Security update for libvdpau
| Announcement ID: | SUSE-SU-2015:1925-1 |
|---|---|
| Rating: | moderate |
| References: | |
| Cross-References: | |
| CVSS scores: |
|
| Affected Products: |
|
An update that solves three vulnerabilities can now be installed.
Description:
libvdpau was updated to use secure_getenv() instead of getenv() for several variables so it can be more safely used in setuid applications.
- CVE-2015-5198: libvdpau: incorrect check for security transition (bnc#943967)
- CVE-2015-5199: libvdpau: directory traversal in dlopen (bnc#943968)
- CVE-2015-5200: libvdpau: vulnerability in trace functionality (bnc#943969)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Desktop 11 SP3
zypper in -t patch sledsp3-libvdpau-12192=1 -
SUSE Linux Enterprise Desktop 11 SP4
zypper in -t patch sledsp4-libvdpau-12192=1
Package List:
-
SUSE Linux Enterprise Desktop 11 SP3 (x86_64 i586)
- libvdpau1-0.4.1-16.20.2
-
SUSE Linux Enterprise Desktop 11 SP3 (x86_64)
- libvdpau1-32bit-0.4.1-16.20.2
-
SUSE Linux Enterprise Desktop 11 SP4 (x86_64 i586)
- libvdpau1-0.4.1-16.20.2
-
SUSE Linux Enterprise Desktop 11 SP4 (x86_64)
- libvdpau1-32bit-0.4.1-16.20.2
References:
- https://www.suse.com/security/cve/CVE-2015-5198.html
- https://www.suse.com/security/cve/CVE-2015-5199.html
- https://www.suse.com/security/cve/CVE-2015-5200.html
- https://bugzilla.suse.com/show_bug.cgi?id=943967
- https://bugzilla.suse.com/show_bug.cgi?id=943968
- https://bugzilla.suse.com/show_bug.cgi?id=943969