SUSE-SU-2019:2389-1

HIGH8.0

Security update for ibus

Published Sep 17, 2019

Modified 6 years ago

Fix available

Details

Description of the patch:

This update for ibus fixes the following issues:

Security issue fixed:

CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. (bsc#1150011)

Affected Packages

ibus

SUSE Enterprise Storage 4SUSE Enterprise Storage 5SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSS

Fixed in:

1.5.13-15.11.2

ibus-gtk

SUSE Enterprise Storage 4SUSE Enterprise Storage 5SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSS

Fixed in:

1.5.13-15.11.2

ibus-gtk3

SUSE Enterprise Storage 4SUSE Enterprise Storage 5SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSS

Fixed in:

1.5.13-15.11.2

ibus-lang

SUSE Enterprise Storage 4SUSE Enterprise Storage 5SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSS

Fixed in:

1.5.13-15.11.2

libibus-1_0-5

SUSE Enterprise Storage 4SUSE Enterprise Storage 5SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSS

Fixed in:

1.5.13-15.11.2

typelib-1_0-IBus-1_0

SUSE Enterprise Storage 4SUSE Enterprise Storage 5SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSS

Fixed in:

1.5.13-15.11.2

ibus-gtk3-32bit

SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Workstation Extension 12 SP4SUSE Linux Enterprise Workstation Extension 12 SP5

Fixed in:

1.5.13-15.11.2

libibus-1_0-5-32bit

SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Workstation Extension 12 SP4SUSE Linux Enterprise Workstation Extension 12 SP5

Fixed in:

1.5.13-15.11.2

python-ibus

SUSE Linux Enterprise Desktop 12 SP4SUSE Linux Enterprise Workstation Extension 12 SP4SUSE Linux Enterprise Workstation Extension 12 SP5

Fixed in:

1.5.13-15.11.2

ibus-devel

SUSE Linux Enterprise Software Development Kit 12 SP4SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

1.5.13-15.11.2

References

https://bugzilla.suse.com/1150011

https://lists.suse.com/pipermail/sle-security-updates/2019-September/005925.html

https://www.suse.com/security/cve/CVE-2019-14822/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2019/suse-su-20192389-1/

CVSS Analysis

CVSS v3.0

8.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

HighI:H

Availability

HighA:H

8.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Upstream

Ecosystems(20)

SUSE Enterprise Storage 4 SUSE Enterprise Storage 5 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS

Timeline

PublishedSep 17, 2019

ModifiedSep 17, 2019

SUSE-SU-2019:2389-1 | Mondoo Vulnerability Intelligence