Security update for clamsap

Announcement ID:	SUSE-SU-2016:0807-1
Rating:	moderate
References:	bsc#935939
Cross-References:	CVE-2015-2278 CVE-2015-2282
CVSS scores:
Affected Products:	SLES for SAP Applications 11-SP4

An update that solves two vulnerabilities can now be installed.

Description:

This update fixes the following security issues:

CVE-2015-2278: The LZH decompression implementation allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes.

CVE-2015-2282: Stack-based buffer overflow in the LZC decompression implementation allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SLES for SAP Applications 11-SP4
  zypper in -t patch slesappsp4-clamsap-12462=1

Package List:

• SLES for SAP Applications 11-SP4 (ppc64 x86_64)
  • clamsap-0.98.9-0.7.1

References:

• https://www.suse.com/security/cve/CVE-2015-2278.html
• https://www.suse.com/security/cve/CVE-2015-2282.html
• https://bugzilla.suse.com/show_bug.cgi?id=935939