<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for CaaS Platform 1.0 images</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2017:2470-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-09-14T13:24:48Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-09-14T13:24:48Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-09-14T13:24:48Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for CaaS Platform 1.0 images</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">The Docker images provided with SUSE CaaS Platform 1.0 have been updated to
include the following updates:

libzypp:

- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned
  repositories and packages. (bsc#1045735, bsc#1038984)
- Fix gpg-pubkey release (creation time) computation. (bsc#1036659)
- Update lsof blacklist. (bsc#1046417)
- Re-probe on refresh if the repository type changes. (bsc#1048315)
- Propagate proper error code to DownloadProgressReport. (bsc#1047785)
- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
- Support custom repo variables defined in /etc/zypp/vars.d.
- Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)
- Fix potential crash if repository has no baseurl. (bsc#1043218)

zypper:

- CVE-2017-7436: Adapt download callback to report and handle unsigned packages. (bsc#1038984)
- Report missing/optional files as 'not found' rather than 'error'. (bsc#1047785)
- Document support for custom repository variables defined in /etc/zypp/vars.d.
- Emphasize that it depends on how fast PackageKit will respond to a 'quit' request sent
  if PK blocks package management.

libgcrypt:

- Fix infinite loop in gnome-keyring-daemon caused by attempt to read from random device
  left open by libgcrypt. (bsc#1043333)
- Avoid seeding the DRBG during FIPS power-up selftests. (bsc#1046659)
- Fix a bug in gcry_drbg_healthcheck_sanity() which caused skipping some of the tests. (bsc#1046659)
- dlsym returns PLT address on s390x, dlopen libgcrypt20.so before calling dlsym. (bsc#1047008)

lua51:

- Add Lua(API) and Lua(devel) symbols to fix building of lua51-luasocket. (bsc#1051626)

cyrus-sasl:

- Fix unknown authentication mechanism: kerberos5 (bsc#1026825)
- Really use SASLAUTHD_PARAMS variable (bsc#938657)
- Make sure /usr/sbin/rcsaslauthd exists   
- Add /usr/sbin/rcsaslauthd symbolic link to /usr/sbin/service (bsc#1014471)
- Silence 'GSSAPI client step 1' debug log message (bsc#1044840)

libxml2:

- CVE-2017-8872: Out-of-bounds read in htmlParseTryOrFinish. (bsc#1038444)

curl:

- CVE-2017-1000100: TFP sends more than buffer size and it could lead to a denial of service. (bsc#1051644)
- CVE-2017-1000101: URL globbing out of bounds read could lead to a denial of service. (bsc#1051643)

ncurses:

- CVE-2017-11112: Illegal address access in append_acs. (bsc#1047964)
- CVE-2017-11113: Dereferencing NULL pointer in _nc_parse_entry. (bsc#1047965)
- CVE-2017-10684, CVE-2017-10685: Add modified upstream fix from ncurses 6.0 to avoid broken
  termcap format (bsc#1046853, bsc#1046858, bsc#1049344)

sed:

- Don't terminate with a segmentation fault if close of last file descriptor fails. (bsc#954661)

openssl:

- Remove DES-CBC3-SHA based ciphers from DEFAULT_SUSE to address SWEET32 problem. (bsc#1027908)
- Use getrandom syscall instead of reading from /dev/urandom to get at least 128 bits of
  entropy to comply with FIPS 140.2 IG 7.14. (bsc#1027079 bsc#1044175)
- Fix x86 extended feature detection (bsc#1029523)
- Allow runtime switching of s390x capabilities via the 'OPENSSL_s390xcap' environmental
  variable. (bsc#1028723)
- Add back certificate initialization set_cert_key_stuff() which was removed in a previous update.
  (bsc#1028281)
- Fix a bug in XTS key handling. (bsc#1019637)
- Don't run FIPS power-up self-tests when the checksum files aren't installed. (bsc#1042392)

procps:

- Don't set buffering on invalid file descriptor. (bsc#1053409)

expat:

- CVE-2016-9063: Possible integer overflow to fix inside XML_Parse leading to unexpected behaviour. (bsc#1047240)
- CVE-2017-9233: External Entity Vulnerability could lead to denial of service. (bsc#1047236)

systemd:

