Security update for bzip2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2013-2 Final 1 1 2019-07-29T13:43:39Z current 2019-07-29T13:43:39Z 2019-07-29T13:43:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bzip2 This update for bzip2 fixes the following issues: - Fixed a regression with the fix for CVE-2019-12900, which caused incompatibilities with files that used many selectors (bsc#1139083). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/nginx-ingress-controller:beta1-2019-2013,Container suse/ltss/sle12.5/sles12sp5:latest-2019-2013,Container suse/sles12sp3:latest-2019-2013,Container suse/sles12sp4:latest-2019-2013,Container suse/sles12sp5:latest-2019-2013,Image SLES12-SP5-Azure-BYOS-2019-2013,Image SLES12-SP5-Azure-Basic-On-Demand-2019-2013,Image SLES12-SP5-Azure-HPC-BYOS-2019-2013,Image SLES12-SP5-Azure-HPC-On-Demand-2019-2013,Image SLES12-SP5-Azure-SAP-BYOS-2019-2013,Image SLES12-SP5-Azure-SAP-On-Demand-2019-2013,Image SLES12-SP5-Azure-Standard-On-Demand-2019-2013,Image SLES12-SP5-EC2-BYOS-2019-2013,Image SLES12-SP5-EC2-ECS-On-Demand-2019-2013,Image SLES12-SP5-EC2-On-Demand-2019-2013,Image SLES12-SP5-EC2-SAP-BYOS-2019-2013,Image SLES12-SP5-EC2-SAP-On-Demand-2019-2013,Image SLES12-SP5-GCE-BYOS-2019-2013,Image SLES12-SP5-GCE-On-Demand-2019-2013,Image SLES12-SP5-GCE-SAP-BYOS-2019-2013,Image SLES12-SP5-GCE-SAP-On-Demand-2019-2013,Image SLES12-SP5-OCI-BYOS-BYOS-2019-2013,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2019-2013,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2019-2013,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2019-2013,SUSE-2019-2013,SUSE-Storage-5-2019-2013 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192013-2/ Link for SUSE-SU-2019:2013-2 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005823.html E-Mail link for SUSE-SU-2019:2013-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1139083 SUSE Bug 1139083 https://www.suse.com/security/cve/CVE-2019-12900/ SUSE CVE CVE-2019-12900 page Container caasp/v4/nginx-ingress-controller:beta1 Container suse/ltss/sle12.5/sles12sp5:latest Container suse/sles12sp3:latest Container suse/sles12sp4:latest Container suse/sles12sp5:latest Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-BYOS Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Enterprise Storage 5 libbz2-1-1.0.6-30.8.1 bzip2-1.0.6-30.8.1 bzip2-doc-1.0.6-30.8.1 libbz2-1-32bit-1.0.6-30.8.1 libbz2-1-64bit-1.0.6-30.8.1 libbz2-devel-1.0.6-30.8.1 libbz2-devel-32bit-1.0.6-30.8.1 libbz2-devel-64bit-1.0.6-30.8.1 libbz2-1-1.0.6-30.8.1 as a component of Container caasp/v4/nginx-ingress-controller:beta1 libbz2-1-1.0.6-30.8.1 as a component of Container suse/ltss/sle12.5/sles12sp5:latest libbz2-1-1.0.6-30.8.1 as a component of Container suse/sles12sp3:latest libbz2-1-1.0.6-30.8.1 as a component of Container suse/sles12sp4:latest libbz2-1-1.0.6-30.8.1 as a component of Container suse/sles12sp5:latest libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-On-Demand bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-GCE-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-GCE-On-Demand bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production bzip2-1.0.6-30.8.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libbz2-1-1.0.6-30.8.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production bzip2-1.0.6-30.8.1 as a component of SUSE Enterprise Storage 5 bzip2-doc-1.0.6-30.8.1 as a component of SUSE Enterprise Storage 5 libbz2-1-1.0.6-30.8.1 as a component of SUSE Enterprise Storage 5 libbz2-1-32bit-1.0.6-30.8.1 as a component of SUSE Enterprise Storage 5 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900 Container caasp/v4/nginx-ingress-controller:beta1:libbz2-1-1.0.6-30.8.1 Container suse/ltss/sle12.5/sles12sp5:latest:libbz2-1-1.0.6-30.8.1 Container suse/sles12sp3:latest:libbz2-1-1.0.6-30.8.1 Container suse/sles12sp4:latest:libbz2-1-1.0.6-30.8.1 Container suse/sles12sp5:latest:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-Basic-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-HPC-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-HPC-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-SAP-BYOS:bzip2-1.0.6-30.8.1 Image SLES12-SP5-Azure-SAP-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-SAP-On-Demand:bzip2-1.0.6-30.8.1 Image SLES12-SP5-Azure-SAP-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-Azure-Standard-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-EC2-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-EC2-ECS-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-EC2-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-EC2-SAP-BYOS:bzip2-1.0.6-30.8.1 Image SLES12-SP5-EC2-SAP-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-EC2-SAP-On-Demand:bzip2-1.0.6-30.8.1 Image SLES12-SP5-EC2-SAP-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-GCE-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-GCE-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-GCE-SAP-BYOS:bzip2-1.0.6-30.8.1 Image SLES12-SP5-GCE-SAP-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-GCE-SAP-On-Demand:bzip2-1.0.6-30.8.1 Image SLES12-SP5-GCE-SAP-On-Demand:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-OCI-BYOS-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:bzip2-1.0.6-30.8.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:bzip2-1.0.6-30.8.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libbz2-1-1.0.6-30.8.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:bzip2-1.0.6-30.8.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libbz2-1-1.0.6-30.8.1 SUSE Enterprise Storage 5:bzip2-1.0.6-30.8.1 SUSE Enterprise Storage 5:bzip2-doc-1.0.6-30.8.1 SUSE Enterprise Storage 5:libbz2-1-1.0.6-30.8.1 SUSE Enterprise Storage 5:libbz2-1-32bit-1.0.6-30.8.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192013-2/ https://www.suse.com/security/cve/CVE-2019-12900.html CVE-2019-12900 https://bugzilla.suse.com/1139083 SUSE Bug 1139083 https://bugzilla.suse.com/1141513 SUSE Bug 1141513 https://bugzilla.suse.com/1149458 SUSE Bug 1149458