Security update for SLES 12-SP2 Docker image (important)

2017-10-11T03:08:09
ID SUSE-SU-2017:2701-1
Type suse
Reporter Suse
Modified 2017-10-11T03:08:09

Description

The SUSE Linux Enterprise Server 12 SP2 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

bash:

  • CVE-2016-9401

expat:

  • CVE-2012-6702
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

curl:

  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

glibc:

  • CVE-2017-1000366

openssl:

  • CVE-2017-3731
  • CVE-2017-3732
  • CVE-2016-7055

pam:

  • CVE-2015-3238

apparmor:

  • CVE-2017-6507

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libgcrypt:

  • CVE-2017-7526

libxml2:

  • CVE-2016-1839
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-0663
  • CVE-2017-5969
  • CVE-2017-7375
  • CVE-2017-7376
  • CVE-2017-8872
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libzypp:

  • CVE-2017-9269
  • CVE-2017-7435
  • CVE-2017-7436

openldap2:

  • CVE-2017-9287

systemd:

  • CVE-2016-10156
  • CVE-2017-9217
  • CVE-2017-9445

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

zypper:

  • CVE-2017-7436

Finally, the following packages received non-security fixes:

  • binutils
  • cpio
  • cryptsetup
  • cyrus-sasl
  • dbus-1
  • dirmngr
  • e2fsprogs
  • gpg2
  • insserv-compat
  • kmod
  • libsolv
  • libsemanage
  • lvm2
  • lua51
  • netcfg
  • procps
  • sed
  • sg3_utils
  • shadow