Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2016:2397-1

Опубликовано: 27 сент. 2016
Источник: suse-cvrf

Описание

Security update for flex, at, bogofilter, cyrus-imapd, kdelibs4, libQtWebKit4, libbonobo, mdbtools, netpbm, openslp, sgmltool, virtuoso, libqt5-qtwebkit

Various packages included vulnerable parsers generated by 'flex'.

This update provides a fixed 'flex' package and also rebuilds of packages that might have security issues caused by the auto generated code.

Flex itself was updated to fix a buffer overflow in the generated scanner (bsc#990856, CVE-2016-6354)

Packages that were rebuilt with the fixed flex:

  • at
  • bogofilter
  • cyrus-imapd
  • kdelibs4
  • libQtWebKit4
  • libbonobo
  • mdbtools
  • netpbm
  • openslp
  • sgmltool
  • virtuoso

Also libqt5-qtwebkit received an additional security fix:

  • CVE-2015-8079: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode (bsc#954210).

Список пакетов

SUSE Linux Enterprise Desktop 12 SP1
at-3.1.14-7.3
bogofilter-1.2.4-5.3
libQtWebKit4-4.8.6+2.3.3-3.1
libQtWebKit4-32bit-4.8.6+2.3.3-3.1
libbonobo-2.32.1-16.1
libbonobo-32bit-2.32.1-16.1
libbonobo-lang-2.32.1-16.1
libkde4-4.12.0-7.3
libkde4-32bit-4.12.0-7.3
libkdecore4-4.12.0-7.3
libkdecore4-32bit-4.12.0-7.3
libksuseinstall1-4.12.0-7.3
libksuseinstall1-32bit-4.12.0-7.3
libnetpbm11-10.66.3-4.1
libnetpbm11-32bit-10.66.3-4.1
netpbm-10.66.3-4.1
openslp-2.0.0-11.1
openslp-32bit-2.0.0-11.1
SUSE Linux Enterprise Server 12 SP1
at-3.1.14-7.3
flex-2.5.37-8.1
flex-32bit-2.5.37-8.1
libQtWebKit4-4.8.6+2.3.3-3.1
libQtWebKit4-32bit-4.8.6+2.3.3-3.1
libbonobo-2.32.1-16.1
libbonobo-32bit-2.32.1-16.1
libbonobo-doc-2.32.1-16.1
libbonobo-lang-2.32.1-16.1
libkde4-4.12.0-7.3
libkde4-32bit-4.12.0-7.3
libkdecore4-4.12.0-7.3
libkdecore4-32bit-4.12.0-7.3
libksuseinstall1-4.12.0-7.3
libksuseinstall1-32bit-4.12.0-7.3
libnetpbm11-10.66.3-4.1
libnetpbm11-32bit-10.66.3-4.1
netpbm-10.66.3-4.1
openslp-2.0.0-11.1
openslp-32bit-2.0.0-11.1
openslp-server-2.0.0-11.1
perl-Cyrus-IMAP-2.3.18-40.1
perl-Cyrus-SIEVE-managesieve-2.3.18-40.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
at-3.1.14-7.3
flex-2.5.37-8.1
flex-32bit-2.5.37-8.1
libQtWebKit4-4.8.6+2.3.3-3.1
libQtWebKit4-32bit-4.8.6+2.3.3-3.1
libbonobo-2.32.1-16.1
libbonobo-32bit-2.32.1-16.1
libbonobo-doc-2.32.1-16.1
libbonobo-lang-2.32.1-16.1
libkde4-4.12.0-7.3
libkde4-32bit-4.12.0-7.3
libkdecore4-4.12.0-7.3
libkdecore4-32bit-4.12.0-7.3
libksuseinstall1-4.12.0-7.3
libksuseinstall1-32bit-4.12.0-7.3
libnetpbm11-10.66.3-4.1
libnetpbm11-32bit-10.66.3-4.1
netpbm-10.66.3-4.1
openslp-2.0.0-11.1
openslp-32bit-2.0.0-11.1
openslp-server-2.0.0-11.1
perl-Cyrus-IMAP-2.3.18-40.1
perl-Cyrus-SIEVE-managesieve-2.3.18-40.1
SUSE Linux Enterprise Software Development Kit 12 SP1
flex-2.5.37-8.1
libQtWebKit-devel-4.8.6+2.3.3-3.1
libbonobo-devel-2.32.1-16.1
libnetpbm-devel-10.66.3-4.1
mdbtools-0.7-5.1
openslp-devel-2.0.0-11.1
sgmltool-1.0.9-1075.1
SUSE Linux Enterprise Workstation Extension 12 SP1
bogofilter-1.2.4-5.3

Ссылки

Описание

qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP1:at-3.1.14-7.3
SUSE Linux Enterprise Desktop 12 SP1:bogofilter-1.2.4-5.3
SUSE Linux Enterprise Desktop 12 SP1:libQtWebKit4-32bit-4.8.6+2.3.3-3.1
SUSE Linux Enterprise Desktop 12 SP1:libQtWebKit4-4.8.6+2.3.3-3.1
Ссылки

Описание

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP1:at-3.1.14-7.3
SUSE Linux Enterprise Desktop 12 SP1:bogofilter-1.2.4-5.3
SUSE Linux Enterprise Desktop 12 SP1:libQtWebKit4-32bit-4.8.6+2.3.3-3.1
SUSE Linux Enterprise Desktop 12 SP1:libQtWebKit4-4.8.6+2.3.3-3.1
Ссылки
Уязвимость SUSE-SU-2016:2397-1