Security update for dpkg SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1096-1 Final 1 1 2017-04-24T10:26:51Z current 2017-04-24T10:26:51Z 2017-04-24T10:26:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dpkg This update for dpkg fixes the following issues: This security issue was fixed: - CVE-2015-0860: Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in dpkg allowed remote attackers to execute arbitrary code via the archive magic version number in an 'old-style' Debian binary package, which triggered a stack-based buffer overflow (bsc#957160). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2017-639,SUSE-SLE-SERVER-12-SP1-2017-639 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171096-1/ Link for SUSE-SU-2017:1096-1 https://lists.suse.com/pipermail/sle-security-updates/2017-April/002827.html E-Mail link for SUSE-SU-2017:1096-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/957160 SUSE Bug 957160 https://www.suse.com/security/cve/CVE-2015-0860/ SUSE CVE CVE-2015-0860 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 update-alternatives-1.16.10-12.6.1 update-alternatives-1.16.10-12.6.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 update-alternatives-1.16.10-12.6.1 as a component of SUSE Linux Enterprise Server 12 SP1 update-alternatives-1.16.10-12.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow. CVE-2015-0860 SUSE Linux Enterprise Desktop 12 SP1:update-alternatives-1.16.10-12.6.1 SUSE Linux Enterprise Server 12 SP1:update-alternatives-1.16.10-12.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:update-alternatives-1.16.10-12.6.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171096-1/ https://www.suse.com/security/cve/CVE-2015-0860.html CVE-2015-0860 https://bugzilla.suse.com/957160 SUSE Bug 957160