Security update for libmspack
| Announcement ID: | SUSE-SU-2015:2215-1 |
| Rating: | moderate |
| References: | #934524 #934525 #934526 #934527 #934528 #934529 |
| Affected Products: |
An update that fixes 6 vulnerabilities is now available.
Description:
libmspack was updated to fix several security vulnerabilities.
- Fix null pointer dereference on a crafted CAB. (bsc#934524,
CVE-2014-9732)
- Fix denial of service while processing crafted CHM file. (bsc#934525,
CVE-2015-4467)
- Fix denial of service while processing crafted CHM file. (bsc#934529,
CVE-2015-4472)
- Fix pointer arithmetic overflow during CHM decompression. (bsc#934526,
CVE-2015-4469)
- Fix off-by-one buffer over-read in mspack/mszipd.c. (bsc#934527,
CVE-2015-4470)
- Fix off-by-one buffer under-read in mspack/lzxd.c. (bsc#934528,
CVE-2015-4471)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11-SP4:
zypper in -t patch sdksp4-libmspack-12249=1 - SUSE Linux Enterprise Software Development Kit 11-SP3:
zypper in -t patch sdksp3-libmspack-12249=1 - SUSE Linux Enterprise Server for VMWare 11-SP3:
zypper in -t patch slessp3-libmspack-12249=1 - SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-libmspack-12249=1 - SUSE Linux Enterprise Server 11-SP3:
zypper in -t patch slessp3-libmspack-12249=1 - SUSE Linux Enterprise Desktop 11-SP4:
zypper in -t patch sledsp4-libmspack-12249=1 - SUSE Linux Enterprise Desktop 11-SP3:
zypper in -t patch sledsp3-libmspack-12249=1 - SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-libmspack-12249=1 - SUSE Linux Enterprise Debuginfo 11-SP3:
zypper in -t patch dbgsp3-libmspack-12249=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- libmspack-devel-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64):
- libmspack-devel-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64):
- libmspack0-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- libmspack0-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64):
- libmspack0-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64):
- libmspack0-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64):
- libmspack0-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- libmspack-debuginfo-0.0.20060920alpha-74.10.1
- libmspack-debugsource-0.0.20060920alpha-74.10.1
- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64):
- libmspack-debuginfo-0.0.20060920alpha-74.10.1
- libmspack-debugsource-0.0.20060920alpha-74.10.1
References:
- https://www.suse.com/security/cve/CVE-2014-9732.html
- https://www.suse.com/security/cve/CVE-2015-4467.html
- https://www.suse.com/security/cve/CVE-2015-4469.html
- https://www.suse.com/security/cve/CVE-2015-4470.html
- https://www.suse.com/security/cve/CVE-2015-4471.html
- https://www.suse.com/security/cve/CVE-2015-4472.html
- https://bugzilla.suse.com/934524
- https://bugzilla.suse.com/934525
- https://bugzilla.suse.com/934526
- https://bugzilla.suse.com/934527
- https://bugzilla.suse.com/934528
- https://bugzilla.suse.com/934529