- Revert fix for bsc#1004995 which could have caused boot failure on LVM (bsc#1048605)
- compat-rules: drop the bogus 'import everything' rule (bsc#1046268)
- core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (bsc#1045384 bsc#1047379)
- udev/path_id: introduce support for NVMe devices (bsc#1045987)
- compat-rules: Don't rely on ID_SERIAL when generating 'by-id' links for NVMe devices. (bsc#1048679)
- fstab-generator: Handle NFS 'bg' mounts correctly. (bsc#874665, fate#323464)
- timesyncd: Don't use compiled-in list if FallbackNTP has been configured explicitly.

insserv-compat:

- Add /etc/init.d hierarchy from former 'filesystem' package. (bsc#1035062)
- Fix directory argument parsing. (bsc#944903)
- Add perl(Getopt::Long) to list of requirements.

mariadb:

- Update libmysqlclient18 from version 10.0.30 to 10.0.31.

python-pycrypto:

- CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420).

velum:

- Fix loopback IP for proxy exception during initial configuration. (bsc#1052759)
- Set secure flag in cookie. (bsc#1050484)
- Set VERSION to 1.0.0. (bsc#1050396)
- Allow kubeconfig download when master is ready. (bsc#1048483)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      <Description>Link for SUSE-SU-2017:2470-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-security-announce/2017-09/msg00047.html</URL>
      <Description>E-Mail link for SUSE-SU-2017:2470-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1004995</URL>
      <Description>SUSE Bug 1004995</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1009745</URL>
      <Description>SUSE Bug 1009745</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1014471</URL>
      <Description>SUSE Bug 1014471</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1017420</URL>
      <Description>SUSE Bug 1017420</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1019637</URL>
      <Description>SUSE Bug 1019637</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1026825</URL>
      <Description>SUSE Bug 1026825</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027079</URL>
      <Description>SUSE Bug 1027079</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027688</URL>
      <Description>SUSE Bug 1027688</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027908</URL>
      <Description>SUSE Bug 1027908</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1028281</URL>
      <Description>SUSE Bug 1028281</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1028723</URL>
      <Description>SUSE Bug 1028723</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1029523</URL>
      <Description>SUSE Bug 1029523</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1031756</URL>
      <Description>SUSE Bug 1031756</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1032706</URL>
      <Description>SUSE Bug 1032706</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1033236</URL>
      <Description>SUSE Bug 1033236</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1035062</URL>
      <Description>SUSE Bug 1035062</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1036659</URL>
      <Description>SUSE Bug 1036659</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1038132</URL>
      <Description>SUSE Bug 1038132</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1038444</URL>
      <Description>SUSE Bug 1038444</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1038984</URL>
      <Description>SUSE Bug 1038984</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1042392</URL>
      <Description>SUSE Bug 1042392</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1043218</URL>
      <Description>SUSE Bug 1043218</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1043333</URL>
      <Description>SUSE Bug 1043333</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1044095</URL>
      <Description>SUSE Bug 1044095</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1044107</URL>
      <Description>SUSE Bug 1044107</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1044175</URL>
      <Description>SUSE Bug 1044175</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1044840</URL>
      <Description>SUSE Bug 1044840</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1045384</URL>
      <Description>SUSE Bug 1045384</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1045735</URL>
      <Description>SUSE Bug 1045735</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1045987</URL>
      <Description>SUSE Bug 1045987</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1046268</URL>
      <Description>SUSE Bug 1046268</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1046417</URL>
      <Description>SUSE Bug 1046417</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1046659</URL>
      <Description>SUSE Bug 1046659</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1046853</URL>
      <Description>SUSE Bug 1046853</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1046858</URL>
      <Description>SUSE Bug 1046858</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047008</URL>
      <Description>SUSE Bug 1047008</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047236</URL>
      <Description>SUSE Bug 1047236</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047240</URL>
      <Description>SUSE Bug 1047240</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047310</URL>
      <Description>SUSE Bug 1047310</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047379</URL>
      <Description>SUSE Bug 1047379</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047785</URL>
      <Description>SUSE Bug 1047785</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047964</URL>
      <Description>SUSE Bug 1047964</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047965</URL>
      <Description>SUSE Bug 1047965</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1048315</URL>
      <Description>SUSE Bug 1048315</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1048483</URL>
