Security update for glib2

Announcement ID:	SUSE-SU-2019:1596-1
Rating:	important
References:	bsc#1107116 bsc#1107121 bsc#1111499 bsc#1137001
Cross-References:	CVE-2018-16428 CVE-2018-16429 CVE-2019-12450
CVSS scores:	CVE-2018-16428 ( SUSE ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-16428 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-16429 ( SUSE ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2018-16429 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-12450 ( SUSE ): 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2019-12450 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12450 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 LTSS 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1

An update that solves three vulnerabilities and has one security fix can now be installed.

Description:

This update for glib2 fixes the following issues:

Security issues fixed:

• CVE-2019-12450: Fixed an improper file permission when copy operation takes place (bsc#1137001).
• CVE-2018-16428: Avoid a NULL pointer dereference (bsc#1107121).
• CVE-2018-16429: Fixed out-of-bounds read vulnerability ing_markup_parse_context_parse() (bsc#1107116).
• Some exploitable parser bugs in GVariant and GDBus subsystems were fixed (bsc#1111499).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Server 12 LTSS 12
  zypper in -t patch SUSE-SLE-SERVER-12-2019-1596=1
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-1596=1

Package List:

• SUSE Linux Enterprise Server 12 LTSS 12 (ppc64le s390x x86_64)
  • libgthread-2_0-0-debuginfo-2.38.2-7.9.2
  • libgio-2_0-0-2.38.2-7.9.2
  • libgobject-2_0-0-2.38.2-7.9.2
  • glib2-tools-debuginfo-2.38.2-7.9.2
  • libglib-2_0-0-2.38.2-7.9.2
  • libgio-2_0-0-debuginfo-2.38.2-7.9.2
  • libglib-2_0-0-debuginfo-2.38.2-7.9.2
  • libgmodule-2_0-0-2.38.2-7.9.2
  • libgmodule-2_0-0-debuginfo-2.38.2-7.9.2
  • libgthread-2_0-0-2.38.2-7.9.2
  • glib2-tools-2.38.2-7.9.2
  • libgobject-2_0-0-debuginfo-2.38.2-7.9.2
  • glib2-debugsource-2.38.2-7.9.2
• SUSE Linux Enterprise Server 12 LTSS 12 (noarch)
  • glib2-lang-2.38.2-7.9.2
• SUSE Linux Enterprise Server 12 LTSS 12 (s390x x86_64)
  • libglib-2_0-0-32bit-2.38.2-7.9.2
  • libglib-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgio-2_0-0-32bit-2.38.2-7.9.2
  • libgobject-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgmodule-2_0-0-32bit-2.38.2-7.9.2
  • libgio-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgthread-2_0-0-32bit-2.38.2-7.9.2
  • libgmodule-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgthread-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgobject-2_0-0-32bit-2.38.2-7.9.2
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 (ppc64le s390x x86_64)
  • libgthread-2_0-0-debuginfo-2.38.2-7.9.2
  • libgio-2_0-0-2.38.2-7.9.2
  • libglib-2_0-0-2.38.2-7.9.2
  • glib2-tools-debuginfo-2.38.2-7.9.2
  • libgmodule-2_0-0-2.38.2-7.9.2
  • libgio-2_0-0-debuginfo-2.38.2-7.9.2
  • libglib-2_0-0-debuginfo-2.38.2-7.9.2
  • libgobject-2_0-0-2.38.2-7.9.2
  • libgmodule-2_0-0-debuginfo-2.38.2-7.9.2
  • libgthread-2_0-0-2.38.2-7.9.2
  • glib2-tools-2.38.2-7.9.2
  • libgobject-2_0-0-debuginfo-2.38.2-7.9.2
  • glib2-debugsource-2.38.2-7.9.2
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 (noarch)
  • glib2-lang-2.38.2-7.9.2
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 (s390x x86_64)
  • libglib-2_0-0-32bit-2.38.2-7.9.2
  • libglib-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgio-2_0-0-32bit-2.38.2-7.9.2
  • libgobject-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgmodule-2_0-0-32bit-2.38.2-7.9.2
  • libgio-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgthread-2_0-0-32bit-2.38.2-7.9.2
  • libgmodule-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgthread-2_0-0-debuginfo-32bit-2.38.2-7.9.2
  • libgobject-2_0-0-32bit-2.38.2-7.9.2

References:

• https://www.suse.com/security/cve/CVE-2018-16428.html
• https://www.suse.com/security/cve/CVE-2018-16429.html
• https://www.suse.com/security/cve/CVE-2019-12450.html
• https://bugzilla.suse.com/show_bug.cgi?id=1107116
• https://bugzilla.suse.com/show_bug.cgi?id=1107121
• https://bugzilla.suse.com/show_bug.cgi?id=1111499
• https://bugzilla.suse.com/show_bug.cgi?id=1137001