Security update for patch SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1932-1 Final 1 1 2022-06-03T08:26:34Z current 2022-06-03T08:26:34Z 2022-06-03T08:26:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for patch This update for patch fixes the following issues: Security fixes: - CVE-2019-13636: Fixed mishandled following of symlinks in certain cases other than input files (bsc#1142041). - CVE-2018-6952: Fixed double free of memory in pch.c:another_hunk() (bsc#1080985). Bugfixes: - Pass the correct stat to backup files (bsc#1198106). - Fix temporary file leak when applying ed-style patches (bsc#1092500). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2022-1932,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2022-1932,SUSE-2022-1932,SUSE-SLE-SERVER-12-SP5-2022-1932 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221932-1/ Link for SUSE-SU-2022:1932-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011232.html E-Mail link for SUSE-SU-2022:1932-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1080985 SUSE Bug 1080985 https://bugzilla.suse.com/1092500 SUSE Bug 1092500 https://bugzilla.suse.com/1142041 SUSE Bug 1142041 https://bugzilla.suse.com/1198106 SUSE Bug 1198106 https://www.suse.com/security/cve/CVE-2018-6952/ SUSE CVE CVE-2018-6952 page https://www.suse.com/security/cve/CVE-2019-13636/ SUSE CVE CVE-2019-13636 page Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 patch-2.7.5-8.8.1 patch-2.7.5-8.8.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production patch-2.7.5-8.8.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production patch-2.7.5-8.8.1 as a component of SUSE Linux Enterprise Server 12 SP5 patch-2.7.5-8.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. CVE-2018-6952 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:patch-2.7.5-8.8.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:patch-2.7.5-8.8.1 SUSE Linux Enterprise Server 12 SP5:patch-2.7.5-8.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:patch-2.7.5-8.8.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221932-1/ https://www.suse.com/security/cve/CVE-2018-6952.html CVE-2018-6952 https://bugzilla.suse.com/1080985 SUSE Bug 1080985 https://bugzilla.suse.com/1167721 SUSE Bug 1167721 In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. CVE-2019-13636 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:patch-2.7.5-8.8.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:patch-2.7.5-8.8.1 SUSE Linux Enterprise Server 12 SP5:patch-2.7.5-8.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:patch-2.7.5-8.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221932-1/ https://www.suse.com/security/cve/CVE-2019-13636.html CVE-2019-13636 https://bugzilla.suse.com/1142041 SUSE Bug 1142041