Security update for netatalk

SUSE Security Update: Security update for netatalk
Announcement ID: SUSE-SU-2022:1184-1
Rating: important
References: #1197352
Cross-References:CVE-2021-31439 CVE-2022-23121 CVE-2022-23125
Affected Products:
  • SUSE Linux Enterprise Desktop 12-SP5
  • SUSE Linux Enterprise Server 12-SP5
  • SUSE Linux Enterprise Server for SAP Applications 12-SP5
  • SUSE Linux Enterprise Software Development Kit 12-SP5
  • SUSE Linux Enterprise Workstation Extension 12-SP5

An update that fixes three vulnerabilities is now available.

Description:

This update for netatalk fixes the following issues:

  • CVE-2022-23125: Fixed remote arbitrary code execution related to copyapplfile().
  • CVE-2022-23121: Fixed remote arbitrary code execution related to parse_entries().
  • CVE-2021-31439: Fixed remote arbitrary code execution related to dsi_stream_receive().

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Workstation Extension 12-SP5:
    zypper in -t patch SUSE-SLE-WE-12-SP5-2022-1184=1
  • SUSE Linux Enterprise Software Development Kit 12-SP5:
    zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-1184=1

Package List:

  • SUSE Linux Enterprise Workstation Extension 12-SP5 (x86_64):
    • libatalk12-3.1.0-3.8.1
    • libatalk12-debuginfo-3.1.0-3.8.1
    • netatalk-3.1.0-3.8.1
    • netatalk-debuginfo-3.1.0-3.8.1
    • netatalk-debugsource-3.1.0-3.8.1
  • SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64):
    • libatalk12-3.1.0-3.8.1
    • libatalk12-debuginfo-3.1.0-3.8.1
    • netatalk-3.1.0-3.8.1
    • netatalk-debuginfo-3.1.0-3.8.1
    • netatalk-debugsource-3.1.0-3.8.1
    • netatalk-devel-3.1.0-3.8.1

References: