Security update for flex, at, bogofilter, cyrus-imapd, kdelibs4, libQtWebKit4, libbonobo, mdbtools, netpbm, openslp, sgmltool, virtuoso, libqt5-qtwebkit

Announcement ID: SUSE-SU-2016:2397-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2016-6354 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise Desktop 12 SP1
  • SUSE Linux Enterprise Server 12 SP1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1
  • SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP1
  • SUSE Linux Enterprise Software Development Kit 12 SP1
  • SUSE Linux Enterprise Workstation Extension 12 SP1

An update that solves two vulnerabilities can now be installed.

Description:

Various packages included vulnerable parsers generated by "flex".

This update provides a fixed "flex" package and also rebuilds of packages that might have security issues caused by the auto generated code.

Flex itself was updated to fix a buffer overflow in the generated scanner (bsc#990856, CVE-2016-6354)

Packages that were rebuilt with the fixed flex: - at - bogofilter - cyrus-imapd - kdelibs4 - libQtWebKit4 - libbonobo - mdbtools - netpbm - openslp - sgmltool - virtuoso

Also libqt5-qtwebkit received an additional security fix: - CVE-2015-8079: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode (bsc#954210).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP1
    zypper in -t patch SUSE-SLE-BSK-12-SP1-2016-1390=1
  • SUSE Linux Enterprise Desktop 12 SP1
    zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1390=1
  • SUSE Linux Enterprise Software Development Kit 12 SP1
    zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1390=1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1
    zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1390=1
  • SUSE Linux Enterprise Server 12 SP1
    zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1390=1
  • SUSE Linux Enterprise Workstation Extension 12 SP1
    zypper in -t patch SUSE-SLE-WE-12-SP1-2016-1390=1

Package List:

  • SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP1 (ppc64le s390x x86_64)
    • kdelibs4-debuginfo-4.12.0-7.3
    • virtuoso-drivers-6.1.6-10.1
    • kdelibs4-doc-4.12.0-7.3
    • virtuoso-server-6.1.6-10.1
    • libkdecore4-devel-debuginfo-4.12.0-7.3
    • virtuoso-debugsource-6.1.6-10.1
    • virtuoso-server-debuginfo-6.1.6-10.1
    • libkdecore4-devel-4.12.0-7.3
    • kdelibs4-doc-debuginfo-4.12.0-7.3
    • kdelibs4-core-debuginfo-4.12.0-7.3
    • libmdbodbc1-0.7-5.1
    • kdelibs4-debugsource-4.12.0-7.3
    • mdbtools-devel-0.7-5.1
    • virtuoso-drivers-debuginfo-6.1.6-10.1
    • mdbtools-debuginfo-0.7-5.1
    • kdelibs4-branding-upstream-4.12.0-7.3
    • mdbtools-debugsource-0.7-5.1
    • libkde4-devel-4.12.0-7.3
    • libmdbodbc1-debuginfo-0.7-5.1
    • kdelibs4-core-4.12.0-7.3
  • SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
    • kdelibs4-debuginfo-4.12.0-7.3
    • libnetpbm11-32bit-10.66.3-4.1
    • libkde4-debuginfo-4.12.0-7.3
    • libQtWebKit4-debuginfo-4.8.6+2.3.3-3.1
    • openslp-2.0.0-11.1
    • at-debugsource-3.1.14-7.3
    • openslp-debugsource-2.0.0-11.1
    • netpbm-10.66.3-4.1
    • libkdecore4-debuginfo-32bit-4.12.0-7.3
    • libbonobo-2.32.1-16.1
    • libksuseinstall1-debuginfo-32bit-4.12.0-7.3
    • bogofilter-debuginfo-1.2.4-5.3
    • libkde4-debuginfo-32bit-4.12.0-7.3
    • libkdecore4-4.12.0-7.3
    • at-3.1.14-7.3
    • bogofilter-debugsource-1.2.4-5.3
    • libksuseinstall1-32bit-4.12.0-7.3
    • netpbm-debuginfo-10.66.3-4.1
    • openslp-32bit-2.0.0-11.1
    • libQtWebKit4-32bit-4.8.6+2.3.3-3.1
    • libksuseinstall1-debuginfo-4.12.0-7.3
    • netpbm-debugsource-10.66.3-4.1
    • libbonobo-debugsource-2.32.1-16.1
    • libnetpbm11-debuginfo-32bit-10.66.3-4.1
    • libbonobo-32bit-2.32.1-16.1
    • libkde4-4.12.0-7.3
    • at-debuginfo-3.1.14-7.3
    • libkdecore4-32bit-4.12.0-7.3
    • libnetpbm11-10.66.3-4.1
    • libkde4-32bit-4.12.0-7.3
    • libbonobo-debuginfo-2.32.1-16.1
    • libkdecore4-debuginfo-4.12.0-7.3
    • libnetpbm11-debuginfo-10.66.3-4.1
    • bogofilter-1.2.4-5.3
    • openslp-debuginfo-2.0.0-11.1
    • libQtWebKit4-4.8.6+2.3.3-3.1
    • libQtWebKit4-debuginfo-32bit-4.8.6+2.3.3-3.1
    • libbonobo-debuginfo-32bit-2.32.1-16.1
    • kdelibs4-debugsource-4.12.0-7.3
    • libQtWebKit4-debugsource-4.8.6+2.3.3-3.1
    • openslp-debuginfo-32bit-2.0.0-11.1
    • libksuseinstall1-4.12.0-7.3
  • SUSE Linux Enterprise Desktop 12 SP1 (noarch)
    • libbonobo-lang-2.32.1-16.1
  • SUSE Linux Enterprise Software Development Kit 12 SP1 (ppc64le s390x x86_64)
    • netpbm-debugsource-10.66.3-4.1
    • libbonobo-debuginfo-2.32.1-16.1
    • sgmltool-1.0.9-1075.1
    • libbonobo-debugsource-2.32.1-16.1
    • sgmltool-debugsource-1.0.9-1075.1
    • flex-debuginfo-2.5.37-8.1
    • sgmltool-debuginfo-1.0.9-1075.1
    • netpbm-debuginfo-10.66.3-4.1
    • openslp-debuginfo-2.0.0-11.1
    • mdbtools-0.7-5.1
    • flex-2.5.37-8.1
    • openslp-debugsource-2.0.0-11.1
    • libnetpbm-devel-10.66.3-4.1
    • mdbtools-debuginfo-0.7-5.1
    • openslp-devel-2.0.0-11.1
    • libbonobo-devel-2.32.1-16.1
    • flex-debugsource-2.5.37-8.1
    • mdbtools-debugsource-0.7-5.1
  • SUSE Linux Enterprise Software Development Kit 12 SP1 (ppc64le x86_64)
    • libQtWebKit4-debugsource-4.8.6+2.3.3-3.1
    • libQtWebKit4-debuginfo-4.8.6+2.3.3-3.1
    • libQtWebKit-devel-4.8.6+2.3.3-3.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
    • kdelibs4-debuginfo-4.12.0-7.3
    • libkde4-debuginfo-4.12.0-7.3
    • cyrus-imapd-debuginfo-2.3.18-40.1
    • openslp-server-debuginfo-2.0.0-11.1
    • libQtWebKit4-debuginfo-4.8.6+2.3.3-3.1
    • openslp-2.0.0-11.1
    • at-debugsource-3.1.14-7.3
    • flex-2.5.37-8.1
    • netpbm-10.66.3-4.1
    • openslp-debugsource-2.0.0-11.1
    • libbonobo-2.32.1-16.1
    • libkdecore4-4.12.0-7.3
    • perl-Cyrus-SIEVE-managesieve-2.3.18-40.1
    • libbonobo-doc-debuginfo-2.32.1-16.1
    • perl-Cyrus-IMAP-debuginfo-2.3.18-40.1
    • at-3.1.14-7.3
    • netpbm-debuginfo-10.66.3-4.1
