Security update for ant SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2789-1 Final 1 1 2018-09-21T11:51:26Z current 2018-09-21T11:51:26Z 2018-09-21T11:51:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ant This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053) Other changes made: - Removed support for javadoc - Default value for stripAbsolutePathSpec changed to 'true' The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ant-13781,slessp4-ant-13781 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182789-1/ Link for SUSE-SU-2018:2789-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004578.html E-Mail link for SUSE-SU-2018:2789-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1100053 SUSE Bug 1100053 https://www.suse.com/security/cve/CVE-2018-10886/ SUSE CVE CVE-2018-10886 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ant-1.7.1-20.11.5.1 ant-antlr-1.7.1-16.11.5.1 ant-apache-bcel-1.7.1-16.11.5.1 ant-apache-bsf-1.7.1-16.11.5.1 ant-apache-log4j-1.7.1-16.11.5.1 ant-apache-oro-1.7.1-16.11.5.1 ant-apache-regexp-1.7.1-16.11.5.1 ant-apache-resolver-1.7.1-16.11.5.1 ant-commons-logging-1.7.1-16.11.5.1 ant-javamail-1.7.1-16.11.5.1 ant-jdepend-1.7.1-16.11.5.1 ant-jmf-1.7.1-16.11.5.1 ant-junit-1.7.1-16.11.5.1 ant-manual-1.7.1-20.11.5.1 ant-nodeps-1.7.1-16.11.5.1 ant-scripts-1.7.1-20.11.5.1 ant-swing-1.7.1-16.11.5.1 ant-trax-1.7.1-16.11.5.1 ant-1.7.1-20.11.5.1 as a component of SUSE Linux Enterprise Server 11 SP4 ant-trax-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Server 11 SP4 ant-1.7.1-20.11.5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ant-trax-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ant-1.7.1-20.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-antlr-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-apache-bcel-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-apache-bsf-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-apache-log4j-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-apache-oro-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-apache-regexp-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-apache-resolver-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-commons-logging-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-javamail-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-jdepend-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-jmf-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-junit-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-manual-1.7.1-20.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-nodeps-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-scripts-1.7.1-20.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-swing-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ant-trax-1.7.1-16.11.5.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: this candidate is not about any specific product, protocol, or design, that falls into the scope of the assigning CNA. Notes: None. CVE-2018-10886 SUSE Linux Enterprise Server 11 SP4:ant-1.7.1-20.11.5.1 SUSE Linux Enterprise Server 11 SP4:ant-trax-1.7.1-16.11.5.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ant-1.7.1-20.11.5.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ant-trax-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-1.7.1-20.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-antlr-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-apache-bcel-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-apache-bsf-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-apache-log4j-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-apache-oro-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-apache-regexp-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-apache-resolver-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-commons-logging-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-javamail-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-jdepend-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-jmf-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-junit-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-manual-1.7.1-20.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-nodeps-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-scripts-1.7.1-20.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-swing-1.7.1-16.11.5.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ant-trax-1.7.1-16.11.5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182789-1/ https://www.suse.com/security/cve/CVE-2018-10886.html CVE-2018-10886 https://bugzilla.suse.com/1100053 SUSE Bug 1100053