openSUSE Security Update: Security update for shadowsocks-libev
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:2667-1
Rating:             moderate
References:         #1158251 #1158365 
Cross-References:   CVE-2019-5163 CVE-2019-5164
Affected Products:
                    openSUSE Leap 15.1
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for shadowsocks-libev fixes the following issues:

   - Update version to 3.3.3
     * Refine the handling of suspicious connections.
     * Fix exploitable denial-of-service vulnerability exists in the UDPRelay
       functionality (boo#1158251, CVE-2019-5163)
     * Fix code execution vulnerability in the ss-manager binary
       (boo#1158365, CVE-2019-5164)
     * Refine the handling of fragment request.
     * Fix a high CPU bug introduced in 3.3.0. (#2449)
     * Enlarge the socket buffer size to 16KB.
     * Fix the empty list bug in ss-manager.
     * Fix the IPv6 address parser.
     * Fix a bug of port parser.
     * Fix a crash with MinGW.
     * Refine SIP003 plugin interface.
     * Remove connection timeout from all clients.
     * Fix the alignment bug again.
     * Fix a bug on 32-bit arch.
     * Add TCP fast open support to ss-tunnel by @PantherJohn.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2019-2667=1



Package List:

   - openSUSE Leap 15.1 (x86_64):

      libshadowsocks-libev2-3.3.3-lp151.2.3.1
      libshadowsocks-libev2-debuginfo-3.3.3-lp151.2.3.1
      shadowsocks-libev-3.3.3-lp151.2.3.1
      shadowsocks-libev-debuginfo-3.3.3-lp151.2.3.1
      shadowsocks-libev-debugsource-3.3.3-lp151.2.3.1
      shadowsocks-libev-devel-3.3.3-lp151.2.3.1

   - openSUSE Leap 15.1 (noarch):

      shadowsocks-libev-doc-3.3.3-lp151.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2019-5163.html
   https://www.suse.com/security/cve/CVE-2019-5164.html
   https://bugzilla.suse.com/1158251
   https://bugzilla.suse.com/1158365

--

openSUSE: 2019:2667-1: moderate: shadowsocks-libev

December 11, 2019
An update that fixes two vulnerabilities is now available.

Description

This update for shadowsocks-libev fixes the following issues: - Update version to 3.3.3 * Refine the handling of suspicious connections. * Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163) * Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164) * Refine the handling of fragment request. * Fix a high CPU bug introduced in 3.3.0. (#2449) * Enlarge the socket buffer size to 16KB. * Fix the empty list bug in ss-manager. * Fix the IPv6 address parser. * Fix a bug of port parser. * Fix a crash with MinGW. * Refine SIP003 plugin interface. * Remove connection timeout from all clients. * Fix the alignment bug again. * Fix a bug on 32-bit arch. * Add TCP fast open support to ss-tunnel by @PantherJohn.

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2667=1


Package List

- openSUSE Leap 15.1 (x86_64): libshadowsocks-libev2-3.3.3-lp151.2.3.1 libshadowsocks-libev2-debuginfo-3.3.3-lp151.2.3.1 shadowsocks-libev-3.3.3-lp151.2.3.1 shadowsocks-libev-debuginfo-3.3.3-lp151.2.3.1 shadowsocks-libev-debugsource-3.3.3-lp151.2.3.1 shadowsocks-libev-devel-3.3.3-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): shadowsocks-libev-doc-3.3.3-lp151.2.3.1


References

https://www.suse.com/security/cve/CVE-2019-5163.html https://www.suse.com/security/cve/CVE-2019-5164.html https://bugzilla.suse.com/1158251 https://bugzilla.suse.com/1158365--


Severity
Announcement ID: openSUSE-SU-2019:2667-1
Rating: moderate
Affected Products: openSUSE Leap 15.1

Related News

28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
8.Locks HexConnections CodeGlobe Esm H320
2 - 3 min read
Canonical has launched Ubuntu Pro for Devices , a comprehensive offering emphasizing security and compliance for IoT device deployments. This
2.Motherboard Esm H320
2 - 3 min read
The recently uncovered "Native Branch History Injection (BHI)" exploit against the Linux kernel marks a significant milestone in the ongoing battle
1.Penguin Landscape Esm H320
1 - 2 min read
There are compelling arguments in favor of Linux over Windows for desktop usage. Let's explore some advantages of choosing Linux over Windows for
4.Lock AbstractDigital Esm H320
2 - 3 min read
Canonical , the company behind Ubuntu , has introduced Netplan 1.0 , a network configuration tool that simplifies networking configuration on Linux

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved