SUSE-SU-2018:1441-1: moderate: Security update for libmodplug

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for libmodplug
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:1441-1
Rating:             moderate
References:         #1022032 
Cross-References:   CVE-2013-4233 CVE-2013-4234
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP3
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP3
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for libmodplug fixes the following issues:

   - Update to version 0.8.9.0+git20170610.f6dd59a bsc#1022032:
     * PSM: add missing line to commit
     * ABC: prevent possible increment of p past end
     * ABC: ensure read pointer is valid before incrementing
     * ABC: terminate early when things don't work in substitute
     * OKT: add one more bound check
     * FAR: out by one on check
     * ABC: 10 digit ints require null termination
     * PSM: make sure reads occur of only valid ins
     * ABC: cleanup tracks correctly.
     * WAV: check that there is space for both headers
     * OKT: ensure file size is enough to contain data
     * ABC: initialize earlier
     * ABC: ensure array access is bounded correctly.
     * ABC: clean up loop exiting code
     * ABC: avoid possibility of incrementing *p
     * ABC: abort early if macro would be blank
     * ABC: Use blankline more often
     * ABC: Ensure for loop does not increment past end of loop
     * Initialize nPatterns to 0 earlier
     * Check memory position isn't over the memory length
     * ABC: transpose only needs to look at notes (<26)

   - Update to version 0.8.9.0+git20171024.e9fc46e:
     * Spelling fixes
     * Bump version number to 0.8.9.0
     * MMCMP: Check that end pointer is within the file size
     * WAV: ensure integer doesn't overflow
     * XM: additional mempos check
     * sndmix: Don't process row if its empty.
     * snd_fx: dont include patterns of zero size in length calc
     * MT2,AMF: prevent OOB reads

   - Add patch for broken pc file where quite some upstream refer to modplug
     directly without specifying the subdir it is in.

   - Update to version 0.8.8.5
     * Some security issues: CVE-2013-4233, CVE-2013-4234, as well as many
       fixes suggested by static analyzers: clang build-scan, and coverity.
   - Stop using dos2unix
   - Run through spec-cleaner
   - Use full URL in Source tag


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-984=1

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-984=1



Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):

      libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
      libmodplug-devel-0.8.9.0+git20170610.f6dd59a-15.4.1

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

      libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
      libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
      libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
      libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
      libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1


References:

   https://www.suse.com/security/cve/CVE-2013-4233.html
   https://www.suse.com/security/cve/CVE-2013-4234.html
   https://bugzilla.suse.com/1022032