* bsc#1215947 * bsc#1216419 Cross-References: * CVE-2023-38470 . # Security update for avahi Announcement ID: SUSE-SU-2023:4910-1 Rating: moderate References: * bsc#1215947 * bsc#1216419 Cross-References: * CVE-2023-38470 * CVE-2023-38473 CVSS scores: * CVE-2023-38470 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-38470 ( NVD ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-38473 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-38473 ( NVD ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Manager Proxy 4.2 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Server 4.2 An update that solves two vulnerabilities can now be installed. ## Description: This update for avahi fixes the following issues: * CVE-2023-38473: Fixed a reachable assertion when parsing a host name (bsc#1216419). * CVE-2023-38470: Fixed that each label is at least one byte long (bsc#1215947). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4910=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4910=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-4910=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4910=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4910=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4910=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390xx86_64) * libavahi-ui0-0.7-150100.3.29.1 * libavahi-ui0-debuginfo-0.7-150100.3.29.1 * SUSE Manager Proxy 4.2 (x86_64) * avahi-debuginfo-0.7-150100.3.29.1 * libavahi-client3-debuginfo-0.7-150100.3.29.1 * libavahi-common3-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-core7-0.7-150100.3.29.1 * libavahi-ui-gtk3-0-debuginfo-0.7-150100.3.29.1 * avahi-compat-howl-devel-0.7-150100.3.29.1 * libavahi-glib1-debuginfo-0.7-150100.3.29.1 * libhowl0-debuginfo-0.7-150100.3.29.1 * libavahi-gobject0-debuginfo-0.7-150100.3.29.1 * libavahi-gobject0-0.7-150100.3.29.1 * libavahi-common3-0.7-150100.3.29.1 * libavahi-client3-0.7-150100.3.29.1 * typelib-1_0-Avahi-0_6-0.7-150100.3.29.1 * libavahi-ui-gtk3-0-0.7-150100.3.29.1 * avahi-debugsource-0.7-150100.3.29.1 * avahi-utils-debuginfo-0.7-150100.3.29.1 * avahi-glib2-debugsource-0.7-150100.3.29.1 * libavahi-ui0-0.7-150100.3.29.1 * avahi-compat-mDNSResponder-devel-0.7-150100.3.29.1 * libdns_sd-debuginfo-0.7-150100.3.29.1 * avahi-utils-0.7-150100.3.29.1 * libavahi-common3-debuginfo-0.7-150100.3.29.1 * libavahi-ui0-debuginfo-0.7-150100.3.29.1 * libdns_sd-0.7-150100.3.29.1 * libavahi-glib1-0.7-150100.3.29.1 * libavahi-devel-0.7-150100.3.29.1 * libhowl0-0.7-150100.3.29.1 * avahi-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-common3-32bit-0.7-150100.3.29.1 * libavahi-glib-devel-0.7-150100.3.29.1 * libavahi-client3-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-core7-debuginfo-0.7-150100.3.29.1 * libavahi-client3-32bit-0.7-150100.3.29.1 * avahi-0.7-150100.3.29.1 * SUSE Manager Proxy 4.2 (noarch) * avahi-lang-0.7-150100.3.29.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * avahi-debuginfo-0.7-150100.3.29.1 * libavahi-client3-debuginfo-0.7-150100.3.29.1 * libavahi-common3-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-core7-0.7-150100.3.29.1 * libavahi-ui-gtk3-0-debuginfo-0.7-150100.3.29.1 *avahi-compat-howl-devel-0.7-150100.3.29.1 * libavahi-glib1-debuginfo-0.7-150100.3.29.1 * libhowl0-debuginfo-0.7-150100.3.29.1 * libavahi-gobject0-debuginfo-0.7-150100.3.29.1 * libavahi-gobject0-0.7-150100.3.29.1 * libavahi-common3-0.7-150100.3.29.1 * libavahi-client3-0.7-150100.3.29.1 * typelib-1_0-Avahi-0_6-0.7-150100.3.29.1 * libavahi-ui-gtk3-0-0.7-150100.3.29.1 * avahi-debugsource-0.7-150100.3.29.1 * avahi-utils-debuginfo-0.7-150100.3.29.1 * avahi-glib2-debugsource-0.7-150100.3.29.1 * libavahi-ui0-0.7-150100.3.29.1 * avahi-compat-mDNSResponder-devel-0.7-150100.3.29.1 * libdns_sd-debuginfo-0.7-150100.3.29.1 * avahi-utils-0.7-150100.3.29.1 * libavahi-common3-debuginfo-0.7-150100.3.29.1 * libavahi-ui0-debuginfo-0.7-150100.3.29.1 * libdns_sd-0.7-150100.3.29.1 * libavahi-glib1-0.7-150100.3.29.1 * libavahi-devel-0.7-150100.3.29.1 * libhowl0-0.7-150100.3.29.1 * avahi-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-common3-32bit-0.7-150100.3.29.1 * libavahi-glib-devel-0.7-150100.3.29.1 * libavahi-client3-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-core7-debuginfo-0.7-150100.3.29.1 * libavahi-client3-32bit-0.7-150100.3.29.1 * avahi-0.7-150100.3.29.1 * SUSE Manager Retail Branch Server 4.2 (noarch) * avahi-lang-0.7-150100.3.29.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * avahi-debuginfo-0.7-150100.3.29.1 * libavahi-client3-debuginfo-0.7-150100.3.29.1 * libavahi-core7-0.7-150100.3.29.1 * libavahi-ui-gtk3-0-debuginfo-0.7-150100.3.29.1 * avahi-compat-howl-devel-0.7-150100.3.29.1 * libavahi-glib1-debuginfo-0.7-150100.3.29.1 * libhowl0-debuginfo-0.7-150100.3.29.1 * libavahi-gobject0-debuginfo-0.7-150100.3.29.1 * libavahi-gobject0-0.7-150100.3.29.1 * libavahi-client3-0.7-150100.3.29.1 * libavahi-common3-0.7-150100.3.29.1 * typelib-1_0-Avahi-0_6-0.7-150100.3.29.1 * libavahi-ui-gtk3-0-0.7-150100.3.29.1 * avahi-debugsource-0.7-150100.3.29.1 *avahi-utils-debuginfo-0.7-150100.3.29.1 * avahi-glib2-debugsource-0.7-150100.3.29.1 * libavahi-ui0-0.7-150100.3.29.1 * avahi-compat-mDNSResponder-devel-0.7-150100.3.29.1 * libdns_sd-debuginfo-0.7-150100.3.29.1 * avahi-utils-0.7-150100.3.29.1 * libavahi-common3-debuginfo-0.7-150100.3.29.1 * libavahi-ui0-debuginfo-0.7-150100.3.29.1 * libdns_sd-0.7-150100.3.29.1 * libavahi-glib1-0.7-150100.3.29.1 * libavahi-devel-0.7-150100.3.29.1 * libhowl0-0.7-150100.3.29.1 * libavahi-glib-devel-0.7-150100.3.29.1 * libavahi-core7-debuginfo-0.7-150100.3.29.1 * avahi-0.7-150100.3.29.1 * SUSE Manager Server 4.2 (noarch) * avahi-lang-0.7-150100.3.29.1 * SUSE Manager Server 4.2 (x86_64) * avahi-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-common3-32bit-0.7-150100.3.29.1 * libavahi-client3-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-common3-32bit-debuginfo-0.7-150100.3.29.1 * libavahi-client3-32bit-0.7-150100.3.29.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * avahi-debuginfo-0.7-150100.3.29.1 * libavahi-client3-debuginfo-0.7-150100.3.29.1 * avahi-debugsource-0.7-150100.3.29.1 * libavahi-core7-0.7-150100.3.29.1 * libavahi-common3-debuginfo-0.7-150100.3.29.1 * libavahi-core7-debuginfo-0.7-150100.3.29.1 * libavahi-client3-0.7-150100.3.29.1 * libavahi-common3-0.7-150100.3.29.1 * avahi-0.7-150100.3.29.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * avahi-debuginfo-0.7-150100.3.29.1 * libavahi-client3-debuginfo-0.7-150100.3.29.1 * avahi-debugsource-0.7-150100.3.29.1 * libavahi-core7-0.7-150100.3.29.1 * libavahi-common3-debuginfo-0.7-150100.3.29.1 * libavahi-core7-debuginfo-0.7-150100.3.29.1 * libavahi-client3-0.7-150100.3.29.1 * libavahi-common3-0.7-150100.3.29.1 * avahi-0.7-150100.3.29.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38470.html * https://www.suse.com/security/cve/CVE-2023-38473.html *https://bugzilla.suse.com/show_bug.cgi?id=1215947 * https://bugzilla.suse.com/show_bug.cgi?id=1216419 . An essential slight security upgrade for coreutils addresses multiple vulnerabilities with distinct instructions for execution.. avahi patch details,SUSE security advisory,network service update. . LinuxSecurity.com Team