      <Description>SUSE Bug 1048483</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1048605</URL>
      <Description>SUSE Bug 1048605</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1048679</URL>
      <Description>SUSE Bug 1048679</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1048715</URL>
      <Description>SUSE Bug 1048715</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1049344</URL>
      <Description>SUSE Bug 1049344</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1050396</URL>
      <Description>SUSE Bug 1050396</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1050484</URL>
      <Description>SUSE Bug 1050484</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1051626</URL>
      <Description>SUSE Bug 1051626</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1051643</URL>
      <Description>SUSE Bug 1051643</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1051644</URL>
      <Description>SUSE Bug 1051644</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1052030</URL>
      <Description>SUSE Bug 1052030</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1052759</URL>
      <Description>SUSE Bug 1052759</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1053409</URL>
      <Description>SUSE Bug 1053409</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/874665</URL>
      <Description>SUSE Bug 874665</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/902364</URL>
      <Description>SUSE Bug 902364</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/938657</URL>
      <Description>SUSE Bug 938657</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/944903</URL>
      <Description>SUSE Bug 944903</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/954661</URL>
      <Description>SUSE Bug 954661</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/960820</URL>
      <Description>SUSE Bug 960820</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/963041</URL>
      <Description>SUSE Bug 963041</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2013-7459/</URL>
      <Description>SUSE CVE CVE-2013-7459 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-9063/</URL>
      <Description>SUSE CVE CVE-2016-9063 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-1000100/</URL>
      <Description>SUSE CVE CVE-2017-1000100 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-1000101/</URL>
      <Description>SUSE CVE CVE-2017-1000101 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-10684/</URL>
      <Description>SUSE CVE CVE-2017-10684 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-10685/</URL>
      <Description>SUSE CVE CVE-2017-10685 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-11112/</URL>
      <Description>SUSE CVE CVE-2017-11112 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-11113/</URL>
      <Description>SUSE CVE CVE-2017-11113 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-3308/</URL>
      <Description>SUSE CVE CVE-2017-3308 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-3309/</URL>
      <Description>SUSE CVE CVE-2017-3309 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-3453/</URL>
      <Description>SUSE CVE CVE-2017-3453 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-3456/</URL>
      <Description>SUSE CVE CVE-2017-3456 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-3464/</URL>
      <Description>SUSE CVE CVE-2017-3464 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-7435/</URL>
      <Description>SUSE CVE CVE-2017-7435 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-7436/</URL>
      <Description>SUSE CVE CVE-2017-7436 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-8872/</URL>
      <Description>SUSE CVE CVE-2017-8872 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-9233/</URL>
      <Description>SUSE CVE CVE-2017-9233 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-9269/</URL>
      <Description>SUSE CVE CVE-2017-9269 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE CaaS Platform ALL">
      <Branch Type="Product Name" Name="SUSE CaaS Platform ALL">
        <FullProductName ProductID="SUSE CaaS Platform ALL">SUSE CaaS Platform ALL</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3">
      <FullProductName ProductID="caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3">caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3">
      <FullProductName ProductID="container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3">container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-mariadb-docker-image-1.1.0-2.3.10">
      <FullProductName ProductID="sles12-mariadb-docker-image-1.1.0-2.3.10">sles12-mariadb-docker-image-1.1.0-2.3.10</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-pause-docker-image-1.1.0-2.3.11">
      <FullProductName ProductID="sles12-pause-docker-image-1.1.0-2.3.11">sles12-pause-docker-image-1.1.0-2.3.11</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-pv-recycler-node-docker-image-1.1.0-2.3.10">
      <FullProductName ProductID="sles12-pv-recycler-node-docker-image-1.1.0-2.3.10">sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-salt-api-docker-image-1.1.0-2.3.9">
      <FullProductName ProductID="sles12-salt-api-docker-image-1.1.0-2.3.9">sles12-salt-api-docker-image-1.1.0-2.3.9</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-salt-master-docker-image-1.1.0-4.3.10">
      <FullProductName ProductID="sles12-salt-master-docker-image-1.1.0-4.3.10">sles12-salt-master-docker-image-1.1.0-4.3.10</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-salt-minion-docker-image-1.1.0-2.3.8">
      <FullProductName ProductID="sles12-salt-minion-docker-image-1.1.0-2.3.8">sles12-salt-minion-docker-image-1.1.0-2.3.8</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="sles12-velum-docker-image-1.1.0-4.3.9">
      <FullProductName ProductID="sles12-velum-docker-image-1.1.0-4.3.9">sles12-velum-docker-image-1.1.0-4.3.9</FullProductName>
    </Branch>
