Security update for libmspack SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0069-1 Final 1 1 2022-01-13T14:12:43Z current 2022-01-13T14:12:43Z 2022-01-13T14:12:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libmspack This update for libmspack fixes the following issues: - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container rancher/elemental-teal-iso/5.4:latest-2022-69,Container rancher/elemental-teal-rt/5.3:latest-2022-69,Container rancher/elemental-teal-rt/5.4:latest-2022-69,Container rancher/elemental-teal/5.3:latest-2022-69,Container rancher/elemental-teal/5.4:latest-2022-69,Container suse/sle-micro-rancher/5.2:latest-2022-69,Container suse/sle-micro-rancher/5.3:latest-2022-69,Container suse/sle-micro-rancher/5.4:latest-2022-69,Container suse/sle-micro/5.5:latest-2022-69,Image SLES15-SP3-CHOST-BYOS-SAP-CCloud-2022-69,Image SLES15-SP4-CHOST-BYOS-SAP-CCloud-2022-69,Image SLES15-SP5-CHOST-BYOS-SAP-CCloud-2022-69,SUSE-2022-69,SUSE-SLE-Module-Basesystem-15-SP3-2022-69,SUSE-SUSE-MicroOS-5.0-2022-69,SUSE-SUSE-MicroOS-5.1-2022-69 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220069-1/ Link for SUSE-SU-2022:0069-1 https://lists.suse.com/pipermail/sle-security-updates/2022-January/010002.html E-Mail link for SUSE-SU-2022:0069-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1113040 SUSE Bug 1113040 https://www.suse.com/security/cve/CVE-2018-18586/ SUSE CVE CVE-2018-18586 page Container rancher/elemental-teal-iso/5.4:latest Container rancher/elemental-teal-rt/5.3:latest Container rancher/elemental-teal-rt/5.4:latest Container rancher/elemental-teal/5.3:latest Container rancher/elemental-teal/5.4:latest Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Container suse/sle-micro/5.5:latest Image SLES15-SP3-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-CHOST-BYOS-SAP-CCloud SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Module for Basesystem 15 SP3 libmspack0-0.6-3.14.1 libmspack-devel-0.6-3.14.1 libmspack0-32bit-0.6-3.14.1 libmspack0-64bit-0.6-3.14.1 mspack-tools-0.6-3.14.1 libmspack0-0.6-3.14.1 as a component of Container rancher/elemental-teal-iso/5.4:latest libmspack0-0.6-3.14.1 as a component of Container rancher/elemental-teal-rt/5.3:latest libmspack0-0.6-3.14.1 as a component of Container rancher/elemental-teal-rt/5.4:latest libmspack0-0.6-3.14.1 as a component of Container rancher/elemental-teal/5.3:latest libmspack0-0.6-3.14.1 as a component of Container rancher/elemental-teal/5.4:latest libmspack0-0.6-3.14.1 as a component of Container suse/sle-micro-rancher/5.2:latest libmspack0-0.6-3.14.1 as a component of Container suse/sle-micro-rancher/5.3:latest libmspack0-0.6-3.14.1 as a component of Container suse/sle-micro-rancher/5.4:latest libmspack0-0.6-3.14.1 as a component of Container suse/sle-micro/5.5:latest libmspack0-0.6-3.14.1 as a component of Image SLES15-SP3-CHOST-BYOS-SAP-CCloud libmspack0-0.6-3.14.1 as a component of Image SLES15-SP4-CHOST-BYOS-SAP-CCloud libmspack0-0.6-3.14.1 as a component of Image SLES15-SP5-CHOST-BYOS-SAP-CCloud libmspack0-0.6-3.14.1 as a component of SUSE Linux Enterprise Micro 5.0 libmspack0-0.6-3.14.1 as a component of SUSE Linux Enterprise Micro 5.1 libmspack-devel-0.6-3.14.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libmspack0-0.6-3.14.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application CVE-2018-18586 Container rancher/elemental-teal-iso/5.4:latest:libmspack0-0.6-3.14.1 Container rancher/elemental-teal-rt/5.3:latest:libmspack0-0.6-3.14.1 Container rancher/elemental-teal-rt/5.4:latest:libmspack0-0.6-3.14.1 Container rancher/elemental-teal/5.3:latest:libmspack0-0.6-3.14.1 Container rancher/elemental-teal/5.4:latest:libmspack0-0.6-3.14.1 Container suse/sle-micro-rancher/5.2:latest:libmspack0-0.6-3.14.1 Container suse/sle-micro-rancher/5.3:latest:libmspack0-0.6-3.14.1 Container suse/sle-micro-rancher/5.4:latest:libmspack0-0.6-3.14.1 Container suse/sle-micro/5.5:latest:libmspack0-0.6-3.14.1 Image SLES15-SP3-CHOST-BYOS-SAP-CCloud:libmspack0-0.6-3.14.1 Image SLES15-SP4-CHOST-BYOS-SAP-CCloud:libmspack0-0.6-3.14.1 Image SLES15-SP5-CHOST-BYOS-SAP-CCloud:libmspack0-0.6-3.14.1 SUSE Linux Enterprise Micro 5.0:libmspack0-0.6-3.14.1 SUSE Linux Enterprise Micro 5.1:libmspack0-0.6-3.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libmspack-devel-0.6-3.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libmspack0-0.6-3.14.1 low 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220069-1/ https://www.suse.com/security/cve/CVE-2018-18586.html CVE-2018-18586 https://bugzilla.suse.com/1113038 SUSE Bug 1113038 https://bugzilla.suse.com/1113039 SUSE Bug 1113039 https://bugzilla.suse.com/1113040 SUSE Bug 1113040