CVE-2018-17094

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11124. Reason: This candidate is a duplicate of CVE-2017-11124. Notes: All CVE users should reference CVE-2017-11124 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11124. Reason: This candidate is a duplicate of CVE-2017-11124. Notes: All CVE users should reference CVE-2017-11124 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11124. Reason: This candidate is a duplicate of CVE-2017-11124. Notes: All CVE users should reference CVE-2017-11124 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

These are all security issues fixed in the libxar-devel-1.8.0.0.503-1.1 package on the GA media of openSUSE Tumbleweed.

This update for xar fixes the following issues:

Changes in xar:

• Switch to the maintained Apple xar lineage (build 503, versioned 1.8.0.0.503): the mackyle 1.6.1 fork this package tracked has been dead since 2012, and Debian, Fedora and Gentoo all moved to Apple's xar (apple-oss-distributions/xar). This resolves the long-standing NULL-pointer dereferences in xar_get_path() and xar_unserialize() when parsing malformed archives:
  • CVE-2017-11124 (boo#1047875)
  • CVE-2017-11125 (boo#1047874)
  • CVE-2018-17093 (boo#1108595)
  • CVE-2018-17094 (boo#1108596)