Security update for zziplib

Announcement ID:	SUSE-SU-2018:0548-1
Rating:	moderate
References:	bsc#1024532 bsc#1024536 bsc#1034539 bsc#1078497 bsc#1078701 bsc#1079096
Cross-References:	CVE-2018-6381 CVE-2018-6484 CVE-2018-6540
CVSS scores:	CVE-2018-6381 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-6381 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-6484 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-6484 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-6540 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-6540 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 12-SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Workstation Extension 12 12-SP3 SUSE Linux Enterprise Workstation Extension 12 SP2

An update that solves three vulnerabilities and has three security fixes can now be installed.

Description:

This update for zziplib fixes the following issues:

Version update to 0.13.67 contains lots of bug- and security fixes.

• If an extension block is too small to hold an extension, do not use the information therein.
• CVE-2018-6540: If the End of central directory record (EOCD) contains an Offset of start of central directory which is beyond the end of the file, reject the file. (bsc#1079096)
• CVE-2018-6484: Reject the ZIP file and report it as corrupt if the size of the central directory and/or the offset of start of central directory point beyond the end of the ZIP file. (bsc#1078701)
• CVE-2018-6381: If a file is uncompressed, compressed and uncompressed sizes should be identical. (bsc#1078497)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP2
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-357=1
• SUSE Linux Enterprise Desktop 12 SP3
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-357=1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2
  zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-357=1
• SUSE Linux Enterprise Software Development Kit 12 SP3
  zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-357=1
• SUSE Linux Enterprise Workstation Extension 12 SP2
  zypper in -t patch SUSE-SLE-WE-12-SP2-2018-357=1
• SUSE Linux Enterprise Workstation Extension 12 12-SP3
  zypper in -t patch SUSE-SLE-WE-12-SP3-2018-357=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
  • zziplib-debugsource-0.13.67-10.5.1
  • libzzip-0-13-0.13.67-10.5.1
  • libzzip-0-13-debuginfo-0.13.67-10.5.1
• SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
  • zziplib-debugsource-0.13.67-10.5.1
  • libzzip-0-13-0.13.67-10.5.1
  • libzzip-0-13-debuginfo-0.13.67-10.5.1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2 (aarch64 ppc64le s390x x86_64)
  • zziplib-devel-0.13.67-10.5.1
  • zziplib-devel-debuginfo-0.13.67-10.5.1
  • libzzip-0-13-debuginfo-0.13.67-10.5.1
  • zziplib-debugsource-0.13.67-10.5.1
  • libzzip-0-13-0.13.67-10.5.1
• SUSE Linux Enterprise Software Development Kit 12 SP3 (aarch64 ppc64le s390x x86_64)
  • zziplib-devel-0.13.67-10.5.1
  • zziplib-devel-debuginfo-0.13.67-10.5.1
  • libzzip-0-13-debuginfo-0.13.67-10.5.1
  • zziplib-debugsource-0.13.67-10.5.1
  • libzzip-0-13-0.13.67-10.5.1
• SUSE Linux Enterprise Workstation Extension 12 SP2 (x86_64)
  • zziplib-debugsource-0.13.67-10.5.1
  • libzzip-0-13-0.13.67-10.5.1
  • libzzip-0-13-debuginfo-0.13.67-10.5.1
• SUSE Linux Enterprise Workstation Extension 12 12-SP3 (x86_64)
  • zziplib-debugsource-0.13.67-10.5.1
  • libzzip-0-13-0.13.67-10.5.1
  • libzzip-0-13-debuginfo-0.13.67-10.5.1

References:

• https://www.suse.com/security/cve/CVE-2018-6381.html
• https://www.suse.com/security/cve/CVE-2018-6484.html
• https://www.suse.com/security/cve/CVE-2018-6540.html
• https://bugzilla.suse.com/show_bug.cgi?id=1024532
• https://bugzilla.suse.com/show_bug.cgi?id=1024536
• https://bugzilla.suse.com/show_bug.cgi?id=1034539
• https://bugzilla.suse.com/show_bug.cgi?id=1078497
• https://bugzilla.suse.com/show_bug.cgi?id=1078701
• https://bugzilla.suse.com/show_bug.cgi?id=1079096