    <Relationship ProductReference="caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3">caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3">container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-mariadb-docker-image-1.1.0-2.3.10" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10">sles12-mariadb-docker-image-1.1.0-2.3.10 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-pause-docker-image-1.1.0-2.3.11" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11">sles12-pause-docker-image-1.1.0-2.3.11 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-pv-recycler-node-docker-image-1.1.0-2.3.10" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10">sles12-pv-recycler-node-docker-image-1.1.0-2.3.10 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-salt-api-docker-image-1.1.0-2.3.9" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9">sles12-salt-api-docker-image-1.1.0-2.3.9 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-salt-master-docker-image-1.1.0-4.3.10" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10">sles12-salt-master-docker-image-1.1.0-4.3.10 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-salt-minion-docker-image-1.1.0-2.3.8" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8">sles12-salt-minion-docker-image-1.1.0-2.3.8 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
    <Relationship ProductReference="sles12-velum-docker-image-1.1.0-4.3.9" RelationType="Default Component Of" RelatesToProductReference="SUSE CaaS Platform ALL">
      <FullProductName ProductID="SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9">sles12-velum-docker-image-1.1.0-4.3.9 as a component of SUSE CaaS Platform ALL</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.</Note>
    </Notes>
    <CVE>CVE-2013-7459</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2013-7459.html</URL>
        <Description>CVE-2013-7459</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1017420</URL>
        <Description>SUSE Bug 1017420</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1047666</URL>
        <Description>SUSE Bug 1047666</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1087140</URL>
        <Description>SUSE Bug 1087140</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox &lt; 50.</Note>
    </Notes>
    <CVE>CVE-2016-9063</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-9063.html</URL>
        <Description>CVE-2016-9063</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1009026</URL>
        <Description>SUSE Bug 1009026</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1010424</URL>
        <Description>SUSE Bug 1010424</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1047240</URL>
        <Description>SUSE Bug 1047240</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1123115</URL>
        <Description>SUSE Bug 1123115</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.</Note>
    </Notes>
    <CVE>CVE-2017-1000100</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.5</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-1000100.html</URL>
        <Description>CVE-2017-1000100</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1051644</URL>
        <Description>SUSE Bug 1051644</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.</Note>
    </Notes>
    <CVE>CVE-2017-1000101</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-1000101.html</URL>
        <Description>CVE-2017-1000101</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1051643</URL>
        <Description>SUSE Bug 1051643</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.</Note>
    </Notes>
    <CVE>CVE-2017-10684</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.6</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-10684.html</URL>
        <Description>CVE-2017-10684</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1046858</URL>
        <Description>SUSE Bug 1046858</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1115932</URL>
        <Description>SUSE Bug 1115932</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1175501</URL>
        <Description>SUSE Bug 1175501</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.</Note>
    </Notes>
    <CVE>CVE-2017-10685</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.6</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-10685.html</URL>
        <Description>CVE-2017-10685</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1046853</URL>
        <Description>SUSE Bug 1046853</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1115932</URL>
        <Description>SUSE Bug 1115932</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1175501</URL>
        <Description>SUSE Bug 1175501</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.</Note>
    </Notes>
    <CVE>CVE-2017-11112</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.1</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-11112.html</URL>
        <Description>CVE-2017-11112</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1046853</URL>
        <Description>SUSE Bug 1046853</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1047964</URL>
        <Description>SUSE Bug 1047964</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1175501</URL>
        <Description>SUSE Bug 1175501</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="8">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.</Note>
    </Notes>
    <CVE>CVE-2017-11113</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.1</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-11113.html</URL>
        <Description>CVE-2017-11113</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1046853</URL>
        <Description>SUSE Bug 1046853</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1047965</URL>
        <Description>SUSE Bug 1047965</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1175501</URL>
        <Description>SUSE Bug 1175501</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="9">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2017-3308</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-3308.html</URL>
