openSUSE Security Update: Security update for spamassassin
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:1831-1
Rating:             moderate
References:         #1069831 #1107765 #1108745 #1108748 #1108749 
                    #1108750 #1115411 
Cross-References:   CVE-2016-1238 CVE-2017-15705 CVE-2018-11780
                    CVE-2018-11781
Affected Products:
                    openSUSE Leap 15.0
______________________________________________________________________________

   An update that solves four vulnerabilities and has three
   fixes is now available.

Description:

   This update for spamassassin to version 3.4.2 fixes the following issues:

   Security issues fixed:

   - CVE-2018-11781: Fixed an issue where a local user could inject code in
     the meta rule syntax (bsc#1108748).
   - CVE-2018-11780: Fixed a potential remote code execution vulnerability in
     the PDFInfo plugin (bsc#1108750).
   - CVE-2017-15705: Fixed a denial of service through unclosed tags in
     crafted emails (bsc#1108745).
   - CVE-2016-1238: Fixed an issue where perl would load modules from the
     current directory (bsc#1108749).

   Non-security issues fixed:

   - Use systemd timers instead of cron (bsc#1115411)
   - Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)
   - Fixed warning about deprecated regex during sa-update (bsc#1069831)

   This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.0:

      zypper in -t patch openSUSE-2019-1831=1



Package List:

   - openSUSE Leap 15.0 (x86_64):

      perl-Mail-SpamAssassin-3.4.2-lp150.6.3.1
      perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp150.6.3.1
      spamassassin-3.4.2-lp150.6.3.1
      spamassassin-debuginfo-3.4.2-lp150.6.3.1
      spamassassin-debugsource-3.4.2-lp150.6.3.1


References:

   https://www.suse.com/security/cve/CVE-2016-1238.html
   https://www.suse.com/security/cve/CVE-2017-15705.html
   https://www.suse.com/security/cve/CVE-2018-11780.html
   https://www.suse.com/security/cve/CVE-2018-11781.html
   https://bugzilla.suse.com/1069831
   https://bugzilla.suse.com/1107765
   https://bugzilla.suse.com/1108745
   https://bugzilla.suse.com/1108748
   https://bugzilla.suse.com/1108749
   https://bugzilla.suse.com/1108750
   https://bugzilla.suse.com/1115411

--