SUSE-SU-2020:1864-1
Vulnerability from csaf_suse - Published: 2020-07-07 10:54 - Updated: 2026-09-20 13:34Summary
Security update for nasm
Severity
Moderate
Notes
Title of the patch: Security update for nasm
Description of the patch:
nasm was updated to version 2.14.02:
* Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified.
* Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before).
* If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7.
* Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code.
* Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions.
* Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7.
* Fix -E in combination with -MD. See section 2.1.21.
* Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug.
* Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.)
* Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1.
* Changed -I option semantics by adding a trailing path separator unconditionally.
* Fixed null dereference in corrupted invalid single line macros.
* Fixed division by zero which may happen if source code is malformed.
* Fixed out of bound access in processing of malformed segment override.
* Fixed out of bound access in certain EQU parsing.
* Fixed buffer underflow in float parsing.
* Added SGX (Intel Software Guard Extensions) instructions.
* Added +n syntax for multiple contiguous registers.
* Fixed subsections_via_symbols for macho object format.
* Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28.
* Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9.
* Supported generic %pragma namespaces, output and debug. See section 6.10.
* Added the --pragma command line option to inject a %pragma directive. See section 2.1.29.
* Added the --before command line option to accept preprocess statement before input. See section 2.1.30.
* Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions.
* Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8.
* Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5.
* The GLOBAL directive no longer is required to precede the definition of the symbol.
* Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5.
* Updated UD0 encoding to match with the specification
* Added the --limit-X command line option to set execution limits. See section 2.1.31.
* Updated the Codeview version number to be aligned with MASM.
* Added the --keep-all command line option to preserve output files. See section 2.1.32.
* Added the --include command line option, an alias to -P (section 2.1.18).
* Added the --help command line option as an alias to -h (section 3.1).
* Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64.
New upstream version 2.13.03:
* Add flags: AES, VAES, VPCLMULQDQ
* Add VPCLMULQDQ instruction
* elf: Add missing dwarf loc section
* documentation updates
nasm was updated to new upstream version 2.13.02:
* Fix generation of PEXTRW instruction.
* Fix smartalign package which could trigger an error during
optimization if the alignment code expanded too much due to
optimization of the previous code.
* Fix a case where negative value in TIMES directive causes
panic instead of an error.
* Fix the incorrect generation of VEX-encoded instruction
when static mode decorators are specified on scalar instructions,
losing the decorators as they require EVEX encoding.
* Fix generation of dependency lists.
* Fixes macro calls that have the wrong number of arguments
(bsc#1073796, CVE-2017-17810)
* Fixes Heap-based buffer overflow allows related to a strcpy
in paste_tokens (bsc#1073798, CVE-2017-17811)
* Fixes Heap-based buffer over-read in the function detoken()
(bsc#1073799, CVE-2017-17812)
* Fixes Use-after-free in the pp_list_one_macro function
(bsc#1073803, CVE-2017-17813)
* Fixes Use-after-free in do_directive
(bsc#1073808, CVE-2017-17814)
* Fixes Illegal address access in is_mmacro()
(bsc#1073818, CVE-2017-17815)
* Fixes Use-after-free in pp_getline
(bsc#1073823, CVE-2017-17816)
* Fixes Use-after-free in pp_verror
(bsc#1073829, CVE-2017-17817)
* Fixes Heap-based buffer over-read related to a while loop in
paste_tokens (bsc#1073830, CVE-2017-17818)
* Fixes Illegal address access in the function find_cc
(bsc#1073832, CVE-2017-17819)
* Fixes Use-after-free in pp_list_one_macro
(bsc#1073846, CVE-2017-17820)
* Fixes illegal address access in thefunction paste_tokens()
(bsc#1058013, CVE-2017-14228)
nasm was updated to version 2.13.01:
* Fix incorrect output for some types of FAR or SEG references in
the obj output format, and possibly other 16-bit output formats.
* Fix the address in the list file for an instruction containing
a TIMES directive.
* Fix error with TIMES used together with an instruction which
can vary in size, e.g. JMP.
* Fix breakage on some uses of the DZ pseudo-op.
nasm was updated to version 2.13.00:
* Support the official forms of the UD0 and UD1 instructions.
