CVE-2018-20534

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application

This update for libzypp and libsolv fixes the following issues:

Security issues fixed:

• CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c (function testcase_read) (bsc#1120629).
• CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a (bsc#1120630).
• CVE-2018-20534: Fixed illegal address access at src/pool.h (function pool_whatprovides) in libsolv.a (bsc#1120631).

Fixed bugs and enhancements:

• make cleandeps jobs on patterns work (bnc#1137977)
• Fixed an issue where libsolv failed to build against swig 4.0 by updating the version to 0.7.5 (bsc#1135749).
• Virtualization host upgrade from SLES-15 to SLES-15-SP1 finished with wrong product name shown up (bsc#1131823).
• Copy pattern categories from the rpm that defines the pattern (fate#323785).
• Enhance scanning /sys for modaliases (bsc#1130161).
• Prevent SEGV if the application sets an empty TextLocale (bsc#1127026).
• Handle libgpgme error when gpg key is not completely read and user hits CTRL + C (bsc#1127220).
• Added a hint when registration codes have expired (bsc#965786).
• Adds a better handling of an error when verifying any repository medium (bsc#1065022).
• Will now only write type field when probing (bsc#1114908).
• Fixes an issue where zypper has showed the info message 'Installation aborted by user' while the installation was aborted by wicked (bsc#978193).
• Suppresses reporting /memfd: pseudo files (bsc#1123843).
• Fixes an issue where zypper was not able to install or uninstall packages when rpm is unavailable (bsc#1122471).
• Fixes an issue where locks were ignored (bsc#1113296).
• Simplify complex locks so zypper can display them (bsc#1112911).
• zypper will now set SYSTEMD_OFFLINE=1 during chrooted commits (bsc#1118758).
• no-recommends: Nevertheless consider resolver namespaces (hardware, language,..supporting packages) (fate#325513).
• Removes world-readable bit from /var/log/zypp (bsc#1099019).
• Does no longer fail service-refresh on a empty repoindex.xml (bsc#1116840).
• Fixes soname due to libsolv ABI changes (bsc#1115341).
• Add infrastructure to flag specific packages to trigger a reboot needed hint (fate#326451).

This update for zypper 1.14.27 fixes the following issues:

• bash-completion: add package completion for addlock (bsc#1047962)

• bash-completion: fix incorrect detection of command names (bsc#1049826)

• Offer to change the 'runSearchPackages' config option at the prompt (bsc#1119373, FATE#325599)

• Prompt: provide a 'yes/no/always/never' prompt.

• Prompt: support '#NUM' as answer to select the NUMth option...

• Augeas: enable writing back changed option values (to ~/.zypper.conf)

• removelocale: fix segfault

• Move needs-restarting command to subpackage (fixes #254)

• Allow empty string as argument (bsc#1125415)

• Provide a way to delete cache for volatile repositories (bsc#1053177)

• Adapt to boost-1.69 requiring explicit casts tribool->bool (fixes #255)

• Show support status in info if not unknown (bsc#764147)

• Fix installing plain rpm files with zypper in (bsc#1124897)

• Show only required info in the summary in quiet mode (bsc#993025)

• Stay with legacy behavior and return ZYPPER_EXIT_INF_REBOOT_NEEDED only for patches. We don't extend this return code to packages, although they may also carry the 'reboot-needed' attribute. The preferred way to test whether the system needs to be rebooted is zypper needs-rebooting. (openSUSE/zypper#237)

• Skip repository on error (bsc#1123967)

• New commands for locale management: locales addlocale removelocale Inspect and manipulate the systems requested locales, aka. the languages software packages should try support by installing translations, dictionaries and tools, as far as they are available.

• Don't throw, just warn if options are repeated (bsc#1123865)

• Fix detection whether stdout is a tty (happened too late)

• Fix broken --plus-content switch (fixes bsc#1123681)

• Fix…

This update for libzypp, zypper, libsolv and PackageKit fixes the following issues:

Security issues fixed in libsolv:

• CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c (function testcase_read) (bsc#1120629).
• CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a (bsc#1120630).
• CVE-2018-20534: Fixed illegal address access at src/pool.h (function pool_whatprovides) in libsolv.a (bsc#1120631).

