugzilla.suse.com/show_bug.cgi?id=1007871
• https://bugzilla.suse.com/show_bug.cgi?id=1056865
• https://bugzilla.suse.com/show_bug.cgi?id=798458
• https://bugzilla.suse.com/show_bug.cgi?id=817781
• https://bugzilla.suse.com/show_bug.cgi?id=857188
• https://bugzilla.suse.com/show_bug.cgi?id=858676
• https://bugzilla.suse.com/show_bug.cgi?id=858677