* Allow self-segment-relative expressions in immediates and
displacements
* Handle a 64-bit origin in NDISASM.
* NASM can now generate sparse output files for relevant output
formats, if the underlying operating system supports them.
* Fix a number of bugs related to AVX-512 decorators.
* Fix the {z} decorator on AVX-512 VMOVDQ* instructions.
* Add new warnings for certain dangerous constructs which never
ought to have been allowed.
* Fix the EVEX (AVX-512) versions of the VPBROADCAST, VPEXTR, and
VPINSR instructions.
* Support contracted forms of additional instructions.
* Fix Codeview malformed compiler version record.
* Add the CLWB and PCOMMIT instructions.
* Add the %pragma preprocessor directive for soft-error
directives.
* Add the RDPID instruction.
nasm was updated to version 2.12.02:
* Fix preprocessor errors, especially %error and %warning, inside
if statements.
* Fix relative relocations in 32-bit Mach-O.
* More Codeview debug format fixes.
* If the MASM PTR keyword is encountered, issue a warning. This
is much more likely to indicate a MASM-ism encountered in NASM
than it is a valid label.
* This warning can be suppressed with -w-ptr, the [warning]
directive (see section 2.1.24) or by the macro definition
%idefine ptr %??.
* When an error or a warning comes from the expansion of a
multi-line macro, display the file and line numbers for the
expanded macros.
* Macros defined with .nolist do not get displayed.
* Add macros ilog2fw() and ilog2cw() to the ifunc macro package.
See section 5.4.1.
nasm was updated to version 2.12.01:
* Portability fixes for some platforms.
* Fix error when not specifying a list file.
* Correct the handling of macro-local labels in the Codeview
debugging format.
* Add CLZERO, MONITORX and MWAITX instructions.
nasm was updated to version 2.12:
* Major fixes to the macho backend (section 7.8); earlier
versions would produce invalid symbols and relocations on a
regular basis.
* Support for thread-local storage in Mach-O.
* Support for arbitrary sections in Mach-O.
* Fix wrong negative size treated as a big positive value passed
into backend causing NASM to crash.
* Fix handling of zero-extending unsigned relocations, we have
been printing wrong message and forgot to assign segment with
predefined value before passing it into output format.
* Fix potential write of oversized (with size greater than
allowed in output format) relative relocations.
* Portability fixes for building NASM with LLVM compiler.
* Add support of Codeview version 8 (cv8) debug format for win32
and win64 formats in the COFF backend, see section 7.5.3.
* Allow 64-bit outputs in 16/32-bit only backends. Unsigned
64-bit relocations are zero-extended from 32-bits with a
warning (suppressible via -w-zext-reloc); signed 64-bit
relocations are an arror.
* Line numbers in list files now correspond to the lines in the
source files, instead of simply being sequential.
nasm was updated to version 2.11.09:
* Fix potential stack overwrite in macho32 backend.
* Fix relocation records in macho64 backend.
* Fix symbol lookup computation in macho64 backend.
* Adjust .symtab and .rela.text sections alignments to 8 bytes
in elf64 backed.
* Fix section length computation in bin backend which leaded in
incorrect relocation records.
nasm was updated to version 2.11.08:
* Fix section length computation in bin backend which leaded in
incorrect relocation records.
* Add a warning for numeric preprocessor definitions passed via
command line which might have unexpected results otherwise.
