[security-announce] SUSE-SU-2016:1459-1: important: Security update for cyrus-imapd

[news 28]

SUSE Security Update: Security update for cyrus-imapd

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2016:1459-1

Rating: important

References: #860611 #901748 #954200 #954201 #981670

Cross-References: CVE-2014-3566 CVE-2015-8076 CVE-2015-8077

CVE-2015-8078

Affected Products:

SUSE Linux Enterprise Software Development Kit 11-SP4

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP4

______________________________________________________________________________

 

An update that solves four vulnerabilities and has one

errata is now available.

 

Description:

 

 

This update for cyrus-imapd fixes the following issues:

 

- Previous versions of cyrus-imapd would not allow its users to disable

old SSL variants that are vulnerable to attacks like BEAST and POODLE.

This patch adds the configuration option 'tls_versions' to remedy that

issue. Note that users who upgrade an existing installation will *not*

have their imapd.conf file overwritten, i.e. their IMAP server will

continue to support SSLv2 and SSLv3 like before. To disable support for

those protocols, edit imapd.conf manually to include "tls_versions:

tls1_0 tls1_1 tls1_2". New installations, however, will have an

imapd.conf file that contains these settings already, i.e. newly

installed IMAP servers do *not* support unsafe versions of SSL unless

that support is explicitly enabled by the user. (bsc#901748)

 

- An integer overflow vulnerability in cyrus-imapd's urlfetch range

checking code was fixed. (CVE-2015-8076, CVE-2015-8077, CVE-2015-8078,

bsc#981670, bsc#954200, bsc#954201)

 

- Support for Elliptic Curve Diffie–Hellman (ECDH) has been added to

cyrus-imapd. (bsc#860611)

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Software Development Kit 11-SP4:

 

zypper in -t patch sdksp4-cyrus-imapd-12589=1

 

- SUSE Linux Enterprise Server 11-SP4:

 

zypper in -t patch slessp4-cyrus-imapd-12589=1

 

- SUSE Linux Enterprise Debuginfo 11-SP4:

 

zypper in -t patch dbgsp4-cyrus-imapd-12589=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

 

cyrus-imapd-devel-2.3.11-60.65.67.1

 

- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64):

 

perl-Cyrus-IMAP-2.3.11-60.65.67.1

perl-Cyrus-SIEVE-managesieve-2.3.11-60.65.67.1

 

- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

 

cyrus-imapd-2.3.11-60.65.67.1

perl-Cyrus-IMAP-2.3.11-60.65.67.1

perl-Cyrus-SIEVE-managesieve-2.3.11-60.65.67.1

 

- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

 

cyrus-imapd-debuginfo-2.3.11-60.65.67.1

cyrus-imapd-debugsource-2.3.11-60.65.67.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2014-3566.html

https://www.suse.com/security/cve/CVE-2015-8076.html

https://www.suse.com/security/cve/CVE-2015-8077.html

https://www.suse.com/security/cve/CVE-2015-8078.html

https://bugzilla.suse.com/860611

https://bugzilla.suse.com/901748

https://bugzilla.suse.com/954200

https://bugzilla.suse.com/954201

https://bugzilla.suse.com/981670

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org