Security update for gpg2
SUSE Security Update: Security update for gpg2
| Announcement ID: | SUSE-SU-2015:2171-2 |
| Rating: | moderate |
| References: | #918089 #918090 #952347 #955753 |
| Affected Products: |
An update that solves two vulnerabilities and has two fixes is now available.
Description:
The gpg2 package was updated to fix the following security and non
security issues:
- CVE-2015-1606: Fixed invalid memory read using a garbled keyring
(bsc#918089).
- CVE-2015-1607: Fixed memcpy with overlapping ranges (bsc#918090).
- bsc#955753: Fixed a regression of "gpg --recv" due to keyserver import
filter (also boo#952347).
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 12-SP1:
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2015-922=1 - SUSE Linux Enterprise Desktop 12-SP1:
zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2015-922=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64):
- gpg2-2.0.24-3.2
- gpg2-debuginfo-2.0.24-3.2
- gpg2-debugsource-2.0.24-3.2
- SUSE Linux Enterprise Server 12-SP1 (noarch):
- gpg2-lang-2.0.24-3.2
- SUSE Linux Enterprise Desktop 12-SP1 (x86_64):
- gpg2-2.0.24-3.2
- gpg2-debuginfo-2.0.24-3.2
- gpg2-debugsource-2.0.24-3.2
- SUSE Linux Enterprise Desktop 12-SP1 (noarch):
- gpg2-lang-2.0.24-3.2