Security update for perl

Announcement ID: SUSE-SU-2018:1328-2
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2018-12015 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
  • CVE-2018-12015 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2018-6797 ( SUSE ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE-2018-6797 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2018-6798 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CVE-2018-6913 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP2
  • SUSE Linux Enterprise Server 12 SP2
  • SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
  • SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2

An update that solves four vulnerabilities and has one security fix can now be installed.

Description:

This update for perl fixes the following issues:

These security issue were fixed:

  • CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216).
  • CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233).
  • CVE-2018-6797: Fixed sharp-s regexp overflow (bsc#1082234).
  • CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718)

This non-security issue was fixed:

  • fix debugger crash in tab completion with Term::ReadLine::Gnu [bsc#1068565]

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
    zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2018-1328=1
  • SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2
    zypper in -t patch SUSE-SLE-SERVER-12-SP2-ESPOS-2018-1328=1

Package List:

  • SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64)
    • perl-debugsource-5.18.2-12.14.1
    • perl-debuginfo-32bit-5.18.2-12.14.1
    • perl-5.18.2-12.14.1
    • perl-32bit-5.18.2-12.14.1
    • perl-base-debuginfo-5.18.2-12.14.1
    • perl-base-5.18.2-12.14.1
    • perl-debuginfo-5.18.2-12.14.1
  • SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (noarch)
    • perl-doc-5.18.2-12.14.1
  • SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 (x86_64)
    • perl-debugsource-5.18.2-12.14.1
    • perl-debuginfo-32bit-5.18.2-12.14.1
    • perl-5.18.2-12.14.1
    • perl-32bit-5.18.2-12.14.1
    • perl-base-debuginfo-5.18.2-12.14.1
    • perl-base-5.18.2-12.14.1
    • perl-debuginfo-5.18.2-12.14.1
  • SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 (noarch)
    • perl-doc-5.18.2-12.14.1

References: