Security update for SLES 12-SP1 Docker image SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2700-1 Final 1 1 2017-10-10T19:37:36Z current 2017-10-10T19:37:36Z 2017-10-10T19:37:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SLES 12-SP1 Docker image The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes. The following issues related to building of the container images have been fixed: - Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193) - Do not install recommended packages when building container images. (bsc#975726) A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below. pam: - CVE-2015-3238 libtasn1: - CVE-2015-3622 - CVE-2016-4008 expat: expat: - CVE-2012-6702 - CVE-2015-1283 - CVE-2016-0718 - CVE-2016-5300 - CVE-2016-9063 - CVE-2017-9233 libidn: - CVE-2015-2059 - CVE-2015-8948 - CVE-2016-6261 - CVE-2016-6262 - CVE-2016-6263 zlib: - CVE-2016-9840 - CVE-2016-9841 - CVE-2016-9842 - CVE-2016-9843 curl: - CVE-2016-5419 - CVE-2016-5420 - CVE-2016-5421 - CVE-2016-7141 - CVE-2016-7167 - CVE-2016-8615 - CVE-2016-8616 - CVE-2016-8617 - CVE-2016-8618 - CVE-2016-8619 - CVE-2016-8620 - CVE-2016-8621 - CVE-2016-8622 - CVE-2016-8623 - CVE-2016-8624 - CVE-2016-9586 - CVE-2017-1000100 - CVE-2017-1000101 - CVE-2017-7407 openssl: - CVE-2016-2105 - CVE-2016-2106 - CVE-2016-2107 - CVE-2016-2108 - CVE-2016-2109 - CVE-2016-2177 - CVE-2016-2178 - CVE-2016-2179 - CVE-2016-2180 - CVE-2016-2181 - CVE-2016-2182 - CVE-2016-2183 - CVE-2016-6302 - CVE-2016-6303 - CVE-2016-6304 - CVE-2016-6306 - CVE-2016-7056 - CVE-2016-8610 - CVE-2017-3731 cracklib: - CVE-2016-6318 pcre: - CVE-2014-8964 - CVE-2015-2325 - CVE-2015-2327 - CVE-2015-2328 - CVE-2015-3210 - CVE-2015-3217 - CVE-2015-5073 - CVE-2015-8380 - CVE-2015-8381 - CVE-2015-8382 - CVE-2015-8383 - CVE-2015-8384 - CVE-2015-8385 - CVE-2015-8386 - CVE-2015-8387 - CVE-2015-8388 - CVE-2015-8389 - CVE-2015-8390 - CVE-2015-8391 - CVE-2015-8392 - CVE-2015-8393 - CVE-2015-8394 - CVE-2015-8395 - CVE-2016-1283 - CVE-2016-3191 appamor: - CVE-2017-6507 bash: - CVE-2014-6277 - CVE-2014-6278 - CVE-2016-0634 - CVE-2016-7543 cpio: - CVE-2016-2037 glibc: - CVE-2016-1234 - CVE-2016-3075 - CVE-2016-3706 - CVE-2016-4429 - CVE-2017-1000366 perl: - CVE-2015-8853 - CVE-2016-1238 - CVE-2016-2381 - CVE-2016-6185 libssh2_org: - CVE-2016-0787 util-linux: - CVE-2016-5011 - CVE-2017-2616 ncurses: - CVE-2017-10684 - CVE-2017-10685 - CVE-2017-11112 - CVE-2017-11113 libksba: - CVE-2016-4574 - CVE-2016-4579 libxml2: - CVE-2014-0191 - CVE-2015-8806 - CVE-2016-1762 - CVE-2016-1833 - CVE-2016-1834 - CVE-2016-1835 - CVE-2016-1837 - CVE-2016-1838 - CVE-2016-1839 - CVE-2016-1840 - CVE-2016-2073 - CVE-2016-3627 - CVE-2016-3705 - CVE-2016-4447 - CVE-2016-4448 - CVE-2016-4449 - CVE-2016-4483 - CVE-2016-4658 - CVE-2016-9318 - CVE-2016-9597 - CVE-2017-9047 - CVE-2017-9048 - CVE-2017-9049 - CVE-2017-9050 libgcrypt: - CVE-2015-7511 - CVE-2016-6313 - CVE-2017-7526 update-alternatives: - CVE-2015-0860 systemd: - CVE-2014-9770 - CVE-2015-8842 - CVE-2016-7796 dbus-1: - CVE-2014-7824 - CVE-2015-0245 Finally, the following packages received non-security fixes: - augeas - bzip2 - ca-certificates-mozilla - coreutils - cryptsetup - cyrus-sasl - dirmngr - e2fsprogs - findutils - gpg2 - insserv-compat - kmod - libcap - libsolv - libzypp - lua51 - lvm2 - netcfg - p11-kit - permissions - procps - rpm - sed - sg3_utils - shadow - zypper The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Containers-12-2017-1673 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ Link for SUSE-SU-2017:2700-1 https://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html E-Mail link for SUSE-SU-2017:2700-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1056193 SUSE Bug 1056193 https://bugzilla.suse.com/975726 SUSE Bug 975726 https://www.suse.com/security/cve/CVE-2012-6702/ SUSE CVE CVE-2012-6702 page https://www.suse.com/security/cve/CVE-2014-0191/ SUSE CVE CVE-2014-0191 page https://www.suse.com/security/cve/CVE-2014-6271/ SUSE CVE CVE-2014-6271 page https://www.suse.com/security/cve/CVE-2014-6277/ SUSE CVE CVE-2014-6277 page https://www.suse.com/security/cve/CVE-2014-6278/ SUSE CVE CVE-2014-6278 page https://www.suse.com/security/cve/CVE-2014-7169/ SUSE CVE CVE-2014-7169 page https://www.suse.com/security/cve/CVE-2014-7187/ SUSE CVE CVE-2014-7187 page https://www.suse.com/security/cve/CVE-2014-7824/ SUSE CVE CVE-2014-7824 page https://www.suse.com/security/cve/CVE-2014-8964/ SUSE CVE CVE-2014-8964 page https://www.suse.com/security/cve/CVE-2014-9770/ SUSE CVE CVE-2014-9770 page https://www.suse.com/security/cve/CVE-2015-0245/ SUSE CVE CVE-2015-0245 page https://www.suse.com/security/cve/CVE-2015-0860/ SUSE CVE CVE-2015-0860 page https://www.suse.com/security/cve/CVE-2015-1283/ SUSE CVE CVE-2015-1283 page https://www.suse.com/security/cve/CVE-2015-2059/ SUSE CVE CVE-2015-2059 page https://www.suse.com/security/cve/CVE-2015-2325/ SUSE CVE CVE-2015-2325 page https://www.suse.com/security/cve/CVE-2015-2327/ SUSE CVE CVE-2015-2327 page https://www.suse.com/security/cve/CVE-2015-2328/ SUSE CVE CVE-2015-2328 page https://www.suse.com/security/cve/CVE-2015-3210/ SUSE CVE CVE-2015-3210 page https://www.suse.com/security/cve/CVE-2015-3217/ SUSE CVE CVE-2015-3217 page https://www.suse.com/security/cve/CVE-2015-3238/ SUSE CVE CVE-2015-3238 page https://www.suse.com/security/cve/CVE-2015-3622/ SUSE CVE CVE-2015-3622 page https://www.suse.com/security/cve/CVE-2015-5073/ SUSE CVE CVE-2015-5073 page https://www.suse.com/security/cve/CVE-2015-5276/ SUSE CVE CVE-2015-5276 page https://www.suse.com/security/cve/CVE-2015-7511/ SUSE CVE CVE-2015-7511 page https://www.suse.com/security/cve/CVE-2015-8380/ SUSE CVE CVE-2015-8380 page https://www.suse.com/security/cve/CVE-2015-8381/ SUSE CVE CVE-2015-8381 page https://www.suse.com/security/cve/CVE-2015-8382/ SUSE CVE CVE-2015-8382 page https://www.suse.com/security/cve/CVE-2015-8383/ SUSE CVE CVE-2015-8383 page https://www.suse.com/security/cve/CVE-2015-8384/ SUSE CVE CVE-2015-8384 page https://www.suse.com/security/cve/CVE-2015-8385/ SUSE CVE CVE-2015-8385 page https://www.suse.com/security/cve/CVE-2015-8386/ SUSE CVE CVE-2015-8386 page https://www.suse.com/security/cve/CVE-2015-8387/ SUSE CVE CVE-2015-8387 page https://www.suse.com/security/cve/CVE-2015-8388/ SUSE CVE CVE-2015-8388 page https://www.suse.com/security/cve/CVE-2015-8389/ SUSE CVE CVE-2015-8389 page https://www.suse.com/security/cve/CVE-2015-8390/ SUSE CVE CVE-2015-8390 page https://www.suse.com/security/cve/CVE-2015-8391/ SUSE CVE CVE-2015-8391 page https://www.suse.com/security/cve/CVE-2015-8392/ SUSE CVE CVE-2015-8392 page https://www.suse.com/security/cve/CVE-2015-8393/ SUSE CVE CVE-2015-8393 page https://www.suse.com/security/cve/CVE-2015-8394/ SUSE CVE CVE-2015-8394 page https://www.suse.com/security/cve/CVE-2015-8395/ SUSE CVE CVE-2015-8395 page https://www.suse.com/security/cve/CVE-2015-8806/ SUSE CVE CVE-2015-8806 page https://www.suse.com/security/cve/CVE-2015-8842/ SUSE CVE CVE-2015-8842 page https://www.suse.com/security/cve/CVE-2015-8853/ SUSE CVE CVE-2015-8853 page https://www.suse.com/security/cve/CVE-2015-8948/ SUSE CVE CVE-2015-8948 page https://www.suse.com/security/cve/CVE-2016-0634/ SUSE CVE CVE-2016-0634 page https://www.suse.com/security/cve/CVE-2016-0718/ SUSE CVE CVE-2016-0718 page https://www.suse.com/security/cve/CVE-2016-0787/ SUSE CVE CVE-2016-0787 page https://www.suse.com/security/cve/CVE-2016-1234/ SUSE CVE CVE-2016-1234 page https://www.suse.com/security/cve/CVE-2016-1238/ SUSE CVE CVE-2016-1238 page https://www.suse.com/security/cve/CVE-2016-1283/ SUSE CVE CVE-2016-1283 page https://www.suse.com/security/cve/CVE-2016-1762/ SUSE CVE CVE-2016-1762 page https://www.suse.com/security/cve/CVE-2016-1833/ SUSE CVE CVE-2016-1833 page https://www.suse.com/security/cve/CVE-2016-1834/ SUSE CVE CVE-2016-1834 page https://www.suse.com/security/cve/CVE-2016-1835/ SUSE CVE CVE-2016-1835 page https://www.suse.com/security/cve/CVE-2016-1837/ SUSE CVE CVE-2016-1837 page https://www.suse.com/security/cve/CVE-2016-1838/ SUSE CVE CVE-2016-1838 page https://www.suse.com/security/cve/CVE-2016-1839/ SUSE CVE CVE-2016-1839 page https://www.suse.com/security/cve/CVE-2016-1840/ SUSE CVE CVE-2016-1840 page https://www.suse.com/security/cve/CVE-2016-2037/ SUSE CVE CVE-2016-2037 page https://www.suse.com/security/cve/CVE-2016-2073/ SUSE CVE CVE-2016-2073 page https://www.suse.com/security/cve/CVE-2016-2105/ SUSE CVE CVE-2016-2105 page https://www.suse.com/security/cve/CVE-2016-2106/ SUSE CVE CVE-2016-2106 page https://www.suse.com/security/cve/CVE-2016-2107/ SUSE CVE CVE-2016-2107 page https://www.suse.com/security/cve/CVE-2016-2108/ SUSE CVE CVE-2016-2108 page https://www.suse.com/security/cve/CVE-2016-2109/ SUSE CVE CVE-2016-2109 page https://www.suse.com/security/cve/CVE-2016-2177/ SUSE CVE CVE-2016-2177 page https://www.suse.com/security/cve/CVE-2016-2178/ SUSE CVE CVE-2016-2178 page https://www.suse.com/security/cve/CVE-2016-2179/ SUSE CVE CVE-2016-2179 page https://www.suse.com/security/cve/CVE-2016-2180/ SUSE CVE CVE-2016-2180 page https://www.suse.com/security/cve/CVE-2016-2181/ SUSE CVE CVE-2016-2181 page https://www.suse.com/security/cve/CVE-2016-2182/ SUSE CVE CVE-2016-2182 page https://www.suse.com/security/cve/CVE-2016-2183/ SUSE CVE CVE-2016-2183 page https://www.suse.com/security/cve/CVE-2016-2381/ SUSE CVE CVE-2016-2381 page https://www.suse.com/security/cve/CVE-2016-3075/ SUSE CVE CVE-2016-3075 page https://www.suse.com/security/cve/CVE-2016-3191/ SUSE CVE CVE-2016-3191 page https://www.suse.com/security/cve/CVE-2016-3627/ SUSE CVE CVE-2016-3627 page https://www.suse.com/security/cve/CVE-2016-3705/ SUSE CVE CVE-2016-3705 page https://www.suse.com/security/cve/CVE-2016-3706/ SUSE CVE CVE-2016-3706 page https://www.suse.com/security/cve/CVE-2016-4008/ SUSE CVE CVE-2016-4008 page https://www.suse.com/security/cve/CVE-2016-4429/ SUSE CVE CVE-2016-4429 page https://www.suse.com/security/cve/CVE-2016-4447/ SUSE CVE CVE-2016-4447 page https://www.suse.com/security/cve/CVE-2016-4448/ SUSE CVE CVE-2016-4448 page https://www.suse.com/security/cve/CVE-2016-4449/ SUSE CVE CVE-2016-4449 page https://www.suse.com/security/cve/CVE-2016-4483/ SUSE CVE CVE-2016-4483 page https://www.suse.com/security/cve/CVE-2016-4574/ SUSE CVE CVE-2016-4574 page https://www.suse.com/security/cve/CVE-2016-4579/ SUSE CVE CVE-2016-4579 page https://www.suse.com/security/cve/CVE-2016-4658/ SUSE CVE CVE-2016-4658 page https://www.suse.com/security/cve/CVE-2016-5011/ SUSE CVE CVE-2016-5011 page https://www.suse.com/security/cve/CVE-2016-5300/ SUSE CVE CVE-2016-5300 page https://www.suse.com/security/cve/CVE-2016-5419/ SUSE CVE CVE-2016-5419 page https://www.suse.com/security/cve/CVE-2016-5420/ SUSE CVE CVE-2016-5420 page https://www.suse.com/security/cve/CVE-2016-5421/ SUSE CVE CVE-2016-5421 page https://www.suse.com/security/cve/CVE-2016-6185/ SUSE CVE CVE-2016-6185 page https://www.suse.com/security/cve/CVE-2016-6261/ SUSE CVE CVE-2016-6261 page https://www.suse.com/security/cve/CVE-2016-6262/ SUSE CVE CVE-2016-6262 page https://www.suse.com/security/cve/CVE-2016-6263/ SUSE CVE CVE-2016-6263 page https://www.suse.com/security/cve/CVE-2016-6302/ SUSE CVE CVE-2016-6302 page https://www.suse.com/security/cve/CVE-2016-6303/ SUSE CVE CVE-2016-6303 page https://www.suse.com/security/cve/CVE-2016-6304/ SUSE CVE CVE-2016-6304 page https://www.suse.com/security/cve/CVE-2016-6306/ SUSE CVE CVE-2016-6306 page https://www.suse.com/security/cve/CVE-2016-6313/ SUSE CVE CVE-2016-6313 page https://www.suse.com/security/cve/CVE-2016-6318/ SUSE CVE CVE-2016-6318 page https://www.suse.com/security/cve/CVE-2016-7056/ SUSE CVE CVE-2016-7056 page https://www.suse.com/security/cve/CVE-2016-7141/ SUSE CVE CVE-2016-7141 page https://www.suse.com/security/cve/CVE-2016-7167/ SUSE CVE CVE-2016-7167 page https://www.suse.com/security/cve/CVE-2016-7543/ SUSE CVE CVE-2016-7543 page https://www.suse.com/security/cve/CVE-2016-7796/ SUSE CVE CVE-2016-7796 page https://www.suse.com/security/cve/CVE-2016-8610/ SUSE CVE CVE-2016-8610 page https://www.suse.com/security/cve/CVE-2016-8615/ SUSE CVE CVE-2016-8615 page https://www.suse.com/security/cve/CVE-2016-8616/ SUSE CVE CVE-2016-8616 page https://www.suse.com/security/cve/CVE-2016-8617/ SUSE CVE CVE-2016-8617 page https://www.suse.com/security/cve/CVE-2016-8618/ SUSE CVE CVE-2016-8618 page https://www.suse.com/security/cve/CVE-2016-8619/ SUSE CVE CVE-2016-8619 page https://www.suse.com/security/cve/CVE-2016-8620/ SUSE CVE CVE-2016-8620 page https://www.suse.com/security/cve/CVE-2016-8621/ SUSE CVE CVE-2016-8621 page https://www.suse.com/security/cve/CVE-2016-8622/ SUSE CVE CVE-2016-8622 page https://www.suse.com/security/cve/CVE-2016-8623/ SUSE CVE CVE-2016-8623 page https://www.suse.com/security/cve/CVE-2016-8624/ SUSE CVE CVE-2016-8624 page https://www.suse.com/security/cve/CVE-2016-9063/ SUSE CVE CVE-2016-9063 page https://www.suse.com/security/cve/CVE-2016-9318/ SUSE CVE CVE-2016-9318 page https://www.suse.com/security/cve/CVE-2016-9586/ SUSE CVE CVE-2016-9586 page https://www.suse.com/security/cve/CVE-2016-9597/ SUSE CVE CVE-2016-9597 page https://www.suse.com/security/cve/CVE-2016-9840/ SUSE CVE CVE-2016-9840 page https://www.suse.com/security/cve/CVE-2016-9841/ SUSE CVE CVE-2016-9841 page https://www.suse.com/security/cve/CVE-2016-9842/ SUSE CVE CVE-2016-9842 page https://www.suse.com/security/cve/CVE-2016-9843/ SUSE CVE CVE-2016-9843 page