    • libksuseinstall1-debuginfo-4.12.0-7.3
    • netpbm-debugsource-10.66.3-4.1
    • libbonobo-debugsource-2.32.1-16.1
    • openslp-server-2.0.0-11.1
    • flex-debuginfo-2.5.37-8.1
    • perl-Cyrus-SIEVE-managesieve-debuginfo-2.3.18-40.1
    • perl-Cyrus-IMAP-2.3.18-40.1
    • libkde4-4.12.0-7.3
    • at-debuginfo-3.1.14-7.3
    • libnetpbm11-10.66.3-4.1
    • cyrus-imapd-debugsource-2.3.18-40.1
    • libbonobo-debuginfo-2.32.1-16.1
    • libkdecore4-debuginfo-4.12.0-7.3
    • libnetpbm11-debuginfo-10.66.3-4.1
    • libbonobo-doc-2.32.1-16.1
    • openslp-debuginfo-2.0.0-11.1
    • libQtWebKit4-4.8.6+2.3.3-3.1
    • kdelibs4-debugsource-4.12.0-7.3
    • libQtWebKit4-debugsource-4.8.6+2.3.3-3.1
    • flex-debugsource-2.5.37-8.1
    • libksuseinstall1-4.12.0-7.3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1 (noarch)
    • libbonobo-lang-2.32.1-16.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
    • libkde4-debuginfo-32bit-4.12.0-7.3
    • libnetpbm11-32bit-10.66.3-4.1
    • flex-debuginfo-32bit-2.5.37-8.1
    • libnetpbm11-debuginfo-32bit-10.66.3-4.1
    • libQtWebKit4-debuginfo-32bit-4.8.6+2.3.3-3.1
    • libbonobo-32bit-2.32.1-16.1
    • libbonobo-debuginfo-32bit-2.32.1-16.1
    • libkdecore4-debuginfo-32bit-4.12.0-7.3
    • libksuseinstall1-debuginfo-32bit-4.12.0-7.3
    • libksuseinstall1-32bit-4.12.0-7.3
    • libkdecore4-32bit-4.12.0-7.3
    • flex-32bit-2.5.37-8.1
    • openslp-32bit-2.0.0-11.1
    • openslp-debuginfo-32bit-2.0.0-11.1
    • libQtWebKit4-32bit-4.8.6+2.3.3-3.1
    • libkde4-32bit-4.12.0-7.3
  • SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
    • kdelibs4-debuginfo-4.12.0-7.3
    • libkde4-debuginfo-4.12.0-7.3
    • cyrus-imapd-debuginfo-2.3.18-40.1
    • openslp-server-debuginfo-2.0.0-11.1
    • openslp-2.0.0-11.1
    • at-debugsource-3.1.14-7.3
    • flex-2.5.37-8.1
    • netpbm-10.66.3-4.1
    • openslp-debugsource-2.0.0-11.1
    • libbonobo-2.32.1-16.1
    • libkdecore4-4.12.0-7.3
    • perl-Cyrus-SIEVE-managesieve-2.3.18-40.1
    • libbonobo-doc-debuginfo-2.32.1-16.1
    • perl-Cyrus-IMAP-debuginfo-2.3.18-40.1
    • at-3.1.14-7.3
    • netpbm-debuginfo-10.66.3-4.1
    • libksuseinstall1-debuginfo-4.12.0-7.3
    • netpbm-debugsource-10.66.3-4.1
    • libbonobo-debugsource-2.32.1-16.1
    • openslp-server-2.0.0-11.1
    • flex-debuginfo-2.5.37-8.1
    • perl-Cyrus-SIEVE-managesieve-debuginfo-2.3.18-40.1
    • perl-Cyrus-IMAP-2.3.18-40.1
    • libkde4-4.12.0-7.3
    • at-debuginfo-3.1.14-7.3
    • libnetpbm11-10.66.3-4.1
    • cyrus-imapd-debugsource-2.3.18-40.1
    • libbonobo-debuginfo-2.32.1-16.1
    • libkdecore4-debuginfo-4.12.0-7.3
    • libnetpbm11-debuginfo-10.66.3-4.1
    • libbonobo-doc-2.32.1-16.1
    • openslp-debuginfo-2.0.0-11.1
    • kdelibs4-debugsource-4.12.0-7.3
    • flex-debugsource-2.5.37-8.1
    • libksuseinstall1-4.12.0-7.3
  • SUSE Linux Enterprise Server 12 SP1 (ppc64le x86_64)
    • libQtWebKit4-4.8.6+2.3.3-3.1
    • libQtWebKit4-debugsource-4.8.6+2.3.3-3.1
    • libQtWebKit4-debuginfo-4.8.6+2.3.3-3.1
  • SUSE Linux Enterprise Server 12 SP1 (noarch)
    • libbonobo-lang-2.32.1-16.1
  • SUSE Linux Enterprise Server 12 SP1 (s390x x86_64)
    • libkde4-debuginfo-32bit-4.12.0-7.3
    • libnetpbm11-32bit-10.66.3-4.1
    • flex-debuginfo-32bit-2.5.37-8.1
    • libnetpbm11-debuginfo-32bit-10.66.3-4.1
    • libkdecore4-debuginfo-32bit-4.12.0-7.3
    • libbonobo-32bit-2.32.1-16.1
    • libbonobo-debuginfo-32bit-2.32.1-16.1
    • libksuseinstall1-debuginfo-32bit-4.12.0-7.3
    • libksuseinstall1-32bit-4.12.0-7.3
    • libkdecore4-32bit-4.12.0-7.3
    • flex-32bit-2.5.37-8.1
    • openslp-debuginfo-32bit-2.0.0-11.1
    • openslp-32bit-2.0.0-11.1
    • libkde4-32bit-4.12.0-7.3
  • SUSE Linux Enterprise Server 12 SP1 (x86_64)
    • libQtWebKit4-debuginfo-32bit-4.8.6+2.3.3-3.1
    • libQtWebKit4-32bit-4.8.6+2.3.3-3.1
  • SUSE Linux Enterprise Workstation Extension 12 SP1 (x86_64)
    • bogofilter-1.2.4-5.3
    • bogofilter-debugsource-1.2.4-5.3
    • bogofilter-debuginfo-1.2.4-5.3

References: