Security update for libarchive
SUSE Security Update: Security update for libarchive
libarchive was updated to fix a directory traversal in the bsdcpio tool,
which allowed attackers supplying crafted archives to overwrite files.
(CVE-2015-2304)
Also, a integer overflow was fixed that could also overflow buffers.
(CVE-2013-0211)
Announcement ID: | SUSE-SU-2015:0667-1 |
Rating: | moderate |
References: | #800024 #920870 |
Affected Products: |
An update that fixes two vulnerabilities is now available.
Description:
libarchive was updated to fix a directory traversal in the bsdcpio tool,
which allowed attackers supplying crafted archives to overwrite files.
(CVE-2015-2304)
Also, a integer overflow was fixed that could also overflow buffers.
(CVE-2013-0211)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 12:
zypper in -t patch SUSE-SLE-SDK-12-2015-155=1
- SUSE Linux Enterprise Server 12:
zypper in -t patch SUSE-SLE-SERVER-12-2015-155=1
- SUSE Linux Enterprise Desktop 12:
zypper in -t patch SUSE-SLE-DESKTOP-12-2015-155=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64):
- libarchive-debugsource-3.1.2-9.1
- libarchive-devel-3.1.2-9.1
- SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64):
- libarchive-debugsource-3.1.2-9.1
- libarchive13-3.1.2-9.1
- libarchive13-debuginfo-3.1.2-9.1
- SUSE Linux Enterprise Desktop 12 (x86_64):
- libarchive-debugsource-3.1.2-9.1
- libarchive13-3.1.2-9.1
- libarchive13-debuginfo-3.1.2-9.1
References:
- https://www.suse.com/security/cve/CVE-2013-0211.html
- https://www.suse.com/security/cve/CVE-2015-2304.html
- https://bugzilla.suse.com/800024
- https://bugzilla.suse.com/920870