Oval Definition:oval:org.opensuse.security:def:60027
Revision Date:2020-12-01Version:1
Title:Security update for libssh2_org (Moderate)
Description:

This update for libssh2_org fixes the following issues:

Security issues fixed:

- CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490). - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492). - CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481). - CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493). - CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472). - CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480). - CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471). - CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476). - CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

Other issue addressed:

- Libbssh2 will stop using keys unsupported types in the known_hosts file (bsc#1091236).
Family:unixClass:patch
Status:Reference(s):1042037
1045160
1048575
1057406
1091236
1118900
1125721
1126455
1128471
1128472
1128474
1128476
1128480
1128481
1128490
1128492
1128493
1129186
1129622
1130675
1130831
1131493
1131955
1152497
1154448
1154456
1154458
1154461
1154609
1155321
1155945
1156318
1157888
1158003
1158004
1158005
1158006
1158007
1159329
1161181
1161719
1163809
1165528
1166916
1167231
1169658
1172443
1173576
1173613
1173659
1173942
1174247
1176410
1177143
944458
CVE-2013-0221
CVE-2013-0222
CVE-2013-0223
CVE-2013-1986
CVE-2015-4041
CVE-2015-4042
CVE-2015-6806
CVE-2015-7995
CVE-2015-9019
CVE-2016-4738
CVE-2016-7947
CVE-2016-7948
CVE-2017-5029
CVE-2017-7659
CVE-2017-9789
CVE-2018-12207
CVE-2018-20815
CVE-2019-11135
CVE-2019-16746
CVE-2019-18197
CVE-2019-18420
CVE-2019-18421
CVE-2019-18424
CVE-2019-18425
CVE-2019-19577
CVE-2019-19578
CVE-2019-19579
CVE-2019-19580
CVE-2019-19581
CVE-2019-19583
CVE-2019-3812
CVE-2019-3838
CVE-2019-3855
CVE-2019-3856
CVE-2019-3857
CVE-2019-3858
CVE-2019-3859
CVE-2019-3860
CVE-2019-3861
CVE-2019-3862
CVE-2019-3863
CVE-2019-5953
CVE-2019-8625
CVE-2019-8710
CVE-2019-8720
CVE-2019-8743
CVE-2019-8764
CVE-2019-8766
CVE-2019-8769
CVE-2019-8771
CVE-2019-8782
CVE-2019-8783
CVE-2019-8808
CVE-2019-8811
CVE-2019-8812
CVE-2019-8813
CVE-2019-8814
CVE-2019-8815
CVE-2019-8816
CVE-2019-8819
CVE-2019-8820
CVE-2019-8823
CVE-2019-8835
CVE-2019-8844
CVE-2019-8846
CVE-2019-8934
CVE-2019-9824
CVE-2020-10018
CVE-2020-11668
CVE-2020-11793
CVE-2020-12402
CVE-2020-12415
CVE-2020-12416
CVE-2020-12417
CVE-2020-12418
CVE-2020-12419
CVE-2020-12420
CVE-2020-12421
CVE-2020-12422
CVE-2020-12423
CVE-2020-12424
CVE-2020-12425
CVE-2020-12426
CVE-2020-14331
CVE-2020-25219
CVE-2020-26154
CVE-2020-3862
CVE-2020-3864
CVE-2020-3865
CVE-2020-3867
CVE-2020-3868
CVE-2020-7211
CVE-2020-7598
CVE-2020-8174
SUSE-SU-2018:0261-1
SUSE-SU-2019:0719-1
SUSE-SU-2019:0956-1
SUSE-SU-2019:1354-1
SUSE-SU-2020:0920-2
SUSE-SU-2020:1623-1
SUSE-SU-2020:2900-1
Platform(s):openSUSE Leap 15.0
openSUSE Leap 15.1
SUSE Linux Enterprise Server 12 SP2-ESPOS
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-ESPOS
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP3-TERADATA
SUSE Linux Enterprise Server 12 SP4
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
Product(s):
Definition Synopsis
  • openSUSE Leap 15.0 is installed
  • AND openssl-1.1.0h-lp150.1 is installed
  • Definition Synopsis
  • openSUSE Leap 15.1 is installed
  • AND Package Information
  • libnetpbm-devel-10.80.1-lp151.4.3 is installed
  • OR libnetpbm11-10.80.1-lp151.4.3 is installed
  • OR libnetpbm11-32bit-10.80.1-lp151.4.3 is installed
  • OR netpbm-10.80.1-lp151.4.3 is installed
  • OR netpbm-vulnerable-10.80.1-lp151.4.3 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-ESPOS is installed
  • AND Package Information
  • libssh2-1-1.4.3-20.3 is installed
  • OR libssh2-1-32bit-1.4.3-20.3 is installed
  • OR libssh2_org-1.4.3-20.3 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3 is installed
  • AND Package Information
  • coreutils-8.25-12 is installed
  • OR coreutils-lang-8.25-12 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-BCL is installed
  • AND Package Information
  • MozillaFirefox-68.3.0-109.98 is installed
  • OR MozillaFirefox-translations-common-68.3.0-109.98 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
  • AND Package Information
  • kernel-default-4.4.180-94.124 is installed
  • OR kernel-default-base-4.4.180-94.124 is installed
  • OR kernel-default-devel-4.4.180-94.124 is installed
  • OR kernel-default-kgraft-4.4.180-94.124 is installed
  • OR kernel-devel-4.4.180-94.124 is installed
  • OR kernel-macros-4.4.180-94.124 is installed
  • OR kernel-source-4.4.180-94.124 is installed
  • OR kernel-syms-4.4.180-94.124 is installed
  • OR kgraft-patch-4_4_180-94_124-default-1-4.3 is installed
  • OR kgraft-patch-SLE12-SP3_Update_33-1-4.3 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-LTSS is installed
  • AND Package Information
  • MozillaFirefox-68.8.0-109.119 is installed
  • OR MozillaFirefox-translations-common-68.8.0-109.119 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
  • AND Package Information
  • PackageKit-1.1.3-24.9 is installed
  • OR PackageKit-backend-zypp-1.1.3-24.9 is installed
  • OR PackageKit-lang-1.1.3-24.9 is installed
  • OR libpackagekit-glib2-18-1.1.3-24.9 is installed
  • OR typelib-1_0-PackageKitGlib-1_0-1.1.3-24.9 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4 is installed
  • AND Package Information
  • apache2-2.4.23-29.24 is installed
  • OR apache2-doc-2.4.23-29.24 is installed
  • OR apache2-example-pages-2.4.23-29.24 is installed
  • OR apache2-prefork-2.4.23-29.24 is installed
  • OR apache2-utils-2.4.23-29.24 is installed
  • OR apache2-worker-2.4.23-29.24 is installed
  • Definition Synopsis
  • SUSE OpenStack Cloud 8 is installed
  • AND Package Information
  • libproxy-0.4.13-18.3 is installed
  • OR libproxy-plugins-0.4.13-18.3 is installed
  • OR libproxy1-0.4.13-18.3 is installed
  • OR libproxy1-32bit-0.4.13-18.3 is installed
  • OR libproxy1-config-gnome3-0.4.13-18.3 is installed
  • OR libproxy1-config-gnome3-32bit-0.4.13-18.3 is installed
  • OR libproxy1-networkmanager-0.4.13-18.3 is installed
  • OR libproxy1-pacrunner-webkit-0.4.13-18.3 is installed
  • Definition Synopsis
  • SUSE OpenStack Cloud 9 is installed
  • AND python-urllib3-1.23-3.6 is installed
  • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 8 is installed
  • AND nodejs6-6.17.1-11.37 is installed
  • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 9 is installed
  • AND Package Information
  • mariadb-10.2.29-3.22 is installed
  • OR mariadb-galera-10.2.29-3.22 is installed
  • BACK