Security update for ovmf

Announcement ID:	SUSE-SU-2020:0699-1
Rating:	low
References:	bsc#1153072 bsc#1163927 bsc#1163959 bsc#1163969
Cross-References:	CVE-2019-14553 CVE-2019-14559 CVE-2019-14563 CVE-2019-14575
CVSS scores:	CVE-2019-14553 ( SUSE ): 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2019-14553 ( NVD ): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVE-2019-14559 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2019-14559 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-14563 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L CVE-2019-14563 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-14575 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-14575 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves four vulnerabilities can now be installed.

Description:

This update for ovmf fixes the following issues:

Security issues fixed:

• CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959).
• CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences (bsc#1153072).
• CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927).
• CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969).
• Enabled HTTPS-over-IPv6 (bsc#1153072).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise High Performance Computing 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-699=1
• SUSE Linux Enterprise Server 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-699=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-699=1
• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-699=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-699=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-699=1

Package List:

• SUSE Linux Enterprise High Performance Computing 12 SP4 (aarch64 x86_64)
  • ovmf-tools-2017+git1510945757.b2662641d5-3.23.1
  • ovmf-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise High Performance Computing 12 SP4 (noarch)
  • qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.23.1
  • qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server 12 SP4 (aarch64 x86_64)
  • ovmf-tools-2017+git1510945757.b2662641d5-3.23.1
  • ovmf-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server 12 SP4 (noarch)
  • qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.23.1
  • qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (x86_64)
  • ovmf-tools-2017+git1510945757.b2662641d5-3.23.1
  • ovmf-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (noarch)
  • qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
  • ovmf-tools-2017+git1510945757.b2662641d5-3.23.1
  • ovmf-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)
  • qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.23.1
  • qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server 12 SP5 (aarch64 x86_64)
  • ovmf-tools-2017+git1510945757.b2662641d5-3.23.1
  • ovmf-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server 12 SP5 (noarch)
  • qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.23.1
  • qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
  • ovmf-tools-2017+git1510945757.b2662641d5-3.23.1
  • ovmf-2017+git1510945757.b2662641d5-3.23.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)
  • qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.23.1

References:

• https://www.suse.com/security/cve/CVE-2019-14553.html
• https://www.suse.com/security/cve/CVE-2019-14559.html
• https://www.suse.com/security/cve/CVE-2019-14563.html
• https://www.suse.com/security/cve/CVE-2019-14575.html
• https://bugzilla.suse.com/show_bug.cgi?id=1153072
• https://bugzilla.suse.com/show_bug.cgi?id=1163927
• https://bugzilla.suse.com/show_bug.cgi?id=1163959
• https://bugzilla.suse.com/show_bug.cgi?id=1163969