SUSE-CU-2021:499-1: Security update of suse/sles12sp5

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sles12sp5
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2021:499-1
Container Tags        : suse/sles12sp5:6.5.257 , suse/sles12sp5:latest
Container Release     : 6.5.257
Severity              : moderate
Type                  : security
References            : 1025709 1030066 1030803 1030805 1030807 1172973 1172974 CVE-2017-6004
                        CVE-2017-7186 CVE-2017-7244 CVE-2017-7245 CVE-2017-7246 CVE-2019-20838
                        CVE-2020-14155 
-----------------------------------------------------------------

The container suse/sles12sp5 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3652-1
Released:    Wed Nov 10 17:41:22 2021
Summary:     Security update for pcre
Type:        security
Severity:    moderate
References:  1025709,1030066,1030803,1030805,1030807,1172973,1172974,CVE-2017-6004,CVE-2017-7186,CVE-2017-7244,CVE-2017-7245,CVE-2017-7246,CVE-2019-20838,CVE-2020-14155
This update for pcre fixes the following issues:

Update pcre to version 8.45:

- CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
- CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973).
- CVE-2017-7244: Fixed invalid read in _pcre32_xclass() (bsc#1030807).
- CVE-2017-7245: Fixed buffer overflow in the pcre32_copy_substring (bsc#1030805).
- CVE-2017-7246: Fixed another buffer overflow in the pcre32_copy_substring (bsc#1030803).
- CVE-2017-7186: Fixed denial of service caused by an invalid Unicode property lookup (bsc#1030066).
- CVE-2017-6004: Fixed denial of service via crafted regular expression (bsc#1025709).


The following package changes have been done:

- libpcre1-8.45-8.7.1 updated