Other issues addressed in libsolv:

• Fixed an issue where libsolv failed to build against swig 4.0 by updating the version to 0.7.5 (bsc#1135749).
• Fixed an issue with the package name (bsc#1131823).
• repo_add_rpmdb: do not copy bad solvables from the old solv file
• Fixed an issue with cleandeps updates in which all packages were not updated
• Experimental DISTTYPE_CONDA and REL_CONDA support
• Fixed cleandeps jobs when using patterns (bsc#1137977)
• Fixed favorq leaking between solver runs if the solver is reused
• Fixed SOLVER_FLAG_FOCUS_BEST updateing packages without reason
• Be more correct with multiversion packages that obsolete their own name (bnc#1127155)
• Fix repository priority handling for multiversion packages
• Make code compatible with swig 4.0, remove obj0 instances
• repo2solv: support zchunk compressed data
• Remove NO_BRP_STRIP_DEBUG=true as brp-15-strip-debug will not strip debug info for archives

Issues fixed in libzypp:

• Fix empty metalink downloads if filesize is unknown (bsc#1153557)
• Recognize riscv64 as architecture
• Fix installation of new header file (fixes #185)
• zypp.conf: Introduce solver.focus to define the resolvers general attitude when resolving jobs. (bsc#1146415)
• New container detection algorithm for zypper ps (bsc#1146947)
• Fix leaking filedescriptors in MediaCurl. (bsc#1116995)
• Run file conflict check on dry-run. (bsc#1140039)
• Do not remove orphan products if the .prod file is owned by a package. (bsc#1139795)
• Rephrase file conflict check summary. (bsc#1140039)
• Fix bash completions option detection. (bsc#1049825)
• Fixes a bug where zypper exited on SIGPIPE when downloading packages (bsc#1145521)
• Fixes an issue where zypper exited with a segmentation fault when updating via YaST2 (bsc#1146027)
• PublicKey::algoName: supply key algorithm and length

Issues fixed in zypper:

• Update to version 1.14.30
• Ignore SIGPIPE while STDOUT/STDERR are OK (bsc#1145521)
• Dump stacktrace on SIGPIPE (bsc#1145521)
• info: The requested info must be shown in QUIET mode (fixes #287)
• Fix local/remote url classification.
• Rephrase file conflict check summary (bsc#1140039)
• Fix bash completions option detection (bsc#1049825)
• man: split '--with[out]' like options to ease searching.
• Unhided 'ps' command in help
• Added option to show more conflict information
• Rephrased zypper ps hint (bsc#859480)
• Fixed repo refresh not returning 106-ZYPPER_EXIT_INF_REPOS_SKIPPED if --root is used (bsc#1134226)
• Fixed unknown package handling in zypper install (bsc#1127608)
• Re-show progress bar after pressing retry upon install error (bsc#1131113)

Issues fixed in PackageKit:

• Port the cron configuration variables to the systemd timer script, and add -sendwait parameter to mail in the script(bsc#1130306).

This update for libsolv, libzypp and zypper fixes the following issues:

libsolv was updated to version 0.6.36 fixes the following issues:

Security issues fixed:

• CVE-2018-20532: Fixed a NULL pointer dereference in testcase_read() (bsc#1120629).
• CVE-2018-20533: Fixed a NULL pointer dereference in testcase_str2dep_complex() (bsc#1120630).
• CVE-2018-20534: Fixed a NULL pointer dereference in pool_whatprovides() (bsc#1120631).

Non-security issues fixed:

• Made cleandeps jobs on patterns work (bsc#1137977).
• Fixed an issue multiversion packages that obsolete their own name (bsc#1127155).
• Keep consistent package name if there are multiple alternatives (bsc#1131823).

libzypp received following fixes:

• Fixes a bug where locking the kernel was not possible (bsc#1113296)

zypper received following fixes:

• Fixes a bug where the wrong exit code was set when refreshing repos if --root was used (bsc#1134226)
• Improved the displaying of locks (bsc#1112911)
• Fixes an issue where https repository urls caused an error prompt to appear twice (bsc#1110542)
• zypper will now always warn when no repositories are defined (bsc#1109893)

This update for libzypp and libsolv fixes the following issues:

Security issues fixed:

• CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c (function testcase_read) (bsc#1120629).
• CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a (bsc#1120630).
• CVE-2018-20534: Fixed illegal address access at src/pool.h (function pool_whatprovides) in libsolv.a (bsc#1120631).

Fixed bugs and enhancements:

• make cleandeps jobs on patterns work (bnc#1137977)
• Fixed an issue where libsolv failed to build against swig 4.0 by updating the version to 0.7.5 (bsc#1135749).
• Virtualization host upgrade from SLES-15 to SLES-15-SP1 finished with wrong product name shown up (bsc#1131823).
• Copy pattern categories from the rpm that defines the pattern (fate#323785).
• Enhance scanning /sys for modaliases (bsc#1130161).
• Prevent SEGV if the application sets an empty TextLocale (bsc#1127026).
• Handle libgpgme error when gpg key is not completely read and user hits CTRL + C (bsc#1127220).
• Added a hint when registration codes have expired (bsc#965786).
• Adds a better handling of an error when verifying any repository medium (bsc#1065022).
• Will now only write type field when probing (bsc#1114908).
• Fixes an issue where zypper has showed the info message 'Installation aborted by user' while the installation was aborted by wicked (bsc#978193).
• Suppresses reporting /memfd: pseudo files (bsc#1123843).
• Fixes an issue where zypper was not able to install or uninstall packages when rpm is unavailable (bsc#1122471).
• Fixes an issue where locks were ignored (bsc#1113296).
• Simplify complex locks so zypper can display them (bsc#1112911).
• zypper will now set SYSTEMD_OFFLINE=1 during chrooted commits (bsc#1118758).
• no-recommends: Nevertheless consider resolver namespaces (hardware, language,..supporting packages) (fate#325513).
• Removes world-readable bit from /var/log/zypp (bsc#1099019).
• Does no longer fail service-refresh on a empty repoindex.xml (bsc#1116840).
• Fixes soname due to libsolv ABI changes (bsc#1115341).
• Add infrastructure to flag specific packages to trigger a reboot needed hint (fate#326451).