https://www.suse.com/security/cve/CVE-2017-1000100/ SUSE CVE CVE-2017-1000100 page https://www.suse.com/security/cve/CVE-2017-1000101/ SUSE CVE CVE-2017-1000101 page https://www.suse.com/security/cve/CVE-2017-1000366/ SUSE CVE CVE-2017-1000366 page https://www.suse.com/security/cve/CVE-2017-10684/ SUSE CVE CVE-2017-10684 page https://www.suse.com/security/cve/CVE-2017-10685/ SUSE CVE CVE-2017-10685 page https://www.suse.com/security/cve/CVE-2017-11112/ SUSE CVE CVE-2017-11112 page https://www.suse.com/security/cve/CVE-2017-11113/ SUSE CVE CVE-2017-11113 page https://www.suse.com/security/cve/CVE-2017-2616/ SUSE CVE CVE-2017-2616 page https://www.suse.com/security/cve/CVE-2017-3731/ SUSE CVE CVE-2017-3731 page https://www.suse.com/security/cve/CVE-2017-6507/ SUSE CVE CVE-2017-6507 page https://www.suse.com/security/cve/CVE-2017-7407/ SUSE CVE CVE-2017-7407 page https://www.suse.com/security/cve/CVE-2017-7526/ SUSE CVE CVE-2017-7526 page https://www.suse.com/security/cve/CVE-2017-9047/ SUSE CVE CVE-2017-9047 page https://www.suse.com/security/cve/CVE-2017-9048/ SUSE CVE CVE-2017-9048 page https://www.suse.com/security/cve/CVE-2017-9049/ SUSE CVE CVE-2017-9049 page https://www.suse.com/security/cve/CVE-2017-9050/ SUSE CVE CVE-2017-9050 page https://www.suse.com/security/cve/CVE-2017-9233/ SUSE CVE CVE-2017-9233 page SUSE Linux Enterprise Module for Containers 12 sles12sp1-docker-image-1.0.7-20171002 sles12sp1-docker-image-1.0.7-20171002 as a component of SUSE Linux Enterprise Module for Containers 12 Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. CVE-2012-6702 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2012-6702.html CVE-2012-6702 https://bugzilla.suse.com/983215 SUSE Bug 983215 https://bugzilla.suse.com/983216 SUSE Bug 983216 The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document. CVE-2014-0191 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-0191.html CVE-2014-0191 https://bugzilla.suse.com/1014873 SUSE Bug 1014873 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/876652 SUSE Bug 876652 https://bugzilla.suse.com/877506 SUSE Bug 877506 https://bugzilla.suse.com/996079 SUSE Bug 996079 GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. CVE-2014-6271 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-6271.html CVE-2014-6271 https://bugzilla.suse.com/1024628 SUSE Bug 1024628 https://bugzilla.suse.com/1130324 SUSE Bug 1130324 https://bugzilla.suse.com/870618 SUSE Bug 870618 https://bugzilla.suse.com/896776 SUSE Bug 896776 https://bugzilla.suse.com/898346 SUSE Bug 898346 https://bugzilla.suse.com/898604 SUSE Bug 898604 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/900127 SUSE Bug 900127 https://bugzilla.suse.com/900454 SUSE Bug 900454 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. CVE-2014-6277 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-6277.html CVE-2014-6277 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/900127 SUSE Bug 900127 https://bugzilla.suse.com/900454 SUSE Bug 900454 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. CVE-2014-6278 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-6278.html CVE-2014-6278 https://bugzilla.suse.com/898604 SUSE Bug 898604 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/900127 SUSE Bug 900127 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. CVE-2014-7169 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-7169.html CVE-2014-7169 https://bugzilla.suse.com/1024628 SUSE Bug 1024628 https://bugzilla.suse.com/1130324 SUSE Bug 1130324 https://bugzilla.suse.com/870618 SUSE Bug 870618 https://bugzilla.suse.com/896776 SUSE Bug 896776 https://bugzilla.suse.com/898346 SUSE Bug 898346 https://bugzilla.suse.com/898762 SUSE Bug 898762 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/899039 SUSE Bug 899039 https://bugzilla.suse.com/899266 SUSE Bug 899266 https://bugzilla.suse.com/900127 SUSE Bug 900127 https://bugzilla.suse.com/900454 SUSE Bug 900454 https://bugzilla.suse.com/902237 SUSE Bug 902237 Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue. CVE-2014-7187 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-7187.html CVE-2014-7187 https://bugzilla.suse.com/1024628 SUSE Bug 1024628 https://bugzilla.suse.com/898603 SUSE Bug 898603 https://bugzilla.suse.com/898812 SUSE Bug 898812 https://bugzilla.suse.com/898884 SUSE Bug 898884 https://bugzilla.suse.com/899039 SUSE Bug 899039 D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1. CVE-2014-7824 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-7824.html CVE-2014-7824 https://bugzilla.suse.com/904017 SUSE Bug 904017 Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats. CVE-2014-8964 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-8964.html CVE-2014-8964 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/924960 SUSE Bug 924960 https://bugzilla.suse.com/933288 SUSE Bug 933288 https://bugzilla.suse.com/936408 SUSE Bug 936408 https://bugzilla.suse.com/958373 SUSE Bug 958373 tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files. CVE-2014-9770 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2014-9770.html CVE-2014-9770 https://bugzilla.suse.com/972612 SUSE Bug 972612 D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. CVE-2015-0245 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-0245.html CVE-2015-0245 https://bugzilla.suse.com/1003898 SUSE Bug 1003898 https://bugzilla.suse.com/916343 SUSE Bug 916343 Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow. CVE-2015-0860 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-0860.html CVE-2015-0860 https://bugzilla.suse.com/957160 SUSE Bug 957160 Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. CVE-2015-1283 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-1283.html CVE-2015-1283 https://bugzilla.suse.com/1034050 SUSE Bug 1034050 https://bugzilla.suse.com/939077 SUSE Bug 939077 https://bugzilla.suse.com/979441 SUSE Bug 979441 https://bugzilla.suse.com/980391 SUSE Bug 980391 https://bugzilla.suse.com/983985 SUSE Bug 983985 The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read. CVE-2015-2059 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-2059.html CVE-2015-2059 https://bugzilla.suse.com/1173590 SUSE Bug 1173590 https://bugzilla.suse.com/919214 SUSE Bug 919214 https://bugzilla.suse.com/923241 SUSE Bug 923241 https://bugzilla.suse.com/937096 SUSE Bug 937096 https://bugzilla.suse.com/937097 SUSE Bug 937097 The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier. CVE-2015-2325 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-2325.html CVE-2015-2325 https://bugzilla.suse.com/924960 SUSE Bug 924960 https://bugzilla.suse.com/933288 SUSE Bug 933288 https://bugzilla.suse.com/936408 SUSE Bug 936408 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-2327 