Security update for python3
Announcement ID: | SUSE-SU-2016:2859-1 |
---|---|
Rating: | moderate |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves four vulnerabilities and has three security fixes can now be installed.
Description:
This update provides Python 3.4.5, which brings many fixes and enhancements.
The following security issues have been fixed:
- CVE-2016-1000110: CGIHandler could have allowed setting of HTTP_PROXY environment variable based on user supplied Proxy request header. (bsc#989523)
- CVE-2016-0772: A vulnerability in smtplib could have allowed a MITM attacker to perform a startTLS stripping attack. (bsc#984751)
- CVE-2016-5636: A heap overflow in Python's zipimport module. (bsc#985177)
- CVE-2016-5699: A header injection flaw in urrlib2/urllib/httplib/http.client. (bsc#985348)
The update also includes the following non-security fixes:
- Don't force 3rd party C extensions to be built with -Werror=declaration-after-statement. (bsc#951166)
- Make urllib proxy var handling behave as usual on POSIX. (bsc#983582)
For a comprehensive list of changes please refer to the upstream change log: https://docs.python.org/3.4/whatsnew/changelog.html
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Desktop 12 SP2
zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2016-1676=1
-
SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
zypper in -t patch SUSE-SLE-RPI-12-SP2-2016-1676=1
-
SUSE Linux Enterprise Software Development Kit 12 12-SP2
zypper in -t patch SUSE-SLE-SDK-12-SP2-2016-1676=1
-
SUSE Linux Enterprise High Performance Computing 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1676=1
-
SUSE Linux Enterprise Server 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1676=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1676=1
Package List:
-
SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
- libpython3_4m1_0-3.4.5-19.1
- python3-debuginfo-3.4.5-19.1
- python3-base-debuginfo-3.4.5-19.1
- python3-curses-3.4.5-19.1
- python3-debugsource-3.4.5-19.1
- python3-curses-debuginfo-3.4.5-19.1
- python3-base-3.4.5-19.1
- libpython3_4m1_0-debuginfo-3.4.5-19.1
- python3-3.4.5-19.1
- python3-base-debugsource-3.4.5-19.1
-
SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (aarch64)
- libpython3_4m1_0-3.4.5-19.1
- python3-debuginfo-3.4.5-19.1
- python3-base-debuginfo-3.4.5-19.1
- python3-curses-3.4.5-19.1
- python3-debugsource-3.4.5-19.1
- python3-curses-debuginfo-3.4.5-19.1
- python3-base-3.4.5-19.1
- libpython3_4m1_0-debuginfo-3.4.5-19.1
- python3-3.4.5-19.1
- python3-base-debugsource-3.4.5-19.1
-
SUSE Linux Enterprise Software Development Kit 12 12-SP2 (aarch64 ppc64le s390x x86_64)
- python3-base-debugsource-3.4.5-19.1
- python3-devel-3.4.5-19.1
- python3-base-debuginfo-3.4.5-19.1
-
SUSE Linux Enterprise Software Development Kit 12 12-SP2 (ppc64le s390x x86_64)
- python3-devel-debuginfo-3.4.5-19.1
-
SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64 x86_64)
- libpython3_4m1_0-3.4.5-19.1
- python3-debuginfo-3.4.5-19.1
- python3-base-debuginfo-3.4.5-19.1
- python3-curses-3.4.5-19.1
- python3-debugsource-3.4.5-19.1
- python3-curses-debuginfo-3.4.5-19.1
- python3-base-3.4.5-19.1
- libpython3_4m1_0-debuginfo-3.4.5-19.1
- python3-3.4.5-19.1
- python3-base-debugsource-3.4.5-19.1
-
SUSE Linux Enterprise Server 12 SP2 (aarch64 ppc64le s390x x86_64)
- libpython3_4m1_0-3.4.5-19.1
- python3-debuginfo-3.4.5-19.1
- python3-base-debuginfo-3.4.5-19.1
- python3-curses-3.4.5-19.1
- python3-debugsource-3.4.5-19.1
- python3-curses-debuginfo-3.4.5-19.1
- python3-base-3.4.5-19.1
- libpython3_4m1_0-debuginfo-3.4.5-19.1
- python3-3.4.5-19.1
- python3-base-debugsource-3.4.5-19.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
- libpython3_4m1_0-3.4.5-19.1
- python3-debuginfo-3.4.5-19.1
- python3-base-debuginfo-3.4.5-19.1
- python3-curses-3.4.5-19.1
- python3-debugsource-3.4.5-19.1
- python3-curses-debuginfo-3.4.5-19.1
- python3-base-3.4.5-19.1
- libpython3_4m1_0-debuginfo-3.4.5-19.1
- python3-3.4.5-19.1
- python3-base-debugsource-3.4.5-19.1
References:
- https://www.suse.com/security/cve/CVE-2016-0772.html
- https://www.suse.com/security/cve/CVE-2016-1000110.html
- https://www.suse.com/security/cve/CVE-2016-5636.html
- https://www.suse.com/security/cve/CVE-2016-5699.html
- https://bugzilla.suse.com/show_bug.cgi?id=951166
- https://bugzilla.suse.com/show_bug.cgi?id=983582
- https://bugzilla.suse.com/show_bug.cgi?id=984751
- https://bugzilla.suse.com/show_bug.cgi?id=985177
- https://bugzilla.suse.com/show_bug.cgi?id=985348
- https://bugzilla.suse.com/show_bug.cgi?id=989523
- https://bugzilla.suse.com/show_bug.cgi?id=991069