Security update for xmltooling SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0720-1 Final 1 1 2018-03-16T15:31:26Z current 2018-03-16T15:31:26Z 2018-03-16T15:31:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xmltooling This update for xmltooling fixes the following issues: - CVE-2018-0489: Fixed a security bug when xmltooling mishandled digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. (bsc#1083247) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-RPI-12-SP2-2018-488,SUSE-SLE-SDK-12-SP2-2018-488,SUSE-SLE-SDK-12-SP3-2018-488,SUSE-SLE-SERVER-12-SP2-2018-488,SUSE-SLE-SERVER-12-SP3-2018-488 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180720-1/ Link for SUSE-SU-2018:0720-1 https://lists.suse.com/pipermail/sle-security-updates/2018-March/003822.html E-Mail link for SUSE-SU-2018:0720-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1083247 SUSE Bug 1083247 https://www.suse.com/security/cve/CVE-2018-0486/ SUSE CVE CVE-2018-0486 page https://www.suse.com/security/cve/CVE-2018-0489/ SUSE CVE CVE-2018-0489 page SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 libxmltooling6-1.5.6-3.6.1 xmltooling-schemas-1.5.6-3.6.1 libxmltooling-devel-1.5.6-3.6.1 libxmltooling6-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP2 xmltooling-schemas-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP2 libxmltooling6-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP3 xmltooling-schemas-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP3 libxmltooling6-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 xmltooling-schemas-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libxmltooling6-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xmltooling-schemas-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libxmltooling6-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xmltooling-schemas-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libxmltooling-devel-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libxmltooling-devel-1.5.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. CVE-2018-0486 SUSE Linux Enterprise Server 12 SP2:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server 12 SP2:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server 12 SP3:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server 12 SP3:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libxmltooling-devel-1.5.6-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libxmltooling-devel-1.5.6-3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180720-1/ https://www.suse.com/security/cve/CVE-2018-0486.html CVE-2018-0486 https://bugzilla.suse.com/1075975 SUSE Bug 1075975 https://bugzilla.suse.com/1083247 SUSE Bug 1083247 Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. CVE-2018-0489 SUSE Linux Enterprise Server 12 SP2:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server 12 SP2:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server 12 SP3:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server 12 SP3:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libxmltooling6-1.5.6-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xmltooling-schemas-1.5.6-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libxmltooling-devel-1.5.6-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libxmltooling-devel-1.5.6-3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180720-1/ https://www.suse.com/security/cve/CVE-2018-0489.html CVE-2018-0489 https://bugzilla.suse.com/1083247 SUSE Bug 1083247