Security update for expat SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1512-1 Final 1 1 2016-06-07T11:42:43Z current 2016-06-07T11:42:43Z 2016-06-07T11:42:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for expat This update for expat fixes the following issues: Security issue fixed: - CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441) - CVE-2015-1283: Fix multiple integer overflows. (bnc#980391) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-expat-12600,slessp4-expat-12600,slestso13-expat-12600 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161512-1/ Link for SUSE-SU-2016:1512-1 https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html E-Mail link for SUSE-SU-2016:1512-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/979441 SUSE Bug 979441 https://bugzilla.suse.com/980391 SUSE Bug 980391 https://www.suse.com/security/cve/CVE-2015-1283/ SUSE CVE CVE-2015-1283 page https://www.suse.com/security/cve/CVE-2016-0718/ SUSE CVE CVE-2016-0718 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 libexpat-devel-2.0.1-88.38.1 expat-2.0.1-88.38.1 libexpat1-2.0.1-88.38.1 libexpat1-32bit-2.0.1-88.38.1 libexpat1-x86-2.0.1-88.38.1 expat-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 libexpat1-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 libexpat1-32bit-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 libexpat1-x86-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 expat-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libexpat1-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libexpat1-32bit-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libexpat1-x86-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libexpat-devel-2.0.1-88.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libexpat-devel-2.0.1-88.38.1 as a component of SUSE Studio Onsite 1.3 Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. CVE-2015-1283 SUSE Linux Enterprise Server 11 SP4:expat-2.0.1-88.38.1 SUSE Linux Enterprise Server 11 SP4:libexpat1-2.0.1-88.38.1 SUSE Linux Enterprise Server 11 SP4:libexpat1-32bit-2.0.1-88.38.1 SUSE Linux Enterprise Server 11 SP4:libexpat1-x86-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:expat-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libexpat1-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libexpat1-32bit-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libexpat1-x86-2.0.1-88.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libexpat-devel-2.0.1-88.38.1 SUSE Studio Onsite 1.3:libexpat-devel-2.0.1-88.38.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161512-1/ https://www.suse.com/security/cve/CVE-2015-1283.html CVE-2015-1283 https://bugzilla.suse.com/1034050 SUSE Bug 1034050 https://bugzilla.suse.com/939077 SUSE Bug 939077 https://bugzilla.suse.com/979441 SUSE Bug 979441 https://bugzilla.suse.com/980391 SUSE Bug 980391 https://bugzilla.suse.com/983985 SUSE Bug 983985 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. CVE-2016-0718 SUSE Linux Enterprise Server 11 SP4:expat-2.0.1-88.38.1 SUSE Linux Enterprise Server 11 SP4:libexpat1-2.0.1-88.38.1 SUSE Linux Enterprise Server 11 SP4:libexpat1-32bit-2.0.1-88.38.1 SUSE Linux Enterprise Server 11 SP4:libexpat1-x86-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:expat-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libexpat1-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libexpat1-32bit-2.0.1-88.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libexpat1-x86-2.0.1-88.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libexpat-devel-2.0.1-88.38.1 SUSE Studio Onsite 1.3:libexpat-devel-2.0.1-88.38.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161512-1/ https://www.suse.com/security/cve/CVE-2016-0718.html CVE-2016-0718 https://bugzilla.suse.com/979441 SUSE Bug 979441 https://bugzilla.suse.com/991809 SUSE Bug 991809