* Add ability to specify a module name record in rdoff linker
Patchnames: SUSE-2020-1864,SUSE-SLE-SDK-12-SP5-2020-1864
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
moderate
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
4.4 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2017-14228
Threats
Impact
low
References
53 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for nasm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\n\nnasm was updated to version 2.14.02:\n\n* Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified.\n* Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before).\n* If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7.\n* Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code.\n* Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions.\n* Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7.\n* Fix -E in combination with -MD. See section 2.1.21.\n* Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug.\n* Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.)\n* Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1.\n* Changed -I option semantics by adding a trailing path separator unconditionally.\n* Fixed null dereference in corrupted invalid single line macros.\n* Fixed division by zero which may happen if source code is malformed.\n* Fixed out of bound access in processing of malformed segment override.\n* Fixed out of bound access in certain EQU parsing.\n* Fixed buffer underflow in float parsing.\n* Added SGX (Intel Software Guard Extensions) instructions.\n* Added +n syntax for multiple contiguous registers.\n* Fixed subsections_via_symbols for macho object format.\n* Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28.\n* Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9.\n* Supported generic %pragma namespaces, output and debug. See section 6.10.\n* Added the --pragma command line option to inject a %pragma directive. See section 2.1.29.\n* Added the --before command line option to accept preprocess statement before input. See section 2.1.30.\n* Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions.\n* Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8.\n* Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5.\n* The GLOBAL directive no longer is required to precede the definition of the symbol.\n* Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5.\n* Updated UD0 encoding to match with the specification\n* Added the --limit-X command line option to set execution limits. See section 2.1.31.\n* Updated the Codeview version number to be aligned with MASM.\n* Added the --keep-all command line option to preserve output files. See section 2.1.32.\n* Added the --include command line option, an alias to -P (section 2.1.18).\n* Added the --help command line option as an alias to -h (section 3.1).\n* Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64.\n\nNew upstream version 2.13.03:\n\n* Add flags: AES, VAES, VPCLMULQDQ\n* Add VPCLMULQDQ instruction\n* elf: Add missing dwarf loc section\n* documentation updates\n\nnasm was updated to new upstream version 2.13.02:\n\n* Fix generation of PEXTRW instruction.\n* Fix smartalign package which could trigger an error during\n optimization if the alignment code expanded too much due to\n optimization of the previous code.\n* Fix a case where negative value in TIMES directive causes\n panic instead of an error.\n* Fix the incorrect generation of VEX-encoded instruction\n when static mode decorators are specified on scalar instructions,\n losing the decorators as they require EVEX encoding.\n* Fix generation of dependency lists.\n* Fixes macro calls that have the wrong number of arguments\n (bsc#1073796, CVE-2017-17810)\n* Fixes Heap-based buffer overflow allows related to a strcpy\n in paste_tokens (bsc#1073798, CVE-2017-17811)\n* Fixes Heap-based buffer over-read in the function detoken()\n (bsc#1073799, CVE-2017-17812)\n* Fixes Use-after-free in the pp_list_one_macro function\n (bsc#1073803, CVE-2017-17813)\n* Fixes Use-after-free in do_directive\n (bsc#1073808, CVE-2017-17814)\n* Fixes Illegal address access in is_mmacro()\n (bsc#1073818, CVE-2017-17815)\n* Fixes Use-after-free in pp_getline\n (bsc#1073823, CVE-2017-17816)\n* Fixes Use-after-free in pp_verror\n (bsc#1073829, CVE-2017-17817)\n* Fixes Heap-based buffer over-read related to a while loop in\n paste_tokens (bsc#1073830, CVE-2017-17818)\n* Fixes Illegal address access in the function find_cc\n (bsc#1073832, CVE-2017-17819)\n* Fixes Use-after-free in pp_list_one_macro\n (bsc#1073846, CVE-2017-17820)\n* Fixes illegal address access in thefunction paste_tokens()\n (bsc#1058013, CVE-2017-14228)\n\nnasm was updated to version 2.13.01:\n\n* Fix incorrect output for some types of FAR or SEG references in\n the obj output format, and possibly other 16-bit output formats.\n* Fix the address in the list file for an instruction containing\n a TIMES directive.\n* Fix error with TIMES used together with an instruction which\n can vary in size, e.g. JMP.\n* Fix breakage on some uses of the DZ pseudo-op.\n\nnasm was updated to version 2.13.00:\n\n* Support the official forms of the UD0 and UD1 instructions.\n* Allow self-segment-relative expressions in immediates and\n displacements\n* Handle a 64-bit origin in NDISASM.