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-2327.html CVE-2015-2327 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/957567 SUSE Bug 957567 PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-2328 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-2328.html CVE-2015-2328 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/957600 SUSE Bug 957600 Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384. CVE-2015-3210 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-3210.html CVE-2015-3210 https://bugzilla.suse.com/933288 SUSE Bug 933288 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. CVE-2015-3217 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-3217.html CVE-2015-3217 https://bugzilla.suse.com/933878 SUSE Bug 933878 https://bugzilla.suse.com/958373 SUSE Bug 958373 The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password. CVE-2015-3238 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-3238.html CVE-2015-3238 https://bugzilla.suse.com/1123794 SUSE Bug 1123794 https://bugzilla.suse.com/934920 SUSE Bug 934920 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate. CVE-2015-3622 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-3622.html CVE-2015-3622 https://bugzilla.suse.com/929414 SUSE Bug 929414 Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. CVE-2015-5073 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-5073.html CVE-2015-5073 https://bugzilla.suse.com/936227 SUSE Bug 936227 The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors. CVE-2015-5276 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-5276.html CVE-2015-5276 https://bugzilla.suse.com/945842 SUSE Bug 945842 Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations. CVE-2015-7511 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-7511.html CVE-2015-7511 https://bugzilla.suse.com/965902 SUSE Bug 965902 The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8380 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8380.html CVE-2015-8380 https://bugzilla.suse.com/957566 SUSE Bug 957566 The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8381 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8381.html CVE-2015-8381 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547. CVE-2015-8382 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8382.html CVE-2015-8382 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8383 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8383.html CVE-2015-8383 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395. CVE-2015-8384 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8384.html CVE-2015-8384 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8385 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8385.html CVE-2015-8385 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8386 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8386.html CVE-2015-8386 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8387 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8387.html CVE-2015-8387 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8388 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8388.html CVE-2015-8388 https://bugzilla.suse.com/936227 SUSE Bug 936227 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8389 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8389.html CVE-2015-8389 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8390 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8390.html CVE-2015-8390 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8391 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8391.html CVE-2015-8391 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395. CVE-2015-8392 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8392.html CVE-2015-8392 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client. CVE-2015-8393 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8393.html CVE-2015-8393 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8394 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8394.html CVE-2015-8394 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392. CVE-2015-8395 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8395.html CVE-2015-8395 https://bugzilla.suse.com/906574 SUSE Bug 906574 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document. CVE-2015-8806 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8806.html CVE-2015-8806 https://bugzilla.suse.com/963963 SUSE Bug 963963 https://bugzilla.suse.com/965283 SUSE Bug 965283 https://bugzilla.suse.com/981114 SUSE Bug 981114 tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file. CVE-2015-8842 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8842.html CVE-2015-8842 https://bugzilla.suse.com/972612 SUSE Bug 972612 The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80." CVE-2015-8853 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8853.html CVE-2015-8853 https://bugzilla.suse.com/976584 SUSE Bug 976584 https://bugzilla.suse.com/997948 SUSE Bug 997948 https://bugzilla.suse.com/997950 SUSE Bug 997950 idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read. CVE-2015-8948 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2015-8948.html CVE-2015-8948 https://bugzilla.suse.com/1014473 SUSE Bug 1014473 https://bugzilla.suse.com/1173590 SUSE Bug 1173590 https://bugzilla.suse.com/1190777 SUSE Bug 1190777 https://bugzilla.suse.com/990189 SUSE Bug 990189 The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. CVE-2016-0634 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-0634.html CVE-2016-0634 https://bugzilla.suse.com/1000396 SUSE Bug 1000396 https://bugzilla.suse.com/1001299 SUSE Bug 1001299 https://bugzilla.suse.com/1159416 SUSE Bug 1159416 https://bugzilla.suse.com/1188388 SUSE Bug 1188388 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. CVE-2016-0718 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-0718.html CVE-2016-0718 https://bugzilla.suse.com/979441 SUSE Bug 979441 https://bugzilla.suse.com/991809 SUSE Bug 991809 The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug." CVE-2016-0787 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-0787.html CVE-2016-0787 https://bugzilla.suse.com/1149968 SUSE Bug 1149968 https://bugzilla.suse.com/967026 SUSE Bug 967026 https://bugzilla.suse.com/968174 SUSE Bug 968174 https://bugzilla.suse.com/974691 SUSE Bug 974691 Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name. CVE-2016-1234 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1234.html CVE-2016-1234 https://bugzilla.suse.com/1020940 SUSE Bug 1020940 https://bugzilla.suse.com/969727 SUSE Bug 969727 https://bugzilla.suse.com/988770 SUSE Bug 988770 https://bugzilla.suse.com/988782 SUSE Bug 988782 