Security update for rdesktop SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:2135-1 Final 1 1 2019-09-14T16:17:10Z current 2019-09-14T16:17:10Z 2019-09-14T16:17:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rdesktop This update for rdesktop fixes the following issues: rdesktop was updated to 1.8.6: * Fix protocol code handling new licenses rdesktop was updated to 1.8.5: * Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server. rdesktop was updated to 1.8.4 (fix for boo#1121448): * Add rdp_protocol_error function that is used in several fixes * Refactor of process_bitmap_updates * Fix possible integer overflow in s_check_rem() on 32bit arch * Fix memory corruption in process_bitmap_data - CVE-2018-8794 * Fix remote code execution in process_bitmap_data - CVE-2018-8795 * Fix remote code execution in process_plane - CVE-2018-8797 * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175 * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175 * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176 * Fix Denial of Service in sec_recv - CVE-2018-20176 * Fix minor information leak in rdpdr_process - CVE-2018-8791 * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792 * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793 * Fix Denial of Service in process_bitmap_data - CVE-2018-8796 * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798 * Fix Denial of Service in process_secondary_order - CVE-2018-8799 * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800 * Fix major information leak in ui_clip_handle_data - CVE-2018-20174 * Fix memory corruption in rdp_in_unistr - CVE-2018-20177 * Fix Denial of Service in process_demand_active - CVE-2018-20178 * Fix remote code execution in lspci_process - CVE-2018-20179 * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180 * Fix remote code execution in seamless_process - CVE-2018-20181 * Fix remote code execution in seamless_process_line - CVE-2018-20182 * Fix building against OpenSSL 1.1 - remove obsolete patches * rdesktop-Fix-OpenSSL-1.1-compability-issues.patch * rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch - update changes file * add missing info about bugzilla 1121448 - Added rdesktop-Fix-decryption.patch Patch from https://github.com/rdesktop/rdesktop/pull/334 to fix connections to VirtualBox. - update to 1.8.6 * Fix protocol code handling new licenses - update to 1.8.5 * Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server. - Trim redundant wording from description. - Use %make_install. - update to 1.8.4 (fix for boo#1121448) * Add rdp_protocol_error function that is used in several fixes * Refactor of process_bitmap_updates * Fix possible integer overflow in s_check_rem() on 32bit arch * Fix memory corruption in process_bitmap_data - CVE-2018-8794 * Fix remote code execution in process_bitmap_data - CVE-2018-8795 * Fix remote code execution in process_plane - CVE-2018-8797 * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175 * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175 * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176 * Fix Denial of Service in sec_recv - CVE-2018-20176 * Fix minor information leak in rdpdr_process - CVE-2018-8791 * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792 * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793 * Fix Denial of Service in process_bitmap_data - CVE-2018-8796 * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798 * Fix Denial of Service in process_secondary_order - CVE-2018-8799 * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800 * Fix major information leak in ui_clip_handle_data - CVE-2018-20174 * Fix memory corruption in rdp_in_unistr - CVE-2018-20177 * Fix Denial of Service in process_demand_active - CVE-2018-20178 * Fix remote code execution in lspci_process - CVE-2018-20179 * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180 * Fix remote code execution in seamless_process - CVE-2018-20181 * Fix remote code execution in seamless_process_line - CVE-2018-20182 * Fix building against OpenSSL 1.1 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-2135 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ E-Mail link for openSUSE-SU-2019:2135-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1121448 SUSE Bug 1121448 https://www.suse.com/security/cve/CVE-2018-20174/ SUSE CVE CVE-2018-20174 page https://www.suse.com/security/cve/CVE-2018-20175/ SUSE CVE CVE-2018-20175 page https://www.suse.com/security/cve/CVE-2018-20176/ SUSE CVE CVE-2018-20176 page https://www.suse.com/security/cve/CVE-2018-20177/ SUSE CVE CVE-2018-20177 page https://www.suse.com/security/cve/CVE-2018-20178/ SUSE CVE CVE-2018-20178 page https://www.suse.com/security/cve/CVE-2018-20179/ SUSE CVE CVE-2018-20179 page https://www.suse.com/security/cve/CVE-2018-20180/ SUSE CVE CVE-2018-20180 page https://www.suse.com/security/cve/CVE-2018-20181/ SUSE CVE CVE-2018-20181 page https://www.suse.com/security/cve/CVE-2018-20182/ SUSE CVE CVE-2018-20182 page https://www.suse.com/security/cve/CVE-2018-8791/ SUSE CVE CVE-2018-8791 page https://www.suse.com/security/cve/CVE-2018-8792/ SUSE CVE CVE-2018-8792 page https://www.suse.com/security/cve/CVE-2018-8793/ SUSE CVE CVE-2018-8793 page https://www.suse.com/security/cve/CVE-2018-8794/ SUSE CVE CVE-2018-8794 page https://www.suse.com/security/cve/CVE-2018-8795/ SUSE CVE CVE-2018-8795 page https://www.suse.com/security/cve/CVE-2018-8796/ SUSE CVE CVE-2018-8796 page https://www.suse.com/security/cve/CVE-2018-8797/ SUSE CVE CVE-2018-8797 page https://www.suse.com/security/cve/CVE-2018-8798/ SUSE CVE CVE-2018-8798 page https://www.suse.com/security/cve/CVE-2018-8799/ SUSE CVE CVE-2018-8799 page https://www.suse.com/security/cve/CVE-2018-8800/ SUSE CVE CVE-2018-8800 page SUSE Package Hub 15 SP1 openSUSE Leap 15.1 rdesktop-1.8.6-bp151.2.3.1 rdesktop-1.8.6-bp151.2.3.1 as a component of SUSE Package Hub 15 SP1 rdesktop-1.8.6-bp151.2.3.1 as a component of openSUSE Leap 15.1 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak. CVE-2018-20174 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20174.html CVE-2018-20174 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault). CVE-2018-20175 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20175.html CVE-2018-20175 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault). CVE-2018-20176 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20176.html CVE-2018-20176 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution. CVE-2018-20177 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20177.html CVE-2018-20177 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault). CVE-2018-20178 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20178.html CVE-2018-20178 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution. CVE-2018-20179 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20179.html CVE-2018-20179 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution. CVE-2018-20180 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20180.html CVE-2018-20180 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution. CVE-2018-20181 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20181.html CVE-2018-20181 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution. CVE-2018-20182 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-20182.html CVE-2018-20182 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak. CVE-2018-8791 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8791.html CVE-2018-8791 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault). CVE-2018-8792 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8792.html CVE-2018-8792 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution. CVE-2018-8793 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8793.html CVE-2018-8793 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution. CVE-2018-8794 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8794.html CVE-2018-8794 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution. CVE-2018-8795 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8795.html CVE-2018-8795 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of Service (segfault). CVE-2018-8796 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8796.html CVE-2018-8796 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution. CVE-2018-8797 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8797.html CVE-2018-8797 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information leak. CVE-2018-8798 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8798.html CVE-2018-8798 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial of Service (segfault). CVE-2018-8799 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8799.html CVE-2018-8799 https://bugzilla.suse.com/1121448 SUSE Bug 1121448 rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution. CVE-2018-8800 SUSE Package Hub 15 SP1:rdesktop-1.8.6-bp151.2.3.1 openSUSE Leap 15.1:rdesktop-1.8.6-bp151.2.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ https://www.suse.com/security/cve/CVE-2018-8800.html CVE-2018-8800 https://bugzilla.suse.com/1121448 SUSE Bug 1121448