Security update for the Ruby on Rails stack SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2716-1 Final 1 1 2017-10-12T12:43:34Z current 2017-10-12T12:43:34Z 2017-10-12T12:43:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Ruby on Rails stack This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and improvements from upstream. The following security issues have been fixed by upstream: rubygem-actionpack-4_2 - CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method (bsc#968849). rubygem-activerecord-4_2 - CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313). rubygem-actionview-4_2 - CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject arbitrary web script or HTML via text declared as 'HTML safe' and used as attribute values in tag handlers (bsc#993302). Additionally, the following packages have been updated to version 4.2.9: - rubygem-rails-4_2 - rubygem-railties-4_2 - rubygem-activesupport-4_2 - rubygem-activerecord-4_2 - rubygem-activejob-4_2 - rubygem-actionview-4_2 - rubygem-actionpack-4_2 - rubygem-actionmailer-4_2 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2017-1679,SUSE-OpenStack-Cloud-7-2017-1679,SUSE-Storage-3-2017-1679,SUSE-Storage-4-2017-1679 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/ Link for SUSE-SU-2017:2716-1 https://lists.suse.com/pipermail/sle-security-updates/2017-October/003293.html E-Mail link for SUSE-SU-2017:2716-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1055962 SUSE Bug 1055962 https://bugzilla.suse.com/968849 SUSE Bug 968849 https://bugzilla.suse.com/993302 SUSE Bug 993302 https://bugzilla.suse.com/993313 SUSE Bug 993313 https://www.suse.com/security/cve/CVE-2016-2098/ SUSE CVE CVE-2016-2098 page https://www.suse.com/security/cve/CVE-2016-6316/ SUSE CVE CVE-2016-6316 page https://www.suse.com/security/cve/CVE-2016-6317/ SUSE CVE CVE-2016-6317 page SUSE Enterprise Storage 3 SUSE Enterprise Storage 4 SUSE OpenStack Cloud 6 SUSE OpenStack Cloud 7 ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 3 ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 6 ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 as a component of SUSE OpenStack Cloud 7 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. CVE-2016-2098 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/ https://www.suse.com/security/cve/CVE-2016-2098.html CVE-2016-2098 https://bugzilla.suse.com/968849 SUSE Bug 968849 https://bugzilla.suse.com/969943 SUSE Bug 969943 https://bugzilla.suse.com/993313 SUSE Bug 993313 Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers. CVE-2016-6316 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/ https://www.suse.com/security/cve/CVE-2016-6316.html CVE-2016-6316 https://bugzilla.suse.com/993302 SUSE Bug 993302 https://bugzilla.suse.com/993313 SUSE Bug 993313 Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155. CVE-2016-6317 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/ https://www.suse.com/security/cve/CVE-2016-6317.html CVE-2016-6317 https://bugzilla.suse.com/993313 SUSE Bug 993313