        <Description>CVE-2017-3308</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1034850</URL>
        <Description>SUSE Bug 1034850</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1048715</URL>
        <Description>SUSE Bug 1048715</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="10">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2017-3309</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-3309.html</URL>
        <Description>CVE-2017-3309</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1034850</URL>
        <Description>SUSE Bug 1034850</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1048715</URL>
        <Description>SUSE Bug 1048715</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="11">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2017-3453</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-3453.html</URL>
        <Description>CVE-2017-3453</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1034850</URL>
        <Description>SUSE Bug 1034850</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1048715</URL>
        <Description>SUSE Bug 1048715</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="12">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).</Note>
    </Notes>
    <CVE>CVE-2017-3456</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-3456.html</URL>
        <Description>CVE-2017-3456</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1034850</URL>
        <Description>SUSE Bug 1034850</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1048715</URL>
        <Description>SUSE Bug 1048715</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="13">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).</Note>
    </Notes>
    <CVE>CVE-2017-3464</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:S/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-3464.html</URL>
        <Description>CVE-2017-3464</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1034850</URL>
        <Description>SUSE Bug 1034850</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1048715</URL>
        <Description>SUSE Bug 1048715</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="14">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.</Note>
    </Notes>
    <CVE>CVE-2017-7435</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7435.html</URL>
        <Description>CVE-2017-7435</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1009127</URL>
        <Description>SUSE Bug 1009127</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1038984</URL>
        <Description>SUSE Bug 1038984</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1045735</URL>
        <Description>SUSE Bug 1045735</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="15">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.</Note>
    </Notes>
    <CVE>CVE-2017-7436</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7436.html</URL>
        <Description>CVE-2017-7436</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1008325</URL>
        <Description>SUSE Bug 1008325</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1009127</URL>
        <Description>SUSE Bug 1009127</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1038984</URL>
        <Description>SUSE Bug 1038984</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1045735</URL>
        <Description>SUSE Bug 1045735</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="16">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.</Note>
    </Notes>
    <CVE>CVE-2017-8872</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.9</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.4</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-8872.html</URL>
        <Description>CVE-2017-8872</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1038444</URL>
        <Description>SUSE Bug 1038444</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1123919</URL>
        <Description>SUSE Bug 1123919</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="17">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.</Note>
    </Notes>
    <CVE>CVE-2017-9233</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-9233.html</URL>
        <Description>CVE-2017-9233</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1030296</URL>
        <Description>SUSE Bug 1030296</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1047236</URL>
        <Description>SUSE Bug 1047236</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1073350</URL>
        <Description>SUSE Bug 1073350</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1123115</URL>
        <Description>SUSE Bug 1123115</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/983216</URL>
        <Description>SUSE Bug 983216</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="18">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.</Note>
    </Notes>
    <CVE>CVE-2017-9269</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE CaaS Platform ALL:caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-mariadb-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pause-docker-image-1.1.0-2.3.11</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-pv-recycler-node-docker-image-1.1.0-2.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-api-docker-image-1.1.0-2.3.9</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-master-docker-image-1.1.0-4.3.10</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-salt-minion-docker-image-1.1.0-2.3.8</ProductID>
        <ProductID>SUSE CaaS Platform ALL:sles12-velum-docker-image-1.1.0-4.3.9</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172470-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-9269.html</URL>
        <Description>CVE-2017-9269</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1038984</URL>
        <Description>SUSE Bug 1038984</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1045735</URL>
        <Description>SUSE Bug 1045735</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
