Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP1) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2859-1 Final 1 1 2019-10-30T11:44:23Z current 2019-10-30T11:44:23Z 2019-10-30T11:44:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP1) This update for the Linux Kernel 4.12.14-197_18 fixes several issues. The following security issues were fixed: - CVE-2019-10220: Fixed a relative path escape in the Samba client module (bsc#1144903, bsc#1153108). - CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2859,SUSE-SLE-Live-Patching-12-SP4-2019-2849,SUSE-SLE-Module-Live-Patching-15-2019-2859,SUSE-SLE-Module-Live-Patching-15-SP1-2019-2865 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192859-1/ Link for SUSE-SU-2019:2859-1 https://www.suse.com/support/update/announcement/2019/suse-su-20192859-1.html E-Mail link for SUSE-SU-2019:2859-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1144903 SUSE Bug 1144903 https://bugzilla.suse.com/1149841 SUSE Bug 1149841 https://bugzilla.suse.com/1153108 SUSE Bug 1153108 https://bugzilla.suse.com/1153158 SUSE Bug 1153158 https://bugzilla.suse.com/1153161 SUSE Bug 1153161 https://www.suse.com/security/cve/CVE-2019-10220/ SUSE CVE CVE-2019-10220 page https://www.suse.com/security/cve/CVE-2019-17133/ SUSE CVE CVE-2019-17133 page SUSE Linux Enterprise Live Patching 12 SP4 SUSE Linux Enterprise Live Patching 15 SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-4_12_14-150_35-default-2-2.1 kgraft-patch-4_12_14-95_32-default-2-2.1 kernel-livepatch-4_12_14-197_18-default-2-2.1 kgraft-patch-4_12_14-95_32-default-2-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP4 kernel-livepatch-4_12_14-150_35-default-2-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-197_18-default-2-2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP1 Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. CVE-2019-10220 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_32-default-2-2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_18-default-2-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_35-default-2-2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192859-1/ https://www.suse.com/security/cve/CVE-2019-10220.html CVE-2019-10220 https://bugzilla.suse.com/1144903 SUSE Bug 1144903 https://bugzilla.suse.com/1153108 SUSE Bug 1153108 In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. CVE-2019-17133 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_32-default-2-2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_18-default-2-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_35-default-2-2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192859-1/ https://www.suse.com/security/cve/CVE-2019-17133.html CVE-2019-17133 https://bugzilla.suse.com/1153158 SUSE Bug 1153158 https://bugzilla.suse.com/1153161 SUSE Bug 1153161