Security update for mono-core SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2958-1 Final 1 1 2016-12-01T09:31:59Z current 2016-12-01T09:31:59Z 2016-12-01T09:31:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mono-core mono-core was updated to fix the following vulnerabilities: - CVE-2009-0689: Remote attackers could cause a denial of service and possibly arbitrary code execution through the string-to-double parser implementation. (bsc#958097) - CVE-2012-3543: Remote attackers could cause a denial of service through increased CPU consumption due to lack of protection against predictable hash collisions when processing form parameters. (bsc#739119) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-mono-core-12866,slessp3-mono-core-12866,slessp4-mono-core-12866 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162958-1/ Link for SUSE-SU-2016:2958-1 https://lists.suse.com/pipermail/sle-security-updates/2016-December/002433.html E-Mail link for SUSE-SU-2016:2958-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/739119 SUSE Bug 739119 https://bugzilla.suse.com/958097 SUSE Bug 958097 https://www.suse.com/security/cve/CVE-2009-0689/ SUSE CVE CVE-2009-0689 page https://www.suse.com/security/cve/CVE-2012-3543/ SUSE CVE CVE-2012-3543 page SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 bytefx-data-mysql-2.6.7-0.18.1 mono-core-2.6.7-0.18.1 mono-data-2.6.7-0.18.1 mono-data-firebird-2.6.7-0.18.1 mono-data-oracle-2.6.7-0.18.1 mono-data-postgresql-2.6.7-0.18.1 mono-data-sqlite-2.6.7-0.18.1 mono-data-sybase-2.6.7-0.18.1 mono-devel-2.6.7-0.18.1 mono-extras-2.6.7-0.18.1 mono-jscript-2.6.7-0.18.1 mono-locale-extras-2.6.7-0.18.1 mono-nunit-2.6.7-0.18.1 mono-wcf-2.6.7-0.18.1 mono-web-2.6.7-0.18.1 mono-winforms-2.6.7-0.18.1 mono-winfxcore-2.6.7-0.18.1 monodoc-core-2.6.7-0.18.1 mono-core-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-data-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-data-postgresql-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-data-sqlite-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-locale-extras-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-nunit-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-web-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-winforms-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS mono-core-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-data-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-data-postgresql-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-data-sqlite-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-locale-extras-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-nunit-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-web-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-winforms-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA mono-core-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-data-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-data-postgresql-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-data-sqlite-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-locale-extras-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-nunit-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-web-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-winforms-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server 11 SP4 mono-core-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-data-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-data-postgresql-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-data-sqlite-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-locale-extras-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-nunit-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-web-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mono-winforms-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 bytefx-data-mysql-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-core-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-data-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-data-firebird-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-data-oracle-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-data-postgresql-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-data-sqlite-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-data-sybase-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-devel-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-extras-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-jscript-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-locale-extras-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-nunit-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-wcf-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-web-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-winforms-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 mono-winfxcore-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 monodoc-core-2.6.7-0.18.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number. CVE-2009-0689 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:bytefx-data-mysql-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-firebird-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-oracle-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-sybase-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-devel-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-extras-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-jscript-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-wcf-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-winfxcore-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:monodoc-core-2.6.7-0.18.1 important 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162958-1/ https://www.suse.com/security/cve/CVE-2009-0689.html CVE-2009-0689 https://bugzilla.suse.com/522109 SUSE Bug 522109 https://bugzilla.suse.com/545277 SUSE Bug 545277 https://bugzilla.suse.com/546371 SUSE Bug 546371 https://bugzilla.suse.com/557126 SUSE Bug 557126 https://bugzilla.suse.com/557127 SUSE Bug 557127 https://bugzilla.suse.com/557128 SUSE Bug 557128 https://bugzilla.suse.com/557671 SUSE Bug 557671 https://bugzilla.suse.com/590499 SUSE Bug 590499 https://bugzilla.suse.com/607935 SUSE Bug 607935 https://bugzilla.suse.com/851803 SUSE Bug 851803 https://bugzilla.suse.com/958097 SUSE Bug 958097 https://bugzilla.suse.com/963818 SUSE Bug 963818 mono 2.10.x ASP.NET Web Form Hash collision DoS CVE-2012-3543 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-LTSS:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server 11 SP4:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:bytefx-data-mysql-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-core-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-firebird-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-oracle-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-postgresql-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-sqlite-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-data-sybase-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-devel-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-extras-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-jscript-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-locale-extras-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-nunit-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-wcf-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-web-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-winforms-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:mono-winfxcore-2.6.7-0.18.1 SUSE Linux Enterprise Software Development Kit 11 SP4:monodoc-core-2.6.7-0.18.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162958-1/ https://www.suse.com/security/cve/CVE-2012-3543.html CVE-2012-3543 https://bugzilla.suse.com/739119 SUSE Bug 739119 https://bugzilla.suse.com/963818 SUSE Bug 963818