Security update for libu2f-host SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:0199-1 Final 1 1 2019-02-18T11:02:25Z current 2019-02-18T11:02:25Z 2019-02-18T11:02:25Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libu2f-host This update for libu2f-host fixes the following issues: Security issue fixed: - CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2019-02/msg00035.html E-Mail link for openSUSE-SU-2019:0199-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libu2f-host-1.0.0-5.3.1 libu2f-host-devel-1.0.0-5.3.1 libu2f-host-doc-1.0.0-5.3.1 libu2f-host0-1.0.0-5.3.1 u2f-host-1.0.0-5.3.1 libu2f-host-1.0.0-5.3.1 as a component of openSUSE Leap 42.3 libu2f-host-devel-1.0.0-5.3.1 as a component of openSUSE Leap 42.3 libu2f-host-doc-1.0.0-5.3.1 as a component of openSUSE Leap 42.3 libu2f-host0-1.0.0-5.3.1 as a component of openSUSE Leap 42.3 u2f-host-1.0.0-5.3.1 as a component of openSUSE Leap 42.3 Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey. CVE-2018-20340 openSUSE Leap 42.3:libu2f-host-1.0.0-5.3.1 openSUSE Leap 42.3:libu2f-host-devel-1.0.0-5.3.1 openSUSE Leap 42.3:libu2f-host-doc-1.0.0-5.3.1 openSUSE Leap 42.3:libu2f-host0-1.0.0-5.3.1 openSUSE Leap 42.3:u2f-host-1.0.0-5.3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2019-02/msg00035.html https://www.suse.com/security/cve/CVE-2018-20340.html CVE-2018-20340 https://bugzilla.suse.com/1124781 SUSE Bug 1124781