SUSE-SU-2015:2215-1: moderate: Security update for libmspack

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for libmspack
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:2215-1
Rating:             moderate
References:         #934524 #934525 #934526 #934527 #934528 #934529 
                    
Cross-References:   CVE-2014-9732 CVE-2015-4467 CVE-2015-4469
                    CVE-2015-4470 CVE-2015-4471 CVE-2015-4472
                   
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Software Development Kit 11-SP3
                    SUSE Linux Enterprise Server for VMWare 11-SP3
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Server 11-SP3
                    SUSE Linux Enterprise Desktop 11-SP4
                    SUSE Linux Enterprise Desktop 11-SP3
                    SUSE Linux Enterprise Debuginfo 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________

   An update that fixes 6 vulnerabilities is now available.

Description:

   libmspack was updated to fix several security vulnerabilities.

   - Fix null pointer dereference on a crafted CAB. (bsc#934524,
     CVE-2014-9732)
   - Fix denial of service while processing crafted CHM file. (bsc#934525,
     CVE-2015-4467)
   - Fix denial of service while processing crafted CHM file. (bsc#934529,
     CVE-2015-4472)
   - Fix pointer arithmetic overflow during CHM decompression. (bsc#934526,
     CVE-2015-4469)
   - Fix off-by-one buffer over-read in mspack/mszipd.c. (bsc#934527,
     CVE-2015-4470)
   - Fix off-by-one buffer under-read in mspack/lzxd.c. (bsc#934528,
     CVE-2015-4471)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-libmspack-12249=1

   - SUSE Linux Enterprise Software Development Kit 11-SP3:

      zypper in -t patch sdksp3-libmspack-12249=1

   - SUSE Linux Enterprise Server for VMWare 11-SP3:

      zypper in -t patch slessp3-libmspack-12249=1

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-libmspack-12249=1

   - SUSE Linux Enterprise Server 11-SP3:

      zypper in -t patch slessp3-libmspack-12249=1

   - SUSE Linux Enterprise Desktop 11-SP4:

      zypper in -t patch sledsp4-libmspack-12249=1

   - SUSE Linux Enterprise Desktop 11-SP3:

      zypper in -t patch sledsp3-libmspack-12249=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-libmspack-12249=1

   - SUSE Linux Enterprise Debuginfo 11-SP3:

      zypper in -t patch dbgsp3-libmspack-12249=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      libmspack-devel-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64):

      libmspack-devel-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64):

      libmspack0-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      libmspack0-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64):

      libmspack0-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64):

      libmspack0-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64):

      libmspack0-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      libmspack-debuginfo-0.0.20060920alpha-74.10.1
      libmspack-debugsource-0.0.20060920alpha-74.10.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64):

      libmspack-debuginfo-0.0.20060920alpha-74.10.1
      libmspack-debugsource-0.0.20060920alpha-74.10.1


References:

   https://www.suse.com/security/cve/CVE-2014-9732.html
   https://www.suse.com/security/cve/CVE-2015-4467.html
   https://www.suse.com/security/cve/CVE-2015-4469.html
   https://www.suse.com/security/cve/CVE-2015-4470.html
   https://www.suse.com/security/cve/CVE-2015-4471.html
   https://www.suse.com/security/cve/CVE-2015-4472.html
   https://bugzilla.suse.com/934524
   https://bugzilla.suse.com/934525
   https://bugzilla.suse.com/934526
   https://bugzilla.suse.com/934527
   https://bugzilla.suse.com/934528
   https://bugzilla.suse.com/934529