SUSE-SU-2022:1158-1

HIGH8.4

Security update for xz

Published Apr 12, 2022

Modified 4 years ago

Fix available

Details

Description of the patch:

This update for xz fixes the following issues:

CVE-2022-1271: Fixed an incorrect escaping of malicious filenames (ZDI-CAN-16587). (bsc#1198062)

Affected Packages

liblzma5

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

5.2.3-150000.4.7.1

liblzma5-32bit

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

5.2.3-150000.4.7.1

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

5.2.3-150000.4.7.1

xz-devel

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

5.2.3-150000.4.7.1

xz-lang

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

5.2.3-150000.4.7.1

xz-static-devel

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

5.2.3-150000.4.7.1

xz-devel-32bit

openSUSE Leap 15.3

Fixed in:

5.2.3-150000.4.7.1

References

ADVISORY

https://bugzilla.suse.com/1198062

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2022-April/010686.html

ADVISORY