\n* NASM can now generate sparse output files for relevant output\n formats, if the underlying operating system supports them.\n* Fix a number of bugs related to AVX-512 decorators.\n* Fix the {z} decorator on AVX-512 VMOVDQ* instructions.\n* Add new warnings for certain dangerous constructs which never\n ought to have been allowed.\n* Fix the EVEX (AVX-512) versions of the VPBROADCAST, VPEXTR, and\n VPINSR instructions.\n* Support contracted forms of additional instructions.\n* Fix Codeview malformed compiler version record.\n* Add the CLWB and PCOMMIT instructions.\n* Add the %pragma preprocessor directive for soft-error\n directives.\n* Add the RDPID instruction.\n\nnasm was updated to version 2.12.02:\n\n* Fix preprocessor errors, especially %error and %warning, inside \n if statements.\n* Fix relative relocations in 32-bit Mach-O.\n* More Codeview debug format fixes.\n* If the MASM PTR keyword is encountered, issue a warning. This \n is much more likely to indicate a MASM-ism encountered in NASM \n than it is a valid label.\n* This warning can be suppressed with -w-ptr, the [warning] \n directive (see section 2.1.24) or by the macro definition \n %idefine ptr %??.\n* When an error or a warning comes from the expansion of a \n multi-line macro, display the file and line numbers for the \n expanded macros.\n* Macros defined with .nolist do not get displayed.\n* Add macros ilog2fw() and ilog2cw() to the ifunc macro package. \n See section 5.4.1.\n\nnasm was updated to version 2.12.01:\n\n* Portability fixes for some platforms.\n* Fix error when not specifying a list file.\n* Correct the handling of macro-local labels in the Codeview \n debugging format.\n* Add CLZERO, MONITORX and MWAITX instructions.\n\nnasm was updated to version 2.12:\n\n* Major fixes to the macho backend (section 7.8); earlier \n versions would produce invalid symbols and relocations on a \n regular basis.\n* Support for thread-local storage in Mach-O.\n* Support for arbitrary sections in Mach-O.\n* Fix wrong negative size treated as a big positive value passed \n into backend causing NASM to crash.\n* Fix handling of zero-extending unsigned relocations, we have \n been printing wrong message and forgot to assign segment with \n predefined value before passing it into output format.\n* Fix potential write of oversized (with size greater than \n allowed in output format) relative relocations.\n* Portability fixes for building NASM with LLVM compiler.\n* Add support of Codeview version 8 (cv8) debug format for win32 \n and win64 formats in the COFF backend, see section 7.5.3.\n* Allow 64-bit outputs in 16/32-bit only backends. Unsigned \n 64-bit relocations are zero-extended from 32-bits with a \n warning (suppressible via -w-zext-reloc); signed 64-bit \n relocations are an arror.\n* Line numbers in list files now correspond to the lines in the \n source files, instead of simply being sequential.\n\nnasm was updated to version 2.11.09:\n\n* Fix potential stack overwrite in macho32 backend.\n* Fix relocation records in macho64 backend.\n* Fix symbol lookup computation in macho64 backend.\n* Adjust .symtab and .rela.text sections alignments to 8 bytes \n in elf64 backed.\n* Fix section length computation in bin backend which leaded in \n incorrect relocation records.\n\nnasm was updated to version 2.11.08:\n\n* Fix section length computation in bin backend which leaded in \n incorrect relocation records.\n* Add a warning for numeric preprocessor definitions passed via \n command line which might have unexpected results otherwise.\n* Add ability to specify a module name record in rdoff linker \n\n ",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2020-1864,SUSE-SLE-SDK-12-SP5-2020-1864",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_1864-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2020:1864-1",
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-20201864-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2020:1864-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-July/007088.html"
},
{
"category": "self",
"summary": "SUSE Bug 1058013",
"url": "https://bugzilla.suse.com/1058013"
},
{
"category": "self",
"summary": "SUSE Bug 1073796",
"url": "https://bugzilla.suse.com/1073796"
},
{
"category": "self",
"summary": "SUSE Bug 1073798",
"url": "https://bugzilla.suse.com/1073798"
},
{
"category": "self",
"summary": "SUSE Bug 1073799",
"url": "https://bugzilla.suse.com/1073799"
},
{
"category": "self",
"summary": "SUSE Bug 1073803",
"url": "https://bugzilla.suse.com/1073803"
},
{
"category": "self",
"summary": "SUSE Bug 1073808",
"url": "https://bugzilla.suse.com/1073808"
},
{
"category": "self",
"summary": "SUSE Bug 1073818",
"url": "https://bugzilla.suse.com/1073818"
},
{
"category": "self",
"summary": "SUSE Bug 1073823",
"url": "https://bugzilla.suse.com/1073823"
},
{
"category": "self",
"summary": "SUSE Bug 1073829",
"url": "https://bugzilla.suse.com/1073829"
},
{
"category": "self",
"summary": "SUSE Bug 1073830",
"url": "https://bugzilla.suse.com/1073830"
},
{
"category": "self",
"summary": "SUSE Bug 1073832",
"url": "https://bugzilla.suse.com/1073832"
},
{
"category": "self",
"summary": "SUSE Bug 1073846",
"url": "https://bugzilla.suse.com/1073846"
},
{
"category": "self",
"summary": "SUSE Bug 1084631",
