Security update for libofx SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2064-1 Final 1 1 2018-07-26T14:51:20Z current 2018-07-26T14:51:20Z 2018-07-26T14:51:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libofx This update for libofx fixes the following issues: Security issues fixed: - CVE-2017-2816: Fix an exploitable buffer overflow vulnerability in the tag parsing functionality (bsc#1058673). - CVE-2017-2920: Fix a buffer overflow vulnerability in sanitize_proprietary_tags in lib/ofx_preproc.cpp (bsc#1061964). - CVE-2017-14731: Fix remote denial of service via a crafted file in ofx_proc_file in ofx_preproc.cpp (bsc#1060437). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-1408,SUSE-SLE-SDK-12-SP3-2018-1408,SUSE-SLE-WE-12-SP3-2018-1408 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182064-1/ Link for SUSE-SU-2018:2064-1 https://lists.suse.com/pipermail/sle-security-updates/2018-July/004310.html E-Mail link for SUSE-SU-2018:2064-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1058673 SUSE Bug 1058673 https://bugzilla.suse.com/1060437 SUSE Bug 1060437 https://bugzilla.suse.com/1061964 SUSE Bug 1061964 https://www.suse.com/security/cve/CVE-2017-14731/ SUSE CVE CVE-2017-14731 page https://www.suse.com/security/cve/CVE-2017-2816/ SUSE CVE CVE-2017-2816 page https://www.suse.com/security/cve/CVE-2017-2920/ SUSE CVE CVE-2017-2920 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Workstation Extension 12 SP3 libofx-0.9.9-3.7.1 libofx6-0.9.9-3.7.1 libofx-devel-0.9.9-3.7.1 libofx-0.9.9-3.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libofx6-0.9.9-3.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libofx-0.9.9-3.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libofx-devel-0.9.9-3.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libofx-0.9.9-3.7.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP3 libofx6-0.9.9-3.7.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP3 ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call. CVE-2017-14731 SUSE Linux Enterprise Desktop 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Desktop 12 SP3:libofx6-0.9.9-3.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libofx-devel-0.9.9-3.7.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libofx6-0.9.9-3.7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182064-1/ https://www.suse.com/security/cve/CVE-2017-14731.html CVE-2017-14731 https://bugzilla.suse.com/1060437 SUSE Bug 1060437 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability. CVE-2017-2816 SUSE Linux Enterprise Desktop 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Desktop 12 SP3:libofx6-0.9.9-3.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libofx-devel-0.9.9-3.7.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libofx6-0.9.9-3.7.1 moderate 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182064-1/ https://www.suse.com/security/cve/CVE-2017-2816.html CVE-2017-2816 https://bugzilla.suse.com/1058673 SUSE Bug 1058673 An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability. CVE-2017-2920 SUSE Linux Enterprise Desktop 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Desktop 12 SP3:libofx6-0.9.9-3.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libofx-devel-0.9.9-3.7.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libofx-0.9.9-3.7.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libofx6-0.9.9-3.7.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182064-1/ https://www.suse.com/security/cve/CVE-2017-2920.html CVE-2017-2920 https://bugzilla.suse.com/1061964 SUSE Bug 1061964