This update for libsolv fixes the following issues :

This is a reissue of an existing libsolv update that also included libsolv-devel for LTSS products.

libsolv was updated to version 0.6.36 fixes the following issues :

Security issues fixed :

CVE-2018-20532: Fixed a NULL pointer dereference in testcase_read() (bsc#1120629).

CVE-2018-20533: Fixed a NULL pointer dereference in testcase_str2dep_complex() (bsc#1120630).

CVE-2018-20534: Fixed a NULL pointer dereference in pool_whatprovides() (bsc#1120631).

Non-security issues fixed :

Made cleandeps jobs on patterns work (bsc#1137977).

Fixed an issue multiversion packages that obsolete their own name (bsc#1127155).

Keep consistent package name if there are multiple alternatives (bsc#1131823).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libsolv package has been released.

This update for libsolv, libzypp and zypper fixes the following issues :

libsolv was updated to version 0.6.36 fixes the following issues :

Security issues fixed :

CVE-2018-20532: Fixed a NULL pointer dereference in testcase_read() (bsc#1120629).

CVE-2018-20533: Fixed a NULL pointer dereference in testcase_str2dep_complex() (bsc#1120630).

CVE-2018-20534: Fixed a NULL pointer dereference in pool_whatprovides() (bsc#1120631).

Non-security issues fixed: Made cleandeps jobs on patterns work (bsc#1137977).

Fixed an issue multiversion packages that obsolete their own name (bsc#1127155).

Keep consistent package name if there are multiple alternatives (bsc#1131823).

libzypp received following fixes: Fixes a bug where locking the kernel was not possible (bsc#1113296)

zypper received following fixes: Fixes a bug where the wrong exit code was set when refreshing repos if

--root was used (bsc#1134226)

Improved the displaying of locks (bsc#1112911)

Fixes an issue where `https` repository urls caused an error prompt to appear twice (bsc#1110542)

zypper will now always warn when no repositories are defined (bsc#1109893)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application.(CVE-2018-20534)

There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.(CVE-2018-20532)

There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.(CVE-2018-20533)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
143691	SUSE SLES12 Security Update : libsolv (SUSE-SU-2020:2660-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/6	medium
122921	Photon OS 1.0: Libsolv PHSA-2019-1.0-0212	Nessus	PhotonOS Local Security Checks	2019/3/18	2024/6/13	medium
127090	SUSE SLED12 / SLES12 Security Update : libsolv, libzypp, zypper (SUSE-SU-2019:1972-1)	Nessus	SuSE Local Security Checks	2019/7/26	2024/5/8	medium
132262	Amazon Linux 2 : libsolv (ALAS-2019-1374)	Nessus	Amazon Linux Local Security Checks	2019/12/19	2024/4/3	medium

检测

插件搜索

medium

medium

medium

medium