"url": "https://bugzilla.suse.com/1084631"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14228 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14228/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17810 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17810/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17811 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17811/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17812 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17812/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17813 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17813/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17814 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17815 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17815/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17816 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17816/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17817 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17817/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17818 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17818/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17819 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17820 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17820/"
}
],
"title": "Security update for nasm",
"tracking": {
"current_release_date": "2026-09-20T13:34:11Z",
"generator": {
"date": "2020-07-07T10:54:13Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2020:1864-1",
"initial_release_date": "2020-07-07T10:54:13Z",
"revision_history": [
{
"date": "2020-07-07T10:54:13Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T13:34:11Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "nasm-0:2.14.02-4.8.1.aarch64",
"product": {
"name": "nasm-0:2.14.02-4.8.1.aarch64",
"product_id": "nasm-0:2.14.02-4.8.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14.02:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/nasm@2.14.02-4.8.1?arch=aarch64\u0026upstream=nasm-0:2.14.02-4.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "nasm-0:2.14.02-4.8.1.i586",
"product": {
"name": "nasm-0:2.14.02-4.8.1.i586",
"product_id": "nasm-0:2.14.02-4.8.1.i586",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14.02:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/nasm@2.14.02-4.8.1?arch=i586\u0026upstream=nasm-0:2.14.02-4.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "nasm-0:2.14.02-4.8.1.ppc64le",
"product": {
"name": "nasm-0:2.14.02-4.8.1.ppc64le",
"product_id": "nasm-0:2.14.02-4.8.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14.02:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/nasm@2.14.02-4.8.1?arch=ppc64le\u0026upstream=nasm-0:2.14.02-4.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "nasm-0:2.14.02-4.8.1.s390",
"product": {
"name": "nasm-0:2.14.02-4.8.1.s390",
"product_id": "nasm-0:2.14.02-4.8.1.s390",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14.02:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/nasm@2.14.02-4.8.1?arch=s390\u0026upstream=nasm-0:2.14.02-4.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390"
},
{
"branches": [
{
"category": "product_version",
"name": "nasm-0:2.14.02-4.8.1.s390x",
"product": {
"name": "nasm-0:2.14.02-4.8.1.s390x",
"product_id": "nasm-0:2.14.02-4.8.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14.02:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/nasm@2.14.02-4.8.1?arch=s390x\u0026upstream=nasm-0:2.14.02-4.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nasm-0:2.14.02-4.8.1.x86_64",
"product": {
"name": "nasm-0:2.14.02-4.8.1.x86_64",
"product_id": "nasm-0:2.14.02-4.8.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14.02:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/nasm@2.14.02-4.8.1?arch=x86_64\u0026upstream=nasm-0:2.14.02-4.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-sdk:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64"
},
"product_reference": "nasm-0:2.14.02-4.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le"
},
"product_reference": "nasm-0:2.14.02-4.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x"
},
"product_reference": "nasm-0:2.14.02-4.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
},
"product_reference": "nasm-0:2.14.02-4.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64"
},
"product_reference": "nasm-0:2.14.02-4.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le"
},
"product_reference": "nasm-0:2.14.02-4.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x"
},
"product_reference": "nasm-0:2.14.02-4.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
},
"product_reference": "nasm-0:2.14.02-4.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64"
},
"product_reference": "nasm-0:2.14.02-4.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le"
},
"product_reference": "nasm-0:2.14.02-4.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x"
},
"product_reference": "nasm-0:2.14.02-4.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nasm-0:2.14.02-4.8.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
},
"product_reference": "nasm-0:2.14.02-4.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-14228",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14228"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14228",
"url": "https://www.suse.com/security/cve/CVE-2017-14228"
