Security update for zziplib SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0919-1 Final 1 1 2018-04-11T06:43:27Z current 2018-04-11T06:43:27Z 2018-04-11T06:43:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for zziplib This update for zziplib fixes the following issues: Security issues fixed: - CVE-2018-7726: There is a bus error caused by the__zzip_parse_root_directory function of zip.c. Attackers could leverage thisvulnerability to cause a denial of service (bsc#1084517). - CVE-2018-7725: An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service (bsc#1084519). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-619,SUSE-SLE-SDK-12-SP3-2018-619,SUSE-SLE-WE-12-SP3-2018-619 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180919-1/ Link for SUSE-SU-2018:0919-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003884.html E-Mail link for SUSE-SU-2018:0919-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1084517 SUSE Bug 1084517 https://bugzilla.suse.com/1084519 SUSE Bug 1084519 https://www.suse.com/security/cve/CVE-2018-7725/ SUSE CVE CVE-2018-7725 page https://www.suse.com/security/cve/CVE-2018-7726/ SUSE CVE CVE-2018-7726 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Workstation Extension 12 SP3 libzzip-0-13-0.13.67-10.8.1 zziplib-devel-0.13.67-10.8.1 libzzip-0-13-0.13.67-10.8.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libzzip-0-13-0.13.67-10.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 zziplib-devel-0.13.67-10.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libzzip-0-13-0.13.67-10.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP3 An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service. CVE-2018-7725 SUSE Linux Enterprise Desktop 12 SP3:libzzip-0-13-0.13.67-10.8.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libzzip-0-13-0.13.67-10.8.1 SUSE Linux Enterprise Software Development Kit 12 SP3:zziplib-devel-0.13.67-10.8.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libzzip-0-13-0.13.67-10.8.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180919-1/ https://www.suse.com/security/cve/CVE-2018-7725.html CVE-2018-7725 https://bugzilla.suse.com/1084519 SUSE Bug 1084519 An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. CVE-2018-7726 SUSE Linux Enterprise Desktop 12 SP3:libzzip-0-13-0.13.67-10.8.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libzzip-0-13-0.13.67-10.8.1 SUSE Linux Enterprise Software Development Kit 12 SP3:zziplib-devel-0.13.67-10.8.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libzzip-0-13-0.13.67-10.8.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180919-1/ https://www.suse.com/security/cve/CVE-2018-7726.html CVE-2018-7726 https://bugzilla.suse.com/1084517 SUSE Bug 1084517