SUSE-SU-2018:0295-1: moderate: Security update for libtasn1

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for libtasn1
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:0295-1
Rating:             moderate
References:         #1076832 
Cross-References:   CVE-2018-6003
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP3
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP3
                    SUSE CaaS Platform ALL
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for libtasn1 fixes one issue.

   This security issue was fixed:

   - CVE-2018-6003: Prevent a stack exhaustion in  _asn1_decode_simple_ber
     (lib/decoding.c) when decoding BER encoded structure allowed for DoS
     (bsc#1076832).


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-214=1

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-214=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-214=1

   - SUSE CaaS Platform ALL:

      zypper in -t patch SUSE-CAASP-ALL-2018-214=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):

      libtasn1-debuginfo-4.9-3.5.1
      libtasn1-debugsource-4.9-3.5.1
      libtasn1-devel-4.9-3.5.1

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

      libtasn1-4.9-3.5.1
      libtasn1-6-4.9-3.5.1
      libtasn1-6-debuginfo-4.9-3.5.1
      libtasn1-debuginfo-4.9-3.5.1
      libtasn1-debugsource-4.9-3.5.1

   - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64):

      libtasn1-6-32bit-4.9-3.5.1
      libtasn1-6-debuginfo-32bit-4.9-3.5.1

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      libtasn1-4.9-3.5.1
      libtasn1-6-32bit-4.9-3.5.1
      libtasn1-6-4.9-3.5.1
      libtasn1-6-debuginfo-32bit-4.9-3.5.1
      libtasn1-6-debuginfo-4.9-3.5.1
      libtasn1-debuginfo-4.9-3.5.1
      libtasn1-debugsource-4.9-3.5.1

   - SUSE CaaS Platform ALL (x86_64):

      libtasn1-4.9-3.5.1
      libtasn1-6-4.9-3.5.1
      libtasn1-6-debuginfo-4.9-3.5.1
      libtasn1-debuginfo-4.9-3.5.1
      libtasn1-debugsource-4.9-3.5.1


References:

   https://www.suse.com/security/cve/CVE-2018-6003.html
   https://bugzilla.suse.com/1076832