Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges

Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

SUSE: 2021:2145-1 Moderate: Libsolv Heap Overflow Issue

suse
Calendar Grey June 23, 2021
Scroller Suse
SUSE has released a security update for libsolv, addressing various vulnerabilities and providing patch guidance. Keep your systems safe!
An update that fixes two vulnerabilities, contains one feature is now available

Summary

This update for libsolv fixes the following issues: Security issues fixed: - CVE-2019-20387: Fixed heap-buffer-overflow in repodata_schema2id (bsc#1161510) - CVE-2021-3200: testcase_read: error out if repos are added or the system is changed too late (bsc#1186229) Other issues fixed: - backport support for blacklisted packages to support ptf packages and retracted patches - fix ruleinfo of complex dependencies returning the wrong origin - fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason - fix add_complex_recommends() selecting conflicted packages in rare cases - fix potential segfault in resolve_jobrules - fix solv_zchunk decoding error if large chunks are used Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods

Topics%20covered

Topics Covered

security advisory moderate heap overflow SUSE Linux Enterprise libsolv

References

#1161510 #1186229 SLE-17973

Cross- CVE-2019-20387 CVE-2021-3200

CVSS scores:

CVE-2019-20387 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2019-20387 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2021-3200 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2021-3200 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Server 12-SP2-BCL

https://www.suse.com/security/cve/CVE-2019-20387.html

https://www.suse.com/security/cve/CVE-2021-3200.html

https://bugzilla.suse.com/1161510

https://bugzilla.suse.com/1186229

Announcement ID: SUSE-SU-2021:2145-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate heap overflow SUSE Linux Enterprise libsolv

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.