This update for zypper 1.14.27 fixes the following issues:

• bash-completion: add package completion for addlock (bsc#1047962)

• bash-completion: fix incorrect detection of command names (bsc#1049826)

• Offer to change the 'runSearchPackages' config option at the prompt (bsc#1119373, FATE#325599)

• Prompt: provide a 'yes/no/always/never' prompt.

• Prompt: support '#NUM' as answer to select the NUMth option...

• Augeas: enable writing back changed option values (to ~/.zypper.conf)

• removelocale: fix segfault

• Move needs-restarting command to subpackage (fixes #254)

• Allow empty string as argument (bsc#1125415)

• Provide a way to delete cache for volatile repositories (bsc#1053177)

• Adapt to boost-1.69 requiring explicit casts tribool->bool (fixes #255)

• Show support status in info if not unknown (bsc#764147)

• Fix installing plain rpm files with zypper in (bsc#1124897)

• Show only required info in the summary in quiet mode (bsc#993025)

• Stay with legacy behavior and return ZYPPER_EXIT_INF_REBOOT_NEEDED only for patches. We don't extend this return code to packages, although they may also carry the 'reboot-needed' attribute. The preferred way to test whether the system needs to be rebooted is zypper needs-rebooting. (openSUSE/zypper#237)

• Skip repository on error (bsc#1123967)

• New commands for locale management: locales addlocale removelocale Inspect and manipulate the systems requested locales, aka. the languages software packages should try support by installing translations, dictionaries and tools, as far as they are available.

• Don't throw, just warn if options are repeated (bsc#1123865)

• Fix detection whether stdout is a tty (happened too late)

• Fix broken --plus-content switch (fixes bsc#1123681)

• Fix…

This update for libsolv, libzypp and zypper fixes the following issues:

libsolv was updated to version 0.6.36 and fixes the following issues:

Security issues fixed:

• CVE-2018-20532: Fixed a NULL pointer dereference in testcase_read() (bsc#1120629).
• CVE-2018-20533: Fixed a NULL pointer dereference in testcase_str2dep_complex() (bsc#1120630).
• CVE-2018-20534: Fixed a NULL pointer dereference in pool_whatprovides() (bsc#1120631).

Non-security issues fixed:

• Made cleandeps jobs on patterns work (bsc#1137977).
• Fixed an issue multiversion packages that obsolete their own name (bsc#1127155).
• Keep consistent package name if there are multiple alternatives (bsc#1131823).

Fixes for libzypp:

• Fixes a bug where locking the kernel was not possible (bsc#1113296)
• Fixes a file descriptor leak (bsc#1116995)
• Will now run file conflict check on dry-run (best with download-only) (bsc#1140039)

Fixes for zypper:

• Fixes a bug where the wrong exit code was set when refreshing repos if --root was used (bsc#1134226)
• Improved the displaying of locks (bsc#1112911)
• Fixes an issue where https repository urls caused an error prompt to appear twice (bsc#1110542)
• zypper will now always warn when no repositories are defined (bsc#1109893)
• Fixes bash completion option detection (bsc#1049825)

This update for libsolv fixes the following issues:

This is a reissue of an existing libsolv update that also included libsolv-devel for LTSS products.

libsolv was updated to version 0.6.36 fixes the following issues:

Security issues fixed:

• CVE-2018-20532: Fixed a NULL pointer dereference in testcase_read() (bsc#1120629).
• CVE-2018-20533: Fixed a NULL pointer dereference in testcase_str2dep_complex() (bsc#1120630).
• CVE-2018-20534: Fixed a NULL pointer dereference in pool_whatprovides() (bsc#1120631).

Non-security issues fixed:

• Made cleandeps jobs on patterns work (bsc#1137977).
• Fixed an issue multiversion packages that obsolete their own name (bsc#1127155).
• Keep consistent package name if there are multiple alternatives (bsc#1131823).

It was discovered that Libsolv incorrectly handled certain malformed input. An attacker could use this issue to cause Libsolv to crash, resulting in a denial of service.