shield Security update for libmicrohttpd

SUSE-SLE-SDK-12-SP2-2017-966

This update for libmicrohttpd fixes the following issues: - CVE-2013-7038: The MHD_http_unescape function in libmicrohttpd might have allowed remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read. (bsc#854443) - CVE-2013-7039: Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header. (bsc#854443) - Fixed various bugs found during a 2017 audit, which are more hardening measures and not security issues. (bsc#1041216)

• Release Date
  Jun 16 2017
• References
  Bugzilla: 1041216, 854443
  CVEs: CVE-2013-7038, CVE-2013-7039
• Type
  security
• Severity
  moderate

cloud_download Downloads

SUSE Linux Enterprise Software Development Kit 12.2 ppc64le

• Packages
  libmicrohttpd
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock src

  libmicrohttpd-devel
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock rpm

SUSE Linux Enterprise Software Development Kit 12.2 x86_64

• Packages
  libmicrohttpd
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock src

  libmicrohttpd-devel
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock rpm

SUSE Linux Enterprise Software Development Kit 12.2 s390x

• Packages
  libmicrohttpd
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock src

  libmicrohttpd-devel
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock rpm

SUSE Linux Enterprise Software Development Kit 12.2 aarch64

• Packages
  libmicrohttpd
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock src

  libmicrohttpd-devel
  Small Embeddable HTTP Server Library

  0.9.30-5.1 lock rpm