SUSE-SU-2020:2872-1: moderate: Security update for hexchat

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for hexchat
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:2872-1
Rating:             moderate
References:         #1020739 #1034310 
Cross-References:   CVE-2016-2087
Affected Products:
                    SUSE Linux Enterprise Workstation Extension 12-SP5
______________________________________________________________________________

   An update that solves one vulnerability and has one errata
   is now available.

Description:


   This update for hexchat fixes the following issues:

   - CVE-2016-2087: A directory traversal was possible if a user could be
     convinced to connect to a server with a hostname with ".." in its name.
     (bsc#1020739).

   This non-security issue was fixed:

   - Add dependency on iso-codes and hwdata as hexchat tries to use them
     (bsc#1034310)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Workstation Extension 12-SP5:

      zypper in -t patch SUSE-SLE-WE-12-SP5-2020-2872=1



Package List:

   - SUSE Linux Enterprise Workstation Extension 12-SP5 (x86_64):

      hexchat-2.12.0-6.5.146
      hexchat-debuginfo-2.12.0-6.5.146
      hexchat-debugsource-2.12.0-6.5.146

   - SUSE Linux Enterprise Workstation Extension 12-SP5 (noarch):

      hexchat-lang-2.12.0-6.5.146


References:

   https://www.suse.com/security/cve/CVE-2016-2087.html
   https://bugzilla.suse.com/1020739
   https://bugzilla.suse.com/1034310