https://bugzilla.suse.com/989127 SUSE Bug 989127 (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. CVE-2016-1238 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1238.html CVE-2016-1238 https://bugzilla.suse.com/1108749 SUSE Bug 1108749 https://bugzilla.suse.com/1123389 SUSE Bug 1123389 https://bugzilla.suse.com/987887 SUSE Bug 987887 https://bugzilla.suse.com/988311 SUSE Bug 988311 The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2016-1283 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1283.html CVE-2016-1283 https://bugzilla.suse.com/960837 SUSE Bug 960837 The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1762 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1762.html CVE-2016-1762 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981040 SUSE Bug 981040 The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1833 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1833.html CVE-2016-1833 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981108 SUSE Bug 981108 Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1834 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1834.html CVE-2016-1834 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981041 SUSE Bug 981041 Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1835 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1835.html CVE-2016-1835 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981109 SUSE Bug 981109 Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1837 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1837.html CVE-2016-1837 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981111 SUSE Bug 981111 The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1838 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1838.html CVE-2016-1838 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981112 SUSE Bug 981112 The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1839 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1839.html CVE-2016-1839 https://bugzilla.suse.com/1039069 SUSE Bug 1039069 https://bugzilla.suse.com/1039661 SUSE Bug 1039661 https://bugzilla.suse.com/1069433 SUSE Bug 1069433 https://bugzilla.suse.com/1069690 SUSE Bug 1069690 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/963963 SUSE Bug 963963 https://bugzilla.suse.com/981114 SUSE Bug 981114 Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1840 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-1840.html CVE-2016-1840 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981115 SUSE Bug 981115 The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. CVE-2016-2037 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2037.html CVE-2016-2037 https://bugzilla.suse.com/1028410 SUSE Bug 1028410 https://bugzilla.suse.com/963448 SUSE Bug 963448 The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document. CVE-2016-2073 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2073.html CVE-2016-2073 https://bugzilla.suse.com/963963 SUSE Bug 963963 Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. CVE-2016-2105 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2105.html CVE-2016-2105 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977614 SUSE Bug 977614 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989902 SUSE Bug 989902 https://bugzilla.suse.com/990369 SUSE Bug 990369 https://bugzilla.suse.com/990370 SUSE Bug 990370 Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. CVE-2016-2106 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2106.html CVE-2016-2106 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977615 SUSE Bug 977615 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/979279 SUSE Bug 979279 https://bugzilla.suse.com/990369 SUSE Bug 990369 The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. CVE-2016-2107 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 7.1 AV:N/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2107.html CVE-2016-2107 https://bugzilla.suse.com/976942 SUSE Bug 976942 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977616 SUSE Bug 977616 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/990369 SUSE Bug 990369 https://bugzilla.suse.com/990370 SUSE Bug 990370 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. CVE-2016-2109 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2109.html CVE-2016-2109 https://bugzilla.suse.com/1015243 SUSE Bug 1015243 https://bugzilla.suse.com/976942 SUSE Bug 976942 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/990369 SUSE Bug 990369 OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c. CVE-2016-2177 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2177.html CVE-2016-2177 https://bugzilla.suse.com/982575 SUSE Bug 982575 https://bugzilla.suse.com/999075 SUSE Bug 999075 https://bugzilla.suse.com/999665 SUSE Bug 999665 The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. CVE-2016-2178 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.2 AV:L/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2178.html CVE-2016-2178 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/983249 SUSE Bug 983249 https://bugzilla.suse.com/983519 SUSE Bug 983519 https://bugzilla.suse.com/999665 SUSE Bug 999665 The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. CVE-2016-2179 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2179.html CVE-2016-2179 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/999665 SUSE Bug 999665 The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command. CVE-2016-2180 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2180.html CVE-2016-2180 https://bugzilla.suse.com/1003811 SUSE Bug 1003811 https://bugzilla.suse.com/990419 SUSE Bug 990419 https://bugzilla.suse.com/999665 SUSE Bug 999665 The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. CVE-2016-2181 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2181.html CVE-2016-2181 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/994749 SUSE Bug 994749 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/999665 SUSE Bug 999665 The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. CVE-2016-2182 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 3.6 AV:N/AC:H/Au:S/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2182.html CVE-2016-2182 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/993819 SUSE Bug 993819 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995959 SUSE Bug 995959 https://bugzilla.suse.com/999665 SUSE Bug 999665 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. CVE-2016-2183 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2183.html CVE-2016-2183 https://bugzilla.suse.com/1001912 SUSE Bug 1001912 https://bugzilla.suse.com/1024218 SUSE Bug 1024218 https://bugzilla.suse.com/1027038 SUSE