Security update for ovmf SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0581-1 Final 1 1 2019-03-11T12:57:45Z current 2019-03-11T12:57:45Z 2019-03-11T12:57:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ovmf This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-12180: Fixed a buffer overflow in BlockIo service, which could lead to memory read/write overrun (bsc#1127820). - CVE-2018-12178: Fixed an improper DNS check upon receiving a new DNS packet (bsc#1127821). - CVE-2018-3630: Fixed a logic error in FV parsing which could allow a local attacker to bypass the chain of trust checks (bsc#1127822). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-581,SUSE-SLE-DESKTOP-12-SP4-2019-581,SUSE-SLE-SERVER-12-SP4-2019-581 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190581-1/ Link for SUSE-SU-2019:0581-1 https://lists.suse.com/pipermail/sle-security-updates/2019-March/005183.html E-Mail link for SUSE-SU-2019:0581-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1127820 SUSE Bug 1127820 https://bugzilla.suse.com/1127821 SUSE Bug 1127821 https://bugzilla.suse.com/1127822 SUSE Bug 1127822 https://www.suse.com/security/cve/CVE-2018-12178/ SUSE CVE CVE-2018-12178 page https://www.suse.com/security/cve/CVE-2018-12180/ SUSE CVE CVE-2018-12180 page https://www.suse.com/security/cve/CVE-2018-3630/ SUSE CVE CVE-2018-3630 page SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 ovmf-2017+git1510945757.b2662641d5-3.8.3 ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 qemu-ovmf-ia32-2017+git1510945757.b2662641d5-3.8.3 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-3.8.3 qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Desktop 12 SP4 ovmf-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server 12 SP4 ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server 12 SP4 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server 12 SP4 qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server 12 SP4 ovmf-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network. CVE-2018-12178 SUSE Linux Enterprise Desktop 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190581-1/ https://www.suse.com/security/cve/CVE-2018-12178.html CVE-2018-12178 https://bugzilla.suse.com/1127821 SUSE Bug 1127821 Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access. CVE-2018-12180 SUSE Linux Enterprise Desktop 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190581-1/ https://www.suse.com/security/cve/CVE-2018-12180.html CVE-2018-12180 https://bugzilla.suse.com/1127820 SUSE Bug 1127820 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none. CVE-2018-3630 SUSE Linux Enterprise Desktop 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server 12 SP4:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.8.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190581-1/ https://www.suse.com/security/cve/CVE-2018-3630.html CVE-2018-3630 https://bugzilla.suse.com/1127822 SUSE Bug 1127822