Updated avahi packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: avahi security update Advisory ID: RHSA-2009:0013-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:0013.html Issue date: 2009-01-12 CVE Names: CVE-2008-5081 ==================================================================== 1. Summary: Updated avahi packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zeroconf Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, see printers to print to, and find shared files on other computers. Hugo Dias discovered a denial of service flaw in avahi-daemon. A remote attacker on the same local area network (LAN) could send a specially-crafted mDNS (Multicast DNS) packet that would cause avahi-daemon to exit unexpectedly due to a failed assertion check. (CVE-2008-5081) All users are advised to upgrade to these updated packages, which contain a backported patch which resolves this issue. After installing the update, avahi-daemon will be restarted automatically. 4. Solution: Before applying thisupdate, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 475964 - CVE-2008-5081 avahi: avahi-daemon DoS (application abort) via packet with source port 0 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: avahi-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.i386.rpm avahi-debuginfo-0.6.16-1.el5_2.1.i386.rpm avahi-glib-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-0.6.16-1.el5_2.1.i386.rpm avahi-tools-0.6.16-1.el5_2.1.i386.rpm x86_64: avahi-0.6.16-1.el5_2.1.i386.rpm avahi-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-howl-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.x86_64.rpm avahi-debuginfo-0.6.16-1.el5_2.1.i386.rpm avahi-debuginfo-0.6.16-1.el5_2.1.x86_64.rpm avahi-glib-0.6.16-1.el5_2.1.i386.rpm avahi-glib-0.6.16-1.el5_2.1.x86_64.rpm avahi-qt3-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-0.6.16-1.el5_2.1.x86_64.rpm avahi-tools-0.6.16-1.el5_2.1.x86_64.rpm RHEL Desktop Workstation (v. 5client): Source: i386: avahi-compat-howl-devel-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.i386.rpm avahi-debuginfo-0.6.16-1.el5_2.1.i386.rpm avahi-devel-0.6.16-1.el5_2.1.i386.rpm avahi-glib-devel-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.i386.rpm x86_64: avahi-compat-howl-devel-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-debuginfo-0.6.16-1.el5_2.1.i386.rpm avahi-debuginfo-0.6.16-1.el5_2.1.x86_64.rpm avahi-devel-0.6.16-1.el5_2.1.i386.rpm avahi-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-glib-devel-0.6.16-1.el5_2.1.i386.rpm avahi-glib-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: avahi-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.i386.rpm avahi-debuginfo-0.6.16-1.el5_2.1.i386.rpm avahi-devel-0.6.16-1.el5_2.1.i386.rpm avahi-glib-0.6.16-1.el5_2.1.i386.rpm avahi-glib-devel-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.i386.rpm avahi-tools-0.6.16-1.el5_2.1.i386.rpm ia64: avahi-0.6.16-1.el5_2.1.ia64.rpm avahi-compat-howl-0.6.16-1.el5_2.1.ia64.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.ia64.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.ia64.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.ia64.rpm avahi-debuginfo-0.6.16-1.el5_2.1.ia64.rpm avahi-devel-0.6.16-1.el5_2.1.ia64.rpm avahi-glib-0.6.16-1.el5_2.1.ia64.rpm avahi-glib-devel-0.6.16-1.el5_2.1.ia64.rpm avahi-qt3-0.6.16-1.el5_2.1.ia64.