Security update for libsoup SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2204-2 Final 1 1 2019-01-08T08:36:26Z current 2019-01-08T08:36:26Z 2019-01-08T08:36:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsoup This update for libsoup fixes the following issues: Security issue fixed: - CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097). - CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916). Bug fixes: - bsc#1086036: translation-update-upstream commented out for Leap The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2019-25,SUSE-SLE-SAP-12-SP2-2019-25,SUSE-SLE-SERVER-12-SP2-2019-25,SUSE-Storage-4-2019-25 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182204-2/ Link for SUSE-SU-2018:2204-2 https://lists.suse.com/pipermail/sle-security-updates/2019-January/005020.html E-Mail link for SUSE-SU-2018:2204-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1052916 SUSE Bug 1052916 https://bugzilla.suse.com/1086036 SUSE Bug 1086036 https://bugzilla.suse.com/1100097 SUSE Bug 1100097 https://www.suse.com/security/cve/CVE-2017-2885/ SUSE CVE CVE-2017-2885 page https://www.suse.com/security/cve/CVE-2018-12910/ SUSE CVE CVE-2018-12910 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE OpenStack Cloud 7 libsoup-2_4-1-2.62.2-5.7.1 libsoup-2_4-1-32bit-2.62.2-5.7.1 libsoup-lang-2.62.2-5.7.1 typelib-1_0-Soup-2_4-2.62.2-5.7.1 libsoup-2_4-1-2.62.2-5.7.1 as a component of SUSE Enterprise Storage 4 libsoup-2_4-1-32bit-2.62.2-5.7.1 as a component of SUSE Enterprise Storage 4 libsoup-lang-2.62.2-5.7.1 as a component of SUSE Enterprise Storage 4 typelib-1_0-Soup-2_4-2.62.2-5.7.1 as a component of SUSE Enterprise Storage 4 libsoup-2_4-1-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libsoup-2_4-1-32bit-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libsoup-lang-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS typelib-1_0-Soup-2_4-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libsoup-2_4-1-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsoup-2_4-1-32bit-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsoup-lang-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 typelib-1_0-Soup-2_4-2.62.2-5.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsoup-2_4-1-2.62.2-5.7.1 as a component of SUSE OpenStack Cloud 7 libsoup-2_4-1-32bit-2.62.2-5.7.1 as a component of SUSE OpenStack Cloud 7 libsoup-lang-2.62.2-5.7.1 as a component of SUSE OpenStack Cloud 7 typelib-1_0-Soup-2_4-2.62.2-5.7.1 as a component of SUSE OpenStack Cloud 7 An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability. CVE-2017-2885 SUSE Enterprise Storage 4:libsoup-2_4-1-2.62.2-5.7.1 SUSE Enterprise Storage 4:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE Enterprise Storage 4:libsoup-lang-2.62.2-5.7.1 SUSE Enterprise Storage 4:typelib-1_0-Soup-2_4-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libsoup-2_4-1-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libsoup-lang-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:typelib-1_0-Soup-2_4-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsoup-2_4-1-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsoup-lang-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:typelib-1_0-Soup-2_4-2.62.2-5.7.1 SUSE OpenStack Cloud 7:libsoup-2_4-1-2.62.2-5.7.1 SUSE OpenStack Cloud 7:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE OpenStack Cloud 7:libsoup-lang-2.62.2-5.7.1 SUSE OpenStack Cloud 7:typelib-1_0-Soup-2_4-2.62.2-5.7.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182204-2/ https://www.suse.com/security/cve/CVE-2017-2885.html CVE-2017-2885 https://bugzilla.suse.com/1052916 SUSE Bug 1052916 The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. CVE-2018-12910 SUSE Enterprise Storage 4:libsoup-2_4-1-2.62.2-5.7.1 SUSE Enterprise Storage 4:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE Enterprise Storage 4:libsoup-lang-2.62.2-5.7.1 SUSE Enterprise Storage 4:typelib-1_0-Soup-2_4-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libsoup-2_4-1-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libsoup-lang-2.62.2-5.7.1 SUSE Linux Enterprise Server 12 SP2-LTSS:typelib-1_0-Soup-2_4-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsoup-2_4-1-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsoup-lang-2.62.2-5.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:typelib-1_0-Soup-2_4-2.62.2-5.7.1 SUSE OpenStack Cloud 7:libsoup-2_4-1-2.62.2-5.7.1 SUSE OpenStack Cloud 7:libsoup-2_4-1-32bit-2.62.2-5.7.1 SUSE OpenStack Cloud 7:libsoup-lang-2.62.2-5.7.1 SUSE OpenStack Cloud 7:typelib-1_0-Soup-2_4-2.62.2-5.7.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182204-2/ https://www.suse.com/security/cve/CVE-2018-12910.html CVE-2018-12910 https://bugzilla.suse.com/1100097 SUSE Bug 1100097