Security update for spamassassin
Announcement ID: | SUSE-SU-2019:1961-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves four vulnerabilities can now be installed.
Description:
This update for spamassassin to version 3.4.2 fixes the following issues:
Security issues fixed:
- CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745).
- CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748).
- CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750).
Non-security issues fixed:
- Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing
- sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules
- GeoIP2 support has been added to RelayCountry and URILocalBL plugins
- Several new or enhanced configuration options
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Desktop 12 SP4
zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-1961=1
-
SUSE Linux Enterprise High Performance Computing 12 SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-1961=1
-
SUSE Linux Enterprise Server 12 SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-1961=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-1961=1
Package List:
-
SUSE Linux Enterprise Desktop 12 SP4 (x86_64)
- spamassassin-debugsource-3.4.2-44.3.1
- perl-Mail-SpamAssassin-3.4.2-44.3.1
- spamassassin-debuginfo-3.4.2-44.3.1
- spamassassin-3.4.2-44.3.1
-
SUSE Linux Enterprise High Performance Computing 12 SP4 (aarch64 x86_64)
- spamassassin-debugsource-3.4.2-44.3.1
- perl-Mail-SpamAssassin-3.4.2-44.3.1
- spamassassin-debuginfo-3.4.2-44.3.1
- spamassassin-3.4.2-44.3.1
-
SUSE Linux Enterprise Server 12 SP4 (aarch64 ppc64le s390x x86_64)
- spamassassin-debugsource-3.4.2-44.3.1
- perl-Mail-SpamAssassin-3.4.2-44.3.1
- spamassassin-debuginfo-3.4.2-44.3.1
- spamassassin-3.4.2-44.3.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
- spamassassin-debugsource-3.4.2-44.3.1
- perl-Mail-SpamAssassin-3.4.2-44.3.1
- spamassassin-debuginfo-3.4.2-44.3.1
- spamassassin-3.4.2-44.3.1
References:
- https://www.suse.com/security/cve/CVE-2016-1238.html
- https://www.suse.com/security/cve/CVE-2017-15705.html
- https://www.suse.com/security/cve/CVE-2018-11780.html
- https://www.suse.com/security/cve/CVE-2018-11781.html
- https://bugzilla.suse.com/show_bug.cgi?id=1108745
- https://bugzilla.suse.com/show_bug.cgi?id=1108748
- https://bugzilla.suse.com/show_bug.cgi?id=1108750