Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2017:2839-1

Опубликовано: 24 окт. 2017
Источник: suse-cvrf

Описание

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2017-12166: Lack of bound check in read_key in old legacy key handling before using values could be used for a remote buffer overflow (bsc#1060877).

Список пакетов

SUSE Linux Enterprise Desktop 12 SP2
openvpn-2.3.8-16.20.1
SUSE Linux Enterprise Desktop 12 SP3
openvpn-2.3.8-16.20.1
SUSE Linux Enterprise Server 12 SP1-LTSS
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server 12 SP2
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server 12 SP3
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server 12-LTSS
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1
SUSE OpenStack Cloud 6
openvpn-2.3.8-16.20.1
openvpn-auth-pam-plugin-2.3.8-16.20.1

Ссылки

Описание

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:openvpn-2.3.8-16.20.1
SUSE Linux Enterprise Desktop 12 SP3:openvpn-2.3.8-16.20.1
SUSE Linux Enterprise Server 12 SP1-LTSS:openvpn-2.3.8-16.20.1
SUSE Linux Enterprise Server 12 SP1-LTSS:openvpn-auth-pam-plugin-2.3.8-16.20.1
Ссылки