Security update for taglib SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2968-1 Final 1 1 2020-10-20T14:04:53Z current 2020-10-20T14:04:53Z 2020-10-20T14:04:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for taglib This update for taglib fixes the following issues: - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file (bsc#1096180). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2968,SUSE-SLE-SDK-12-SP5-2020-2968,SUSE-SLE-SERVER-12-SP5-2020-2968,SUSE-SLE-WE-12-SP5-2020-2968 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202968-1/ Link for SUSE-SU-2020:2968-1 https://lists.suse.com/pipermail/sle-security-updates/2020-October/007596.html E-Mail link for SUSE-SU-2020:2968-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1096180 SUSE Bug 1096180 https://www.suse.com/security/cve/CVE-2018-11439/ SUSE CVE CVE-2018-11439 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 libtag-devel-1.9.1-3.4.18 libtag1-1.9.1-3.4.18 libtag1-32bit-1.9.1-3.4.18 libtag1-64bit-1.9.1-3.4.18 libtag_c0-1.9.1-3.4.18 libtag_c0-32bit-1.9.1-3.4.18 libtag_c0-64bit-1.9.1-3.4.18 taglib-1.9.1-3.4.18 libtag1-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Server 12 SP5 libtag_c0-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Server 12 SP5 taglib-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Server 12 SP5 libtag1-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libtag_c0-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 taglib-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libtag-devel-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libtag1-32bit-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libtag_c0-32bit-1.9.1-3.4.18 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file. CVE-2018-11439 SUSE Linux Enterprise Server 12 SP5:libtag1-1.9.1-3.4.18 SUSE Linux Enterprise Server 12 SP5:libtag_c0-1.9.1-3.4.18 SUSE Linux Enterprise Server 12 SP5:taglib-1.9.1-3.4.18 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtag1-1.9.1-3.4.18 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtag_c0-1.9.1-3.4.18 SUSE Linux Enterprise Server for SAP Applications 12 SP5:taglib-1.9.1-3.4.18 SUSE Linux Enterprise Software Development Kit 12 SP5:libtag-devel-1.9.1-3.4.18 SUSE Linux Enterprise Workstation Extension 12 SP5:libtag1-32bit-1.9.1-3.4.18 SUSE Linux Enterprise Workstation Extension 12 SP5:libtag_c0-32bit-1.9.1-3.4.18 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202968-1/ https://www.suse.com/security/cve/CVE-2018-11439.html CVE-2018-11439 https://bugzilla.suse.com/1096180 SUSE Bug 1096180