},
{
"category": "external",
"summary": "SUSE Bug 1058013 for CVE-2017-14228",
"url": "https://bugzilla.suse.com/1058013"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "moderate"
}
],
"title": "CVE-2017-14228"
},
{
"cve": "CVE-2017-17810",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17810"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a \"SEGV on unknown address\" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17810",
"url": "https://www.suse.com/security/cve/CVE-2017-17810"
},
{
"category": "external",
"summary": "SUSE Bug 1073796 for CVE-2017-17810",
"url": "https://bugzilla.suse.com/1073796"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "moderate"
}
],
"title": "CVE-2017-17810"
},
{
"cve": "CVE-2017-17811",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17811"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17811",
"url": "https://www.suse.com/security/cve/CVE-2017-17811"
},
{
"category": "external",
"summary": "SUSE Bug 1073798 for CVE-2017-17811",
"url": "https://bugzilla.suse.com/1073798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17811"
},
{
"cve": "CVE-2017-17812",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17812"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17812",
"url": "https://www.suse.com/security/cve/CVE-2017-17812"
},
{
"category": "external",
"summary": "SUSE Bug 1073799 for CVE-2017-17812",
"url": "https://bugzilla.suse.com/1073799"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17812"
},
{
"cve": "CVE-2017-17813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17813"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17813",
"url": "https://www.suse.com/security/cve/CVE-2017-17813"
},
{
"category": "external",
"summary": "SUSE Bug 1073803 for CVE-2017-17813",
"url": "https://bugzilla.suse.com/1073803"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17813"
},
{
"cve": "CVE-2017-17814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17814"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17814",
"url": "https://www.suse.com/security/cve/CVE-2017-17814"
},
{
"category": "external",
"summary": "SUSE Bug 1073808 for CVE-2017-17814",
"url": "https://bugzilla.suse.com/1073808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17814"
},
{
"cve": "CVE-2017-17815",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17815"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17815",
"url": "https://www.suse.com/security/cve/CVE-2017-17815"
},
{
"category": "external",
"summary": "SUSE Bug 1073818 for CVE-2017-17815",
"url": "https://bugzilla.suse.com/1073818"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17815"
},
{
"cve": "CVE-2017-17816",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17816"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17816",
"url": "https://www.suse.com/security/cve/CVE-2017-17816"
},
{
"category": "external",
"summary": "SUSE Bug 1073823 for CVE-2017-17816",
"url": "https://bugzilla.suse.com/1073823"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17816"
},
{
"cve": "CVE-2017-17817",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17817"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause a remote denial of service attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17817",
"url": "https://www.suse.com/security/cve/CVE-2017-17817"
},
{
"category": "external",
"summary": "SUSE Bug 1073829 for CVE-2017-17817",
"url": "https://bugzilla.suse.com/1073829"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17817"
},
{
"cve": "CVE-2017-17818",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17818"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_tokens in asm/preproc.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17818",
"url": "https://www.suse.com/security/cve/CVE-2017-17818"
},
{
"category": "external",
"summary": "SUSE Bug 1073830 for CVE-2017-17818",
"url": "https://bugzilla.suse.com/1073830"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17818"
},
{
"cve": "CVE-2017-17819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17819"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause a remote denial of service attack, because pointers associated with skip_white_ calls are not validated.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17819",
"url": "https://www.suse.com/security/cve/CVE-2017-17819"
},
{
"category": "external",
"summary": "SUSE Bug 1073832 for CVE-2017-17819",
"url": "https://bugzilla.suse.com/1073832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17819"
},
{
"cve": "CVE-2017-17820",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17820"
}
],
"notes": [
{
"category": "general",
"text": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, related to mishandling of operand-type errors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17820",
"url": "https://www.suse.com/security/cve/CVE-2017-17820"
},
{
"category": "external",
"summary": "SUSE Bug 1073846 for CVE-2017-17820",
"url": "https://bugzilla.suse.com/1073846"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:nasm-0:2.14.02-4.8.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:nasm-0:2.14.02-4.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T10:54:13Z",
"details": "low"
}
],
"title": "CVE-2017-17820"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…