SUSE Security Update: Security update for lzo ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0955-1 Rating: important References: #883947 Cross-References: CVE-2014-4607 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: lzo has been updated to fix a potential denial of service issue or possible remote code execution by allowing an attacker, if the LZO decompression algorithm is used in a threaded or kernel context, to corrupt memory structures that control the flow of execution in other contexts. (CVE-2014-4607) Security Issues: * CVE-2014-4607 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4607> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-liblzo2-2-9522 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-liblzo2-2-9521 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): liblzo2-2-2.03-12.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): liblzo2-2-32bit-2.03-12.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): liblzo2-2-2.03-12.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): liblzo2-2-32bit-2.03-12.3.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): lzo-2.02-12.10.1 lzo-devel-2.02-12.10.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): lzo-32bit-2.02-12.10.1 lzo-devel-32bit-2.02-12.10.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): lzo-2.02-12.10.1 lzo-devel-2.02-12.10.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): lzo-32bit-2.02-12.10.1 lzo-devel-32bit-2.02-12.10.1 References: http://support.novell.com/security/cve/CVE-2014-4607.html https://bugzilla.novell.com/883947 http://download.suse.com/patch/finder/?keywords=53e03c0ab7cec114a28a4a37b4ed... http://download.suse.com/patch/finder/?keywords=8a13db4a6cefecad6461ab5197a5... http://download.suse.com/patch/finder/?keywords=ac9e06dc2568672fcb7aa56123a7... http://download.suse.com/patch/finder/?keywords=ece9a97b1932fc3a814dad7078fa... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org