Security update for zziplib

SUSE Security Update: Security update for zziplib
Announcement ID: SUSE-SU-2017:1095-1
Rating: moderate
References: #1024517 #1024528 #1024531 #1024532 #1024533 #1024534 #1024535 #1024536 #1024537 #1024539
Affected Products:
  • SUSE Linux Enterprise Workstation Extension 12-SP2
  • SUSE Linux Enterprise Workstation Extension 12-SP1
  • SUSE Linux Enterprise Software Development Kit 12-SP2
  • SUSE Linux Enterprise Software Development Kit 12-SP1
  • SUSE Linux Enterprise Desktop 12-SP2
  • SUSE Linux Enterprise Desktop 12-SP1

  • An update that solves 8 vulnerabilities and has two fixes is now available.

    Description:


    This update for zziplib fixes the following issues:

    Secuirty issues fixed:
    - CVE-2017-5974: heap-based buffer overflow in __zzip_get32 (fetch.c)
    (bsc#1024517)
    - CVE-2017-5975: heap-based buffer overflow in __zzip_get64 (fetch.c)
    (bsc#1024528)
    - CVE-2017-5976: heap-based buffer overflow in zzip_mem_entry_extra_block
    (memdisk.c) (bsc#1024531)
    - CVE-2017-5977: invalid memory read in zzip_mem_entry_extra_block
    (memdisk.c) (bsc#1024534)
    - CVE-2017-5978: out of bounds read in zzip_mem_entry_new (memdisk.c)
    (bsc#1024533)
    - CVE-2017-5979: NULL pointer dereference in prescan_entry (fseeko.c)
    (bsc#1024535)
    - CVE-2017-5980: NULL pointer dereference in zzip_mem_entry_new
    (memdisk.c) (bsc#1024536)
    - CVE-2017-5981: assertion failure in seeko.c (bsc#1024539)
    - NULL pointer dereference in main (unzzipcat-mem.c) (bsc#1024532)
    - NULL pointer dereference in main (unzzipcat.c) (bsc#1024537)

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Workstation Extension 12-SP2:
      zypper in -t patch SUSE-SLE-WE-12-SP2-2017-638=1
    • SUSE Linux Enterprise Workstation Extension 12-SP1:
      zypper in -t patch SUSE-SLE-WE-12-SP1-2017-638=1
    • SUSE Linux Enterprise Software Development Kit 12-SP2:
      zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-638=1
    • SUSE Linux Enterprise Software Development Kit 12-SP1:
      zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-638=1
    • SUSE Linux Enterprise Desktop 12-SP2:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-638=1
    • SUSE Linux Enterprise Desktop 12-SP1:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-638=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64):
      • libzzip-0-13-0.13.62-9.1
      • libzzip-0-13-debuginfo-0.13.62-9.1
      • zziplib-debugsource-0.13.62-9.1
    • SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64):
      • libzzip-0-13-0.13.62-9.1
      • libzzip-0-13-debuginfo-0.13.62-9.1
      • zziplib-debugsource-0.13.62-9.1
    • SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64):
      • libzzip-0-13-0.13.62-9.1
      • libzzip-0-13-debuginfo-0.13.62-9.1
      • zziplib-debugsource-0.13.62-9.1
      • zziplib-devel-0.13.62-9.1
      • zziplib-devel-debuginfo-0.13.62-9.1
    • SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64):
      • libzzip-0-13-0.13.62-9.1
      • libzzip-0-13-debuginfo-0.13.62-9.1
      • zziplib-debugsource-0.13.62-9.1
      • zziplib-devel-0.13.62-9.1
      • zziplib-devel-debuginfo-0.13.62-9.1
    • SUSE Linux Enterprise Desktop 12-SP2 (x86_64):
      • libzzip-0-13-0.13.62-9.1
      • libzzip-0-13-debuginfo-0.13.62-9.1
      • zziplib-debugsource-0.13.62-9.1
    • SUSE Linux Enterprise Desktop 12-SP1 (x86_64):
      • libzzip-0-13-0.13.62-9.1
      • libzzip-0-13-debuginfo-0.13.62-9.1
      • zziplib-debugsource-0.13.62-9.1

    References: