Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 543
Alerts This Week
Warning Icon 1 543

SUSE Evolution-Data-Server 2021:0949-1 Moderate Update: Buffer Overrun Risk

suse
Calendar Grey March 24, 2021
Scroller Suse Esm H88
SUSE patches resolve vulnerabilities in network-manager, boosting safety and correcting multiple defects. Learn more!
An update that solves two vulnerabilities and has one errata is now available

Summary

This update for evolution-data-server fixes the following issues: - CVE-2020-16117: Fix crash on malformed server response with minimal capabilities (bsc#1174712). - CVE-2020-14928: Response injection via STARTTLS in SMTP and POP3 (bsc#1173910). - Fix buffer overrun when parsing base64 data (bsc#1182882). This update for evolution-ews fixes the following issue: - Fix buffer overrun when parsing base64 data (bsc#1182882). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-WE-15-SP2-2021-949=1 Package List:

Topics%20covered

Topics Covered

security advisory moderate update buffer overrun SUSE response injection

References

#1173910 #1174712 #1182882

Cross- CVE-2020-14928 CVE-2020-16117

CVSS scores:

CVE-2020-14928 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2020-14928 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2020-16117 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2020-16117 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:

SUSE Linux Enterprise Workstation Extension 15-SP2

https://www.suse.com/security/cve/CVE-2020-14928.html

https://www.suse.com/security/cve/CVE-2020-16117.html

https://bugzilla.suse.com/1173910

https://bugzilla.suse.com/1174712

https://bugzilla.suse.com/1182882

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:0949-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate update buffer overrun SUSE response injection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.