Bug 1027038 https://bugzilla.suse.com/1034689 SUSE Bug 1034689 https://bugzilla.suse.com/1056614 SUSE Bug 1056614 https://bugzilla.suse.com/1171693 SUSE Bug 1171693 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995359 SUSE Bug 995359 Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. CVE-2016-2381 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-2381.html CVE-2016-2381 https://bugzilla.suse.com/967082 SUSE Bug 967082 https://bugzilla.suse.com/992991 SUSE Bug 992991 Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name. CVE-2016-3075 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 4 AV:N/AC:H/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-3075.html CVE-2016-3075 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/973164 SUSE Bug 973164 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. CVE-2016-3191 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-3191.html CVE-2016-3191 https://bugzilla.suse.com/971741 SUSE Bug 971741 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. CVE-2016-3627 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-3627.html CVE-2016-3627 https://bugzilla.suse.com/1026099 SUSE Bug 1026099 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/972335 SUSE Bug 972335 https://bugzilla.suse.com/975947 SUSE Bug 975947 The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. CVE-2016-3705 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-3705.html CVE-2016-3705 https://bugzilla.suse.com/1017497 SUSE Bug 1017497 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/975947 SUSE Bug 975947 Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458. CVE-2016-3706 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-3706.html CVE-2016-3706 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/980483 SUSE Bug 980483 https://bugzilla.suse.com/997423 SUSE Bug 997423 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate. CVE-2016-4008 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4008.html CVE-2016-4008 https://bugzilla.suse.com/982779 SUSE Bug 982779 Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets. CVE-2016-4429 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4429.html CVE-2016-4429 https://bugzilla.suse.com/1081556 SUSE Bug 1081556 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 https://bugzilla.suse.com/980854 SUSE Bug 980854 The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName. CVE-2016-4447 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4447.html CVE-2016-4447 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981548 SUSE Bug 981548 Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors. CVE-2016-4448 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4448.html CVE-2016-4448 https://bugzilla.suse.com/1010299 SUSE Bug 1010299 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981549 SUSE Bug 981549 XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors. CVE-2016-4449 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4449.html CVE-2016-4449 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981550 SUSE Bug 981550 The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. CVE-2016-4483 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4483.html CVE-2016-4483 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/978395 SUSE Bug 978395 Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356. CVE-2016-4574 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4574.html CVE-2016-4574 https://bugzilla.suse.com/1135436 SUSE Bug 1135436 https://bugzilla.suse.com/979261 SUSE Bug 979261 Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl." CVE-2016-4579 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4579.html CVE-2016-4579 https://bugzilla.suse.com/1135436 SUSE Bug 1135436 https://bugzilla.suse.com/979906 SUSE Bug 979906 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. CVE-2016-4658 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-4658.html CVE-2016-4658 https://bugzilla.suse.com/1005544 SUSE Bug 1005544 https://bugzilla.suse.com/1014873 SUSE Bug 1014873 https://bugzilla.suse.com/1069433 SUSE Bug 1069433 https://bugzilla.suse.com/1078813 SUSE Bug 1078813 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset. CVE-2016-5011 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-5011.html CVE-2016-5011 https://bugzilla.suse.com/988361 SUSE Bug 988361 The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. CVE-2016-5300 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-5300.html CVE-2016-5300 https://bugzilla.suse.com/983216 SUSE Bug 983216 curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. CVE-2016-5419 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-5419.html CVE-2016-5419 https://bugzilla.suse.com/1033413 SUSE Bug 1033413 https://bugzilla.suse.com/1033442 SUSE Bug 1033442 https://bugzilla.suse.com/991389 SUSE Bug 991389 curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. CVE-2016-5420 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-5420.html CVE-2016-5420 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420 Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors. CVE-2016-5421 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-5421.html CVE-2016-5421 https://bugzilla.suse.com/991391 SUSE Bug 991391 The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory. CVE-2016-6185 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6185.html CVE-2016-6185 https://bugzilla.suse.com/988311 SUSE Bug 988311 https://bugzilla.suse.com/999993 SUSE Bug 999993 The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. CVE-2016-6261 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6261.html CVE-2016-6261 https://bugzilla.suse.com/1118435 SUSE Bug 1118435 https://bugzilla.suse.com/1173590 SUSE Bug 1173590 https://bugzilla.suse.com/990190 SUSE Bug 990190 idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948. CVE-2016-6262 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6262.html CVE-2016-6262 https://bugzilla.suse.com/1014473 SUSE Bug 1014473 https://bugzilla.suse.com/1173590 SUSE Bug 1173590 https://bugzilla.suse.com/1190777 SUSE Bug 1190777 https://bugzilla.suse.com/990189 SUSE Bug 990189 The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data. CVE-2016-6263 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6263.html CVE-2016-6263 https://bugzilla.suse.com/1118435 SUSE Bug 1118435 https://bugzilla.suse.com/990191 SUSE Bug 990191 The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. CVE-2016-6302 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6302.html CVE-2016-6302 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995324 SUSE Bug 995324 https://bugzilla.suse.com/999665 SUSE Bug 999665 Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. CVE-2016-6303 