Security update for elfutils

Announcement ID:	SUSE-SU-2019:1486-1
Rating:	moderate
References:	bsc#1033084 bsc#1033085 bsc#1033086 bsc#1033087 bsc#1033088 bsc#1033089 bsc#1033090 bsc#1106390 bsc#1107066 bsc#1107067 bsc#1111973 bsc#1112723 bsc#1112726 bsc#1123685 bsc#1125007
Cross-References:	CVE-2017-7607 CVE-2017-7608 CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2018-16062 CVE-2018-16402 CVE-2018-16403 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 CVE-2019-7150 CVE-2019-7665
CVSS scores:	CVE-2017-7607 ( SUSE ): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7607 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7608 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7608 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7609 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7609 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7610 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7610 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7611 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7611 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7612 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7612 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7613 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7613 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-16062 ( SUSE ): 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2018-16062 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-16402 ( SUSE ): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-16402 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-16402 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-16403 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-16403 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18310 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18310 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18520 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18520 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18521 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18521 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7150 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7150 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7665 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7665 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	Basesystem Module 15-SP1 Basesystem Module 15 SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Real Time 15 SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0

An update that solves 15 vulnerabilities can now be installed.

Description:

This update for elfutils fixes the following issues:

Security issues fixed:

• CVE-2017-7607: Fixed a heap-based buffer overflow in handle_gnu_hash (bsc#1033084)
• CVE-2017-7608: Fixed a heap-based buffer overflow in ebl_object_note_type_name() (bsc#1033085)
• CVE-2017-7609: Fixed a memory allocation failure in __libelf_decompress (bsc#1033086)
• CVE-2017-7610: Fixed a heap-based buffer overflow in check_group (bsc#1033087)
• CVE-2017-7611: Fixed a denial of service via a crafted ELF file (bsc#1033088)
• CVE-2017-7612: Fixed a denial of service in check_sysv_hash() via a crafted ELF file (bsc#1033089)
• CVE-2017-7613: Fixed denial of service caused by the missing validation of the number of sections and the number of segments in a crafted ELF file (bsc#1033090)
• CVE-2018-16062: Fixed a heap-buffer overflow in /elfutils/libdw/dwarf_getaranges.c:156 (bsc#1106390)
• CVE-2018-16402: Fixed a denial of service/double free on an attempt to decompress the same section twice (bsc#1107066)
• CVE-2018-16403: Fixed a heap buffer overflow in readelf (bsc#1107067)
• CVE-2018-18310: Fixed an invalid address read problem in dwfl_segment_report_module.c (bsc#1111973)
• CVE-2018-18520: Fixed bad handling of ar files inside are files (bsc#1112726)
• CVE-2018-18521: Fixed a denial of service vulnerabilities in the function arlib_add_symbols() used by eu-ranlib (bsc#1112723)
• CVE-2019-7150: dwfl_segment_report_module doesn't check whether the dyn data read from core file is truncated (bsc#1123685)
• CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (bsc#1125007)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Basesystem Module 15
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-1486=1
• Basesystem Module 15-SP1
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-1486=1

Package List:

• Basesystem Module 15 (aarch64 ppc64le s390x x86_64)
  • libasm1-debuginfo-0.168-4.5.3
  • libebl-plugins-0.168-4.5.3
  • libdw1-debuginfo-0.168-4.5.3
  • libelf1-debuginfo-0.168-4.5.3
  • libebl-plugins-debuginfo-0.168-4.5.3
  • elfutils-0.168-4.5.3
  • libasm-devel-0.168-4.5.3
  • libebl-devel-0.168-4.5.3
  • libdw-devel-0.168-4.5.3
  • libelf-devel-0.168-4.5.3
  • libasm1-0.168-4.5.3
  • elfutils-debugsource-0.168-4.5.3
  • libdw1-0.168-4.5.3
  • libelf1-0.168-4.5.3
  • elfutils-debuginfo-0.168-4.5.3
• Basesystem Module 15 (noarch)
  • elfutils-lang-0.168-4.5.3
• Basesystem Module 15 (x86_64)
  • libelf1-32bit-0.168-4.5.3
  • libebl-plugins-32bit-0.168-4.5.3
  • libdw1-32bit-debuginfo-0.168-4.5.3
  • libelf1-32bit-debuginfo-0.168-4.5.3
  • libebl-plugins-32bit-debuginfo-0.168-4.5.3
  • libdw1-32bit-0.168-4.5.3
• Basesystem Module 15-SP1 (aarch64 ppc64le s390x x86_64)
  • libasm1-debuginfo-0.168-4.5.3
  • libebl-plugins-0.168-4.5.3
  • libdw1-debuginfo-0.168-4.5.3
  • libelf1-debuginfo-0.168-4.5.3
  • libebl-plugins-debuginfo-0.168-4.5.3
  • elfutils-0.168-4.5.3
  • libasm-devel-0.168-4.5.3
  • libebl-devel-0.168-4.5.3
  • libdw-devel-0.168-4.5.3
  • libelf-devel-0.168-4.5.3
  • libasm1-0.168-4.5.3
  • elfutils-debugsource-0.168-4.5.3
  • libdw1-0.168-4.5.3
  • libelf1-0.168-4.5.3
  • elfutils-debuginfo-0.168-4.5.3
• Basesystem Module 15-SP1 (noarch)
  • elfutils-lang-0.168-4.5.3
• Basesystem Module 15-SP1 (x86_64)
  • libelf1-32bit-0.168-4.5.3
  • libebl-plugins-32bit-0.168-4.5.3
  • libdw1-32bit-debuginfo-0.168-4.5.3
  • libelf1-32bit-debuginfo-0.168-4.5.3
  • libebl-plugins-32bit-debuginfo-0.168-4.5.3
  • libdw1-32bit-0.168-4.5.3

References:

• https://www.suse.com/security/cve/CVE-2017-7607.html
• https://www.suse.com/security/cve/CVE-2017-7608.html
• https://www.suse.com/security/cve/CVE-2017-7609.html
• https://www.suse.com/security/cve/CVE-2017-7610.html
• https://www.suse.com/security/cve/CVE-2017-7611.html
• https://www.suse.com/security/cve/CVE-2017-7612.html
• https://www.suse.com/security/cve/CVE-2017-7613.html
• https://www.suse.com/security/cve/CVE-2018-16062.html
• https://www.suse.com/security/cve/CVE-2018-16402.html
• https://www.suse.com/security/cve/CVE-2018-16403.html
• https://www.suse.com/security/cve/CVE-2018-18310.html
• https://www.suse.com/security/cve/CVE-2018-18520.html
• https://www.suse.com/security/cve/CVE-2018-18521.html
• https://www.suse.com/security/cve/CVE-2019-7150.html
• https://www.suse.com/security/cve/CVE-2019-7665.html
• https://bugzilla.suse.com/show_bug.cgi?id=1033084
• https://bugzilla.suse.com/show_bug.cgi?id=1033085
• https://bugzilla.suse.com/show_bug.cgi?id=1033086
• https://bugzilla.suse.com/show_bug.cgi?id=1033087
• https://bugzilla.suse.com/show_bug.cgi?id=1033088
• https://bugzilla.suse.com/show_bug.cgi?id=1033089
• https://bugzilla.suse.com/show_bug.cgi?id=1033090
• https://bugzilla.suse.com/show_bug.cgi?id=1106390
• https://bugzilla.suse.com/show_bug.cgi?id=1107066
• https://bugzilla.suse.com/show_bug.cgi?id=1107067
• https://bugzilla.suse.com/show_bug.cgi?id=1111973
• https://bugzilla.suse.com/show_bug.cgi?id=1112723
• https://bugzilla.suse.com/show_bug.cgi?id=1112726
• https://bugzilla.suse.com/show_bug.cgi?id=1123685
• https://bugzilla.suse.com/show_bug.cgi?id=1125007