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.ia64.rpm avahi-tools-0.6.16-1.el5_2.1.ia64.rpm ppc: avahi-0.6.16-1.el5_2.1.ppc.rpm avahi-0.6.16-1.el5_2.1.ppc64.rpm avahi-compat-howl-0.6.16-1.el5_2.1.ppc.rpm avahi-compat-howl-0.6.16-1.el5_2.1.ppc64.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.ppc.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.ppc64.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.ppc.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.ppc64.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.ppc.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.ppc64.rpm avahi-debuginfo-0.6.16-1.el5_2.1.ppc.rpm avahi-debuginfo-0.6.16-1.el5_2.1.ppc64.rpm avahi-devel-0.6.16-1.el5_2.1.ppc.rpm avahi-devel-0.6.16-1.el5_2.1.ppc64.rpm avahi-glib-0.6.16-1.el5_2.1.ppc.rpm avahi-glib-0.6.16-1.el5_2.1.ppc64.rpm avahi-glib-devel-0.6.16-1.el5_2.1.ppc.rpm avahi-glib-devel-0.6.16-1.el5_2.1.ppc64.rpm avahi-qt3-0.6.16-1.el5_2.1.ppc.rpm avahi-qt3-0.6.16-1.el5_2.1.ppc64.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.ppc.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.ppc64.rpm avahi-tools-0.6.16-1.el5_2.1.ppc.rpm s390x: avahi-0.6.16-1.el5_2.1.s390.rpm avahi-0.6.16-1.el5_2.1.s390x.rpm avahi-compat-howl-0.6.16-1.el5_2.1.s390.rpm avahi-compat-howl-0.6.16-1.el5_2.1.s390x.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.s390.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.s390x.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.s390.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.s390x.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.s390.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.s390x.rpm avahi-debuginfo-0.6.16-1.el5_2.1.s390.rpm avahi-debuginfo-0.6.16-1.el5_2.1.s390x.rpm avahi-devel-0.6.16-1.el5_2.1.s390.rpm avahi-devel-0.6.16-1.el5_2.1.s390x.rpm avahi-glib-0.6.16-1.el5_2.1.s390.rpm avahi-glib-0.6.16-1.el5_2.1.s390x.rpm avahi-glib-devel-0.6.16-1.el5_2.1.s390.rpm avahi-glib-devel-0.6.16-1.el5_2.1.s390x.rpm avahi-qt3-0.6.16-1.el5_2.1.s390.rpm avahi-qt3-0.6.16-1.el5_2.1.s390x.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.s390.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.s390x.rpm avahi-tools-0.6.16-1.el5_2.1.s390x.rpm x86_64: avahi-0.6.16-1.el5_2.1.i386.rpm avahi-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-howl-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.i386.rpm avahi-compat-howl-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-0.6.16-1.el5_2.1.x86_64.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.i386.rpm avahi-compat-libdns_sd-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-debuginfo-0.6.16-1.el5_2.1.i386.rpm avahi-debuginfo-0.6.16-1.el5_2.1.x86_64.rpm avahi-devel-0.6.16-1.el5_2.1.i386.rpm avahi-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-glib-0.6.16-1.el5_2.1.i386.rpm avahi-glib-0.6.16-1.el5_2.1.x86_64.rpm avahi-glib-devel-0.6.16-1.el5_2.1.i386.rpm avahi-glib-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-qt3-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-0.6.16-1.el5_2.1.x86_64.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.i386.rpm avahi-qt3-devel-0.6.16-1.el5_2.1.x86_64.rpm avahi-tools-0.6.16-1.el5_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.cve.org/CVERecord?id=CVE-2008-5081 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2009 Red Hat, Inc. . Red Hat issues a crucial security bulletin concerning samba software, targeting a moderate severity DDoS vulnerability.. avahi Security, Red Hat Advisory, Linux Security Update. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.