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6303.html CVE-2016-6303 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995377 SUSE Bug 995377 https://bugzilla.suse.com/999665 SUSE Bug 999665 Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. CVE-2016-6304 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6304.html CVE-2016-6304 https://bugzilla.suse.com/1001706 SUSE Bug 1001706 https://bugzilla.suse.com/1003811 SUSE Bug 1003811 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/1005579 SUSE Bug 1005579 https://bugzilla.suse.com/1021375 SUSE Bug 1021375 https://bugzilla.suse.com/999665 SUSE Bug 999665 https://bugzilla.suse.com/999666 SUSE Bug 999666 The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c. CVE-2016-6306 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6306.html CVE-2016-6306 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/999665 SUSE Bug 999665 https://bugzilla.suse.com/999668 SUSE Bug 999668 The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. CVE-2016-6313 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6313.html CVE-2016-6313 https://bugzilla.suse.com/1123792 SUSE Bug 1123792 https://bugzilla.suse.com/994157 SUSE Bug 994157 Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer. CVE-2016-6318 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-6318.html CVE-2016-6318 https://bugzilla.suse.com/1123113 SUSE Bug 1123113 https://bugzilla.suse.com/992966 SUSE Bug 992966 A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. CVE-2016-7056 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-7056.html CVE-2016-7056 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1019334 SUSE Bug 1019334 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420. CVE-2016-7141 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-7141.html CVE-2016-7141 https://bugzilla.suse.com/991390 SUSE Bug 991390 https://bugzilla.suse.com/997420 SUSE Bug 997420 Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow. CVE-2016-7167 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-7167.html CVE-2016-7167 https://bugzilla.suse.com/998760 SUSE Bug 998760 Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. CVE-2016-7543 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-7543.html CVE-2016-7543 https://bugzilla.suse.com/1001299 SUSE Bug 1001299 https://bugzilla.suse.com/1159416 SUSE Bug 1159416 The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled. CVE-2016-7796 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-7796.html CVE-2016-7796 https://bugzilla.suse.com/1001765 SUSE Bug 1001765 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1110018 SUSE Bug 1110018 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/982575 SUSE Bug 982575 A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. CVE-2016-8615 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8615.html CVE-2016-8615 https://bugzilla.suse.com/1005633 SUSE Bug 1005633 A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password. CVE-2016-8616 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8616.html CVE-2016-8616 https://bugzilla.suse.com/1005634 SUSE Bug 1005634 The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. CVE-2016-8617 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8617.html CVE-2016-8617 https://bugzilla.suse.com/1005635 SUSE Bug 1005635 The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. CVE-2016-8618 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8618.html CVE-2016-8618 https://bugzilla.suse.com/1005637 SUSE Bug 1005637 The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. CVE-2016-8619 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8619.html CVE-2016-8619 https://bugzilla.suse.com/1005638 SUSE Bug 1005638 The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. CVE-2016-8620 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8620.html CVE-2016-8620 https://bugzilla.suse.com/1005640 SUSE Bug 1005640 The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. CVE-2016-8621 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8621.html CVE-2016-8621 https://bugzilla.suse.com/1005642 SUSE Bug 1005642 The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer. CVE-2016-8622 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8622.html CVE-2016-8622 https://bugzilla.suse.com/1005643 SUSE Bug 1005643 A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. CVE-2016-8623 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8623.html CVE-2016-8623 https://bugzilla.suse.com/1005645 SUSE Bug 1005645 curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. CVE-2016-8624 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-8624.html CVE-2016-8624 https://bugzilla.suse.com/1005646 SUSE Bug 1005646 An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. CVE-2016-9063 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 critical 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9063.html CVE-2016-9063 https://bugzilla.suse.com/1009026 SUSE Bug 1009026 https://bugzilla.suse.com/1010424 SUSE Bug 1010424 https://bugzilla.suse.com/1047240 SUSE Bug 1047240 https://bugzilla.suse.com/1123115 SUSE Bug 1123115 libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. CVE-2016-9318 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9318.html CVE-2016-9318 https://bugzilla.suse.com/1010675 SUSE Bug 1010675 https://bugzilla.suse.com/1014873 SUSE Bug 1014873 https://bugzilla.suse.com/1019074 SUSE Bug 1019074 https://bugzilla.suse.com/1118959 SUSE Bug 1118959 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/1126613 SUSE Bug 1126613 https://bugzilla.suse.com/1148896 SUSE Bug 1148896 curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. CVE-2016-9586 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 1.2 AV:L/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9586.html CVE-2016-9586 https://bugzilla.suse.com/1015332 SUSE Bug 1015332 It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705. CVE-2016-9597 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9597.html CVE-2016-9597 https://bugzilla.suse.com/1014873 SUSE Bug 1014873 https://bugzilla.suse.com/1017497 SUSE Bug 1017497 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9840 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9840.html CVE-2016-9840 https://bugzilla.suse.com/1003579 SUSE Bug 1003579 https://bugzilla.suse.com/1022633 SUSE Bug 1022633 https://bugzilla.suse.com/1023215 SUSE Bug 1023215 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1062104 SUSE Bug 1062104 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 https://bugzilla.suse.com/1184301 SUSE Bug 1184301 inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9841.html CVE-2016-9841 