Cross-References: CVE-2019-18902 CVE-2019-18903 CVE-2020-7216 CVE-2020-7217 Affected Products: SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________
An update that solves four vulnerabilities and has one errata is now available.
Description:
This update for wicked fixes the following issues:
Security issues fixed:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903). - CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904). - CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905). - CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
Non-security issue fixed:
- dhcp4: Fixed an intermittent hang during network setup by cleaning up the defer timer pointer (bsc#1142214).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-351=1
Package List:
- SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64):
