Security update for libsolv SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2145-1 Final 1 1 2021-06-23T14:51:08Z current 2021-06-23T14:51:08Z 2021-06-23T14:51:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsolv This update for libsolv fixes the following issues: Security issues fixed: - CVE-2019-20387: Fixed heap-buffer-overflow in repodata_schema2id (bsc#1161510) - CVE-2021-3200: testcase_read: error out if repos are added or the system is changed too late (bsc#1186229) Other issues fixed: - backport support for blacklisted packages to support ptf packages and retracted patches - fix ruleinfo of complex dependencies returning the wrong origin - fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason - fix add_complex_recommends() selecting conflicted packages in rare cases - fix potential segfault in resolve_jobrules - fix solv_zchunk decoding error if large chunks are used The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-2145,SUSE-SLE-SERVER-12-SP2-BCL-2021-2145 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212145-1/ Link for SUSE-SU-2021:2145-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009080.html E-Mail link for SUSE-SU-2021:2145-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1161510 SUSE Bug 1161510 https://bugzilla.suse.com/1186229 SUSE Bug 1186229 https://www.suse.com/security/cve/CVE-2019-20387/ SUSE CVE CVE-2019-20387 page https://www.suse.com/security/cve/CVE-2021-3200/ SUSE CVE CVE-2021-3200 page SUSE Linux Enterprise Server 12 SP2-BCL libsolv-demo-0.6.37-2.27.24.1 libsolv-devel-0.6.37-2.27.24.1 libsolv-tools-0.6.37-2.27.24.1 libzypp-16.21.4-27.75.1 libzypp-devel-16.21.4-27.75.1 libzypp-devel-doc-16.21.4-27.75.1 perl-solv-0.6.37-2.27.24.1 python-solv-0.6.37-2.27.24.1 python3-solv-0.6.37-2.27.24.1 ruby-solv-0.6.37-2.27.24.1 libsolv-devel-0.6.37-2.27.24.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libsolv-tools-0.6.37-2.27.24.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libzypp-16.21.4-27.75.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libzypp-devel-16.21.4-27.75.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL perl-solv-0.6.37-2.27.24.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL python-solv-0.6.37-2.27.24.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema. CVE-2019-20387 SUSE Linux Enterprise Server 12 SP2-BCL:libsolv-devel-0.6.37-2.27.24.1 SUSE Linux Enterprise Server 12 SP2-BCL:libsolv-tools-0.6.37-2.27.24.1 SUSE Linux Enterprise Server 12 SP2-BCL:libzypp-16.21.4-27.75.1 SUSE Linux Enterprise Server 12 SP2-BCL:libzypp-devel-16.21.4-27.75.1 SUSE Linux Enterprise Server 12 SP2-BCL:perl-solv-0.6.37-2.27.24.1 SUSE Linux Enterprise Server 12 SP2-BCL:python-solv-0.6.37-2.27.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212145-1/ https://www.suse.com/security/cve/CVE-2019-20387.html CVE-2019-20387 https://bugzilla.suse.com/1161510 SUSE Bug 1161510 Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service CVE-2021-3200 SUSE Linux Enterprise Server 12 SP2-BCL:libsolv-devel-0.6.37-2.27.24.1 SUSE Linux Enterprise Server 12 SP2-BCL:libsolv-tools-0.6.37-2.27.24.1 SUSE Linux Enterprise Server 12 SP2-BCL:libzypp-16.21.4-27.75.1 SUSE Linux Enterprise Server 12 SP2-BCL:libzypp-devel-16.21.4-27.75.1 SUSE Linux Enterprise Server 12 SP2-BCL:perl-solv-0.6.37-2.27.24.1 SUSE Linux Enterprise Server 12 SP2-BCL:python-solv-0.6.37-2.27.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212145-1/ https://www.suse.com/security/cve/CVE-2021-3200.html CVE-2021-3200 https://bugzilla.suse.com/1186229 SUSE Bug 1186229