Security update for libslirp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2941-1 Final 1 1 2022-08-30T08:51:32Z current 2022-08-30T08:51:32Z 2022-08-30T08:51:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libslirp This update for libslirp fixes the following issues: - CVE-2021-3593: Fixed invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365). Non-security fixes: - Fix the version header (bsc#1201551) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container rancher/elemental-teal-iso/5.4:latest-2022-2941,Container rancher/elemental-teal-rt/5.4:latest-2022-2941,Container rancher/elemental-teal/5.4:latest-2022-2941,SUSE-2022-2941,SUSE-SLE-Module-Server-Applications-15-SP3-2022-2941,SUSE-SLE-Module-Server-Applications-15-SP4-2022-2941,SUSE-SUSE-MicroOS-5.1-2022-2941,SUSE-SUSE-MicroOS-5.2-2022-2941,openSUSE-SLE-15.3-2022-2941,openSUSE-SLE-15.4-2022-2941 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222941-1/ Link for SUSE-SU-2022:2941-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/012010.html E-Mail link for SUSE-SU-2022:2941-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1187365 SUSE Bug 1187365 https://bugzilla.suse.com/1201551 SUSE Bug 1201551 https://www.suse.com/security/cve/CVE-2021-3593/ SUSE CVE CVE-2021-3593 page Container rancher/elemental-teal-iso/5.4:latest Container rancher/elemental-teal-rt/5.4:latest Container rancher/elemental-teal/5.4:latest SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 libslirp0-4.3.1-150300.11.1 libslirp-devel-4.3.1-150300.11.1 libslirp0-4.3.1-150300.11.1 as a component of Container rancher/elemental-teal-iso/5.4:latest libslirp0-4.3.1-150300.11.1 as a component of Container rancher/elemental-teal-rt/5.4:latest libslirp0-4.3.1-150300.11.1 as a component of Container rancher/elemental-teal/5.4:latest libslirp0-4.3.1-150300.11.1 as a component of SUSE Linux Enterprise Micro 5.1 libslirp0-4.3.1-150300.11.1 as a component of SUSE Linux Enterprise Micro 5.2 libslirp-devel-4.3.1-150300.11.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libslirp0-4.3.1-150300.11.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libslirp-devel-4.3.1-150300.11.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 libslirp0-4.3.1-150300.11.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 libslirp-devel-4.3.1-150300.11.1 as a component of openSUSE Leap 15.3 libslirp0-4.3.1-150300.11.1 as a component of openSUSE Leap 15.3 libslirp-devel-4.3.1-150300.11.1 as a component of openSUSE Leap 15.4 libslirp0-4.3.1-150300.11.1 as a component of openSUSE Leap 15.4 An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. CVE-2021-3593 Container rancher/elemental-teal-iso/5.4:latest:libslirp0-4.3.1-150300.11.1 Container rancher/elemental-teal-rt/5.4:latest:libslirp0-4.3.1-150300.11.1 Container rancher/elemental-teal/5.4:latest:libslirp0-4.3.1-150300.11.1 SUSE Linux Enterprise Micro 5.1:libslirp0-4.3.1-150300.11.1 SUSE Linux Enterprise Micro 5.2:libslirp0-4.3.1-150300.11.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp-devel-4.3.1-150300.11.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp0-4.3.1-150300.11.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp-devel-4.3.1-150300.11.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp0-4.3.1-150300.11.1 openSUSE Leap 15.3:libslirp-devel-4.3.1-150300.11.1 openSUSE Leap 15.3:libslirp0-4.3.1-150300.11.1 openSUSE Leap 15.4:libslirp-devel-4.3.1-150300.11.1 openSUSE Leap 15.4:libslirp0-4.3.1-150300.11.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222941-1/ https://www.suse.com/security/cve/CVE-2021-3593.html CVE-2021-3593 https://bugzilla.suse.com/1187365 SUSE Bug 1187365