Security update for libwmf

Announcement ID:	SUSE-SU-2015:1484-1
Rating:	moderate
References:	bsc#495842 bsc#831299 bsc#933109 bsc#936058 bsc#936062
Cross-References:	CVE-2009-1364 CVE-2015-0848 CVE-2015-4588 CVE-2015-4695 CVE-2015-4696
CVSS scores:
Affected Products:	SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Bootstrap Kit 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Workstation Extension 12

An update that solves five vulnerabilities can now be installed.

Description:

libwmf was updated to fix five security issues.

These security issues were fixed: - CVE-2009-1364: Fixed realloc return value usage (bsc#495842, bnc#831299) - CVE-2015-0848: Heap overflow on libwmf0.2-7 (bsc#933109) - CVE-2015-4588: DecodeImage() did not check that the run-length "count" fits into the total size of the image, which could lead to a heap-based buffer overflow (bsc#933109) - CVE-2015-4695: meta_pen_create heap buffer over read (bsc#936058) - CVE-2015-4696: Use after free (bsc#936062)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Software Bootstrap Kit 12
  zypper in -t patch SUSE-SLE-BSK-12-2015-481=1
• SUSE Linux Enterprise Desktop 12
  zypper in -t patch SUSE-SLE-DESKTOP-12-2015-481=1
• SUSE Linux Enterprise Software Development Kit 12
  zypper in -t patch SUSE-SLE-SDK-12-2015-481=1
• SUSE Linux Enterprise Workstation Extension 12
  zypper in -t patch SUSE-SLE-WE-12-2015-481=1

Package List:

• SUSE Linux Enterprise Software Bootstrap Kit 12 (ppc64le s390x x86_64)
  • libwmf-tools-debuginfo-0.2.8.4-242.3
  • libwmf-tools-0.2.8.4-242.3
  • libwmf-debugsource-0.2.8.4-242.3
• SUSE Linux Enterprise Desktop 12 (x86_64)
  • libwmf-0_2-7-debuginfo-0.2.8.4-242.3
  • libwmf-0_2-7-0.2.8.4-242.3
  • libwmf-debugsource-0.2.8.4-242.3
• SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64)
  • libwmf-0_2-7-debuginfo-0.2.8.4-242.3
  • libwmf-0_2-7-0.2.8.4-242.3
  • libwmf-debugsource-0.2.8.4-242.3
  • libwmf-gnome-0.2.8.4-242.3
  • libwmf-devel-0.2.8.4-242.3
  • libwmf-gnome-debuginfo-0.2.8.4-242.3
• SUSE Linux Enterprise Workstation Extension 12 (x86_64)
  • libwmf-0_2-7-debuginfo-0.2.8.4-242.3
  • libwmf-0_2-7-0.2.8.4-242.3
  • libwmf-debugsource-0.2.8.4-242.3

References:

• https://www.suse.com/security/cve/CVE-2009-1364.html
• https://www.suse.com/security/cve/CVE-2015-0848.html
• https://www.suse.com/security/cve/CVE-2015-4588.html
• https://www.suse.com/security/cve/CVE-2015-4695.html
• https://www.suse.com/security/cve/CVE-2015-4696.html
• https://bugzilla.suse.com/show_bug.cgi?id=495842
• https://bugzilla.suse.com/show_bug.cgi?id=831299
• https://bugzilla.suse.com/show_bug.cgi?id=933109
• https://bugzilla.suse.com/show_bug.cgi?id=936058
• https://bugzilla.suse.com/show_bug.cgi?id=936062