You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa spamassassin

Sigurnosni nedostaci programskog paketa spamassassin

openSUSE Security Update: Security update for spamassassin
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1831-1
Rating: moderate
References: #1069831 #1107765 #1108745 #1108748 #1108749
#1108750 #1115411
Cross-References: CVE-2016-1238 CVE-2017-15705 CVE-2018-11780
CVE-2018-11781
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves four vulnerabilities and has three
fixes is now available.

Description:

This update for spamassassin to version 3.4.2 fixes the following issues:

Security issues fixed:

– CVE-2018-11781: Fixed an issue where a local user could inject code in
the meta rule syntax (bsc#1108748).
– CVE-2018-11780: Fixed a potential remote code execution vulnerability in
the PDFInfo plugin (bsc#1108750).
– CVE-2017-15705: Fixed a denial of service through unclosed tags in
crafted emails (bsc#1108745).
– CVE-2016-1238: Fixed an issue where perl would load modules from the
current directory (bsc#1108749).

Non-security issues fixed:

– Use systemd timers instead of cron (bsc#1115411)
– Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)
– Fixed warning about deprecated regex during sa-update (bsc#1069831)

This update was imported from the SUSE:SLE-15:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1831=1

Package List:

– openSUSE Leap 15.0 (x86_64):

perl-Mail-SpamAssassin-3.4.2-lp150.6.3.1
perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp150.6.3.1
spamassassin-3.4.2-lp150.6.3.1
spamassassin-debuginfo-3.4.2-lp150.6.3.1
spamassassin-debugsource-3.4.2-lp150.6.3.1

References:

https://www.suse.com/security/cve/CVE-2016-1238.html
https://www.suse.com/security/cve/CVE-2017-15705.html
https://www.suse.com/security/cve/CVE-2018-11780.html
https://www.suse.com/security/cve/CVE-2018-11781.html
https://bugzilla.suse.com/1069831
https://bugzilla.suse.com/1107765
https://bugzilla.suse.com/1108745
https://bugzilla.suse.com/1108748
https://bugzilla.suse.com/1108749
https://bugzilla.suse.com/1108750
https://bugzilla.suse.com/1115411


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

Top
More in Preporuke
Sigurnosni nedostaci programske biblioteke LibTIFF

Otkriveni su sigurnosni nedostaci programske biblioteke LibTIFF za operacijski sustav RHEL. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja ili...

Close