Security update for lhasa SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1091-1 Final 1 1 2016-04-18T11:33:42Z current 2016-04-18T11:33:42Z 2016-04-18T11:33:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for lhasa lhasa was updated to fix one security issue. This security issue was fixed: - CVE-2016-2347: decode_level3_header heap corruption vulnerability (bsc#973790). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2016-639,SUSE-SLE-DESKTOP-12-SP1-2016-639,SUSE-SLE-SDK-12-2016-639,SUSE-SLE-SDK-12-SP1-2016-639,SUSE-SLE-WE-12-2016-639,SUSE-SLE-WE-12-SP1-2016-639 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161091-1/ Link for SUSE-SU-2016:1091-1 https://lists.suse.com/pipermail/sle-security-updates/2016-April/002019.html E-Mail link for SUSE-SU-2016:1091-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/973790 SUSE Bug 973790 https://www.suse.com/security/cve/CVE-2016-2347/ SUSE CVE CVE-2016-2347 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Workstation Extension 12 SP1 lhasa-0.2.0-5.1 liblhasa0-0.2.0-5.1 lhasa-devel-0.2.0-5.1 lhasa-0.2.0-5.1 as a component of SUSE Linux Enterprise Desktop 12 liblhasa0-0.2.0-5.1 as a component of SUSE Linux Enterprise Desktop 12 lhasa-0.2.0-5.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 liblhasa0-0.2.0-5.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 lhasa-devel-0.2.0-5.1 as a component of SUSE Linux Enterprise Software Development Kit 12 liblhasa0-0.2.0-5.1 as a component of SUSE Linux Enterprise Software Development Kit 12 lhasa-devel-0.2.0-5.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 liblhasa0-0.2.0-5.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 lhasa-0.2.0-5.1 as a component of SUSE Linux Enterprise Workstation Extension 12 liblhasa0-0.2.0-5.1 as a component of SUSE Linux Enterprise Workstation Extension 12 lhasa-0.2.0-5.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 liblhasa0-0.2.0-5.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive. CVE-2016-2347 SUSE Linux Enterprise Desktop 12 SP1:lhasa-0.2.0-5.1 SUSE Linux Enterprise Desktop 12 SP1:liblhasa0-0.2.0-5.1 SUSE Linux Enterprise Desktop 12:lhasa-0.2.0-5.1 SUSE Linux Enterprise Desktop 12:liblhasa0-0.2.0-5.1 SUSE Linux Enterprise Software Development Kit 12 SP1:lhasa-devel-0.2.0-5.1 SUSE Linux Enterprise Software Development Kit 12 SP1:liblhasa0-0.2.0-5.1 SUSE Linux Enterprise Software Development Kit 12:lhasa-devel-0.2.0-5.1 SUSE Linux Enterprise Software Development Kit 12:liblhasa0-0.2.0-5.1 SUSE Linux Enterprise Workstation Extension 12 SP1:lhasa-0.2.0-5.1 SUSE Linux Enterprise Workstation Extension 12 SP1:liblhasa0-0.2.0-5.1 SUSE Linux Enterprise Workstation Extension 12:lhasa-0.2.0-5.1 SUSE Linux Enterprise Workstation Extension 12:liblhasa0-0.2.0-5.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161091-1/ https://www.suse.com/security/cve/CVE-2016-2347.html CVE-2016-2347 https://bugzilla.suse.com/973790 SUSE Bug 973790