<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for libapr1</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:1196-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-05-09T17:59:08Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-05-09T17:59:08Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-05-09T17:59:08Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for libapr1</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
  This update fixes the following issues:
  
  -  CVE-2017-12613: DoS or information disclosure in pr_exp_time*() or apr_os_exp_time*() functions (bsc#1064982).
  </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-SDK-12-SP3-2018-835,SUSE-SLE-SERVER-12-SP3-2018-835</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181196-1/</URL>
      <Description>Link for SUSE-SU-2018:1196-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-May/003992.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:1196-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1064982</URL>
      <Description>SUSE Bug 1064982</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-12613/</URL>
      <Description>SUSE CVE CVE-2017-12613 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3" CPE="cpe:/o:suse:sles:12:sp3">SUSE Linux Enterprise Server 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP3" CPE="cpe:/o:suse:sles_sap:12:sp3">SUSE Linux Enterprise Server for SAP Applications 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3" CPE="cpe:/o:suse:sle-sdk:12:sp3">SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libapr1-1.5.1-4.3.1">
      <FullProductName ProductID="libapr1-1.5.1-4.3.1">libapr1-1.5.1-4.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libapr1-devel-1.5.1-4.3.1">
      <FullProductName ProductID="libapr1-devel-1.5.1-4.3.1">libapr1-devel-1.5.1-4.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libapr1-1.5.1-4.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3:libapr1-1.5.1-4.3.1">libapr1-1.5.1-4.3.1 as a component of SUSE Linux Enterprise Server 12 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libapr1-1.5.1-4.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP3:libapr1-1.5.1-4.3.1">libapr1-1.5.1-4.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libapr1-1.5.1-4.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3:libapr1-1.5.1-4.3.1">libapr1-1.5.1-4.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libapr1-devel-1.5.1-4.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP3:libapr1-devel-1.5.1-4.3.1">libapr1-devel-1.5.1-4.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.</Note>
    </Notes>
    <CVE>CVE-2017-12613</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP3:libapr1-1.5.1-4.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP3:libapr1-1.5.1-4.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP3:libapr1-1.5.1-4.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP3:libapr1-devel-1.5.1-4.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.7</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:M/C:P/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.4</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181196-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-12613.html</URL>
        <Description>CVE-2017-12613</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1064982</URL>
        <Description>SUSE Bug 1064982</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1190072</URL>
        <Description>SUSE Bug 1190072</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