https://bugzilla.suse.com/1003579 SUSE Bug 1003579 https://bugzilla.suse.com/1022633 SUSE Bug 1022633 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1064070 SUSE Bug 1064070 https://bugzilla.suse.com/1070162 SUSE Bug 1070162 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9842 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9842.html CVE-2016-9842 https://bugzilla.suse.com/1003580 SUSE Bug 1003580 https://bugzilla.suse.com/1022633 SUSE Bug 1022633 https://bugzilla.suse.com/1023215 SUSE Bug 1023215 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1062104 SUSE Bug 1062104 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 https://bugzilla.suse.com/1184301 SUSE Bug 1184301 The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. CVE-2016-9843 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2016-9843.html CVE-2016-9843 https://bugzilla.suse.com/1003580 SUSE Bug 1003580 https://bugzilla.suse.com/1013882 SUSE Bug 1013882 https://bugzilla.suse.com/1038505 SUSE Bug 1038505 https://bugzilla.suse.com/1062104 SUSE Bug 1062104 https://bugzilla.suse.com/1116686 SUSE Bug 1116686 https://bugzilla.suse.com/1120866 SUSE Bug 1120866 https://bugzilla.suse.com/1123150 SUSE Bug 1123150 https://bugzilla.suse.com/1127473 SUSE Bug 1127473 https://bugzilla.suse.com/1184301 SUSE Bug 1184301 When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS. CVE-2017-1000100 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-1000100.html CVE-2017-1000100 https://bugzilla.suse.com/1051644 SUSE Bug 1051644 curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`. CVE-2017-1000101 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-1000101.html CVE-2017-1000101 https://bugzilla.suse.com/1051643 SUSE Bug 1051643 glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. CVE-2017-1000366 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-1000366.html CVE-2017-1000366 https://bugzilla.suse.com/1037551 SUSE Bug 1037551 https://bugzilla.suse.com/1039357 SUSE Bug 1039357 https://bugzilla.suse.com/1071319 SUSE Bug 1071319 https://bugzilla.suse.com/1123874 SUSE Bug 1123874 In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. CVE-2017-10684 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-10684.html CVE-2017-10684 https://bugzilla.suse.com/1046858 SUSE Bug 1046858 https://bugzilla.suse.com/1115932 SUSE Bug 1115932 https://bugzilla.suse.com/1175501 SUSE Bug 1175501 In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. CVE-2017-10685 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-10685.html CVE-2017-10685 https://bugzilla.suse.com/1046853 SUSE Bug 1046853 https://bugzilla.suse.com/1115932 SUSE Bug 1115932 https://bugzilla.suse.com/1175501 SUSE Bug 1175501 In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data. CVE-2017-11112 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.1 AV:L/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-11112.html CVE-2017-11112 https://bugzilla.suse.com/1046853 SUSE Bug 1046853 https://bugzilla.suse.com/1047964 SUSE Bug 1047964 https://bugzilla.suse.com/1175501 SUSE Bug 1175501 In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data. CVE-2017-11113 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.1 AV:L/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-11113.html CVE-2017-11113 https://bugzilla.suse.com/1046853 SUSE Bug 1046853 https://bugzilla.suse.com/1047965 SUSE Bug 1047965 https://bugzilla.suse.com/1175501 SUSE Bug 1175501 A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. CVE-2017-2616 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-2616.html CVE-2017-2616 https://bugzilla.suse.com/1023041 SUSE Bug 1023041 https://bugzilla.suse.com/1123789 SUSE Bug 1123789 If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. CVE-2017-3731 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-3731.html CVE-2017-3731 https://bugzilla.suse.com/1021641 SUSE Bug 1021641 https://bugzilla.suse.com/1022085 SUSE Bug 1022085 https://bugzilla.suse.com/1064118 SUSE Bug 1064118 https://bugzilla.suse.com/1064119 SUSE Bug 1064119 An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic. CVE-2017-6507 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-6507.html CVE-2017-6507 https://bugzilla.suse.com/1029696 SUSE Bug 1029696 The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read. CVE-2017-7407 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1 AV:L/AC:H/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-7407.html CVE-2017-7407 https://bugzilla.suse.com/1032309 SUSE Bug 1032309 libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used. CVE-2017-7526 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 low 1.2 AV:L/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-7526.html CVE-2017-7526 https://bugzilla.suse.com/1046607 SUSE Bug 1046607 https://bugzilla.suse.com/1047462 SUSE Bug 1047462 https://bugzilla.suse.com/1123792 SUSE Bug 1123792 A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. CVE-2017-9047 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-9047.html CVE-2017-9047 https://bugzilla.suse.com/1039063 SUSE Bug 1039063 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039657 SUSE Bug 1039657 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. CVE-2017-9048 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-9048.html CVE-2017-9048 https://bugzilla.suse.com/1039064 SUSE Bug 1039064 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039658 SUSE Bug 1039658 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. CVE-2017-9049 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-9049.html CVE-2017-9049 https://bugzilla.suse.com/1039063 SUSE Bug 1039063 https://bugzilla.suse.com/1039064 SUSE Bug 1039064 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039659 SUSE Bug 1039659 https://bugzilla.suse.com/1039661 SUSE Bug 1039661 https://bugzilla.suse.com/1069690 SUSE Bug 1069690 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. CVE-2017-9050 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-9050.html CVE-2017-9050 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039069 SUSE Bug 1039069 https://bugzilla.suse.com/1039661 SUSE Bug 1039661 https://bugzilla.suse.com/1069433 SUSE Bug 1069433 https://bugzilla.suse.com/1069690 SUSE Bug 1069690 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. CVE-2017-9233 SUSE Linux Enterprise Module for Containers 12:sles12sp1-docker-image-1.0.7-20171002 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/ https://www.suse.com/security/cve/CVE-2017-9233.html CVE-2017-9233 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1047236 SUSE Bug 1047236 https://bugzilla.suse.com/1073350 SUSE Bug 1073350 https://bugzilla.suse.com/1123115 SUSE Bug 1123115 https://bugzilla.suse.com/983216 SUSE Bug 983216