Security update for dbus-1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2211-1 Final 1 1 2021-06-30T13:58:18Z current 2021-06-30T13:58:18Z 2021-06-30T13:58:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dbus-1 This update for dbus-1 fixes the following issues: - CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-Azure-BYOS-2021-2211,Image SLES15-EC2-CHOST-HVM-BYOS-2021-2211,Image SLES15-EC2-HVM-BYOS-2021-2211,Image SLES15-GCE-BYOS-2021-2211,Image SLES15-SAP-Azure-2021-2211,Image SLES15-SAP-Azure-BYOS-2021-2211,Image SLES15-SAP-Azure-LI-BYOS-Production-2021-2211,Image SLES15-SAP-Azure-VLI-BYOS-Production-2021-2211,Image SLES15-SAP-EC2-HVM-2021-2211,Image SLES15-SAP-EC2-HVM-BYOS-2021-2211,Image SLES15-SAP-GCE-2021-2211,Image SLES15-SAP-GCE-BYOS-2021-2211,SUSE-2021-2211,SUSE-SLE-Product-HPC-15-2021-2211,SUSE-SLE-Product-SLES-15-2021-2211,SUSE-SLE-Product-SLES_SAP-15-2021-2211 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212211-1/ Link for SUSE-SU-2021:2211-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009108.html E-Mail link for SUSE-SU-2021:2211-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1187105 SUSE Bug 1187105 https://www.suse.com/security/cve/CVE-2020-35512/ SUSE CVE CVE-2020-35512 page Image SLES15-Azure-BYOS Image SLES15-EC2-CHOST-HVM-BYOS Image SLES15-EC2-HVM-BYOS Image SLES15-GCE-BYOS Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 dbus-1-1.12.2-3.11.1 libdbus-1-3-1.12.2-3.11.1 dbus-1-devel-1.12.2-3.11.1 dbus-1-devel-32bit-1.12.2-3.11.1 dbus-1-devel-64bit-1.12.2-3.11.1 dbus-1-devel-doc-1.12.2-3.11.1 dbus-1-x11-1.12.2-3.11.1 libdbus-1-3-32bit-1.12.2-3.11.1 libdbus-1-3-64bit-1.12.2-3.11.1 dbus-1-1.12.2-3.11.1 as a component of Image SLES15-Azure-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-Azure-BYOS dbus-1-1.12.2-3.11.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS dbus-1-1.12.2-3.11.1 as a component of Image SLES15-EC2-HVM-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-EC2-HVM-BYOS dbus-1-1.12.2-3.11.1 as a component of Image SLES15-GCE-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-GCE-BYOS dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure-BYOS dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-EC2-HVM libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-EC2-HVM dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-GCE libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-GCE dbus-1-1.12.2-3.11.1 as a component of Image SLES15-SAP-GCE-BYOS libdbus-1-3-1.12.2-3.11.1 as a component of Image SLES15-SAP-GCE-BYOS dbus-1-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS dbus-1-devel-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS dbus-1-x11-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libdbus-1-3-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libdbus-1-3-32bit-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS dbus-1-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS dbus-1-devel-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS dbus-1-x11-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libdbus-1-3-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libdbus-1-3-32bit-1.12.2-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS dbus-1-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS dbus-1-devel-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS dbus-1-x11-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS libdbus-1-3-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS libdbus-1-3-32bit-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS dbus-1-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 dbus-1-devel-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 dbus-1-x11-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libdbus-1-3-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libdbus-1-3-32bit-1.12.2-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors CVE-2020-35512 Image SLES15-Azure-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-Azure-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-EC2-CHOST-HVM-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-EC2-CHOST-HVM-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-EC2-HVM-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-EC2-HVM-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-GCE-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-GCE-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-Azure-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-Azure-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-Azure-LI-BYOS-Production:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-Azure-LI-BYOS-Production:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-Azure:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-Azure:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-EC2-HVM-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-EC2-HVM-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-EC2-HVM:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-EC2-HVM:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-GCE-BYOS:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-GCE-BYOS:libdbus-1-3-1.12.2-3.11.1 Image SLES15-SAP-GCE:dbus-1-1.12.2-3.11.1 Image SLES15-SAP-GCE:libdbus-1-3-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:dbus-1-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:dbus-1-devel-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:dbus-1-x11-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libdbus-1-3-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libdbus-1-3-32bit-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:dbus-1-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:dbus-1-devel-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:dbus-1-x11-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libdbus-1-3-1.12.2-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libdbus-1-3-32bit-1.12.2-3.11.1 SUSE Linux Enterprise Server 15-LTSS:dbus-1-1.12.2-3.11.1 SUSE Linux Enterprise Server 15-LTSS:dbus-1-devel-1.12.2-3.11.1 SUSE Linux Enterprise Server 15-LTSS:dbus-1-x11-1.12.2-3.11.1 SUSE Linux Enterprise Server 15-LTSS:libdbus-1-3-1.12.2-3.11.1 SUSE Linux Enterprise Server 15-LTSS:libdbus-1-3-32bit-1.12.2-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:dbus-1-1.12.2-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:dbus-1-devel-1.12.2-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:dbus-1-x11-1.12.2-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:libdbus-1-3-1.12.2-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:libdbus-1-3-32bit-1.12.2-3.11.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212211-1/ https://www.suse.com/security/cve/CVE-2020-35512.html CVE-2020-35512 https://bugzilla.suse.com/1187105 SUSE Bug 1187105 https://bugzilla.suse.com/1189662 SUSE Bug 1189662 https://bugzilla.suse.com/1205052 SUSE Bug 1205052