Security update for cpio SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0366-1 Final 1 1 2017-02-02T17:22:49Z current 2017-02-02T17:22:49Z 2017-02-02T17:22:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cpio This update for cpio fixes two issues. This security issue was fixed: - CVE-2016-2037: The cpio_safer_name_suffix function in util.c in cpio allowed remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file (bsc#963448). This non-security issue was fixed: - bsc#1020108: Always use 32 bit CRC to prevent checksum errors for files greater than 32MB The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2017-185,SUSE-SLE-DESKTOP-12-SP2-2017-185,SUSE-SLE-RPI-12-SP2-2017-185,SUSE-SLE-SERVER-12-SP1-2017-185,SUSE-SLE-SERVER-12-SP2-2017-185 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170366-1/ Link for SUSE-SU-2017:0366-1 https://lists.suse.com/pipermail/sle-security-updates/2017-February/002615.html E-Mail link for SUSE-SU-2017:0366-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1020108 SUSE Bug 1020108 https://bugzilla.suse.com/963448 SUSE Bug 963448 https://www.suse.com/security/cve/CVE-2016-2037/ SUSE CVE CVE-2016-2037 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 cpio-2.11-32.1 cpio-lang-2.11-32.1 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Server 12 SP1 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Server 12 SP1 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Server 12 SP2 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Server 12 SP2 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 cpio-2.11-32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 cpio-lang-2.11-32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. CVE-2016-2037 SUSE Linux Enterprise Desktop 12 SP1:cpio-2.11-32.1 SUSE Linux Enterprise Desktop 12 SP1:cpio-lang-2.11-32.1 SUSE Linux Enterprise Desktop 12 SP2:cpio-2.11-32.1 SUSE Linux Enterprise Desktop 12 SP2:cpio-lang-2.11-32.1 SUSE Linux Enterprise Server 12 SP1:cpio-2.11-32.1 SUSE Linux Enterprise Server 12 SP1:cpio-lang-2.11-32.1 SUSE Linux Enterprise Server 12 SP2:cpio-2.11-32.1 SUSE Linux Enterprise Server 12 SP2:cpio-lang-2.11-32.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:cpio-2.11-32.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:cpio-lang-2.11-32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:cpio-2.11-32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:cpio-lang-2.11-32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:cpio-2.11-32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:cpio-lang-2.11-32.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170366-1/ https://www.suse.com/security/cve/CVE-2016-2037.html CVE-2016-2037 https://bugzilla.suse.com/1028410 SUSE Bug 1028410 https://bugzilla.suse.com/963448 SUSE Bug 963448