SUSE-SU-2018:1744-1

Details

Description of the patch:

This update for slf4j fixes the following issues:

CVE-2018-8088: Disallow EventData deserialization by default to avoid arbitrary code execution using serialized data (bsc#1085970)

Affected Packages

slf4j

SUSE Linux Enterprise Desktop 12 SP3SUSE Linux Enterprise Server 12 SP3SUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE Linux Enterprise Software Development Kit 12 SP3SUSE Manager Server 3.0

Fixed in:

1.7.12-3.3.1

References

ADVISORY

https://bugzilla.suse.com/1085970

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2018-June/004199.html

ADVISORY

https://www.suse.com/security/cve/CVE-2018-8088/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2018/suse-su-20181744-1/