suse-su-2017:1222-1
Vulnerability from csaf_suse
Published
2017-05-09 11:34
Modified
2017-05-09 11:34
Summary
Security update for Botan

Notes

Title of the patch
Security update for Botan
Description of the patch
This update for Botan to version 1.10.9 fixes the following issues: These security issues were fixed: - CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data (bsc#968025). - CVE-2015-5727: The BER decoder in Botan 1.10.x allowed remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field (bsc#968026). - CVE-2015-7827: Botan make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding (bsc#968030). - CVE-2016-2849: Botan do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allowed remote attackers to obtain ECDSA secret keys via a timing side-channel attack (bsc#977420). - CVE-2016-9132: In Botan 1.8.0 when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later caused memory corruption or other failure (bsc#1013209). - CVE-2016-2194: The ressol function in Botan allowed remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus (bsc#965621). - CVE-2016-2195: Integer overflow in the PointGFp constructor in Botan allowed remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow (bsc#965620). - CVE-2017-2801: Incorrect comparison in X.509 DN strings (bsc#1033605). - CVE-2014-9742: The Miller-Rabin primality check in Botan improperly used a single random base, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group (bsc#974521). These non-security issues were fixed: - Fixed EAX tag verification to run in constant time - The default TLS policy now disables SSLv3. - A crash could have occured when reading from a blocking random device if the device initially indicated that entropy was available but a concurrent process drained the entropy pool before the read was initiated. - Fixed decoding indefinite length BER constructs that contain a context sensitive tag of zero. - The key length limit on HMAC has been raised to 512 bytes, allowing the use of very long passphrases with PBKDF2. - OAEP had two bugs, one of which allowed it to be used even if the key was too small, and the other of which would cause a crash during decryption if the EME data was too large for the associated key.
Patchnames
SUSE-SLE-SDK-12-SP1-2017-723,SUSE-SLE-SDK-12-SP2-2017-723
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for Botan",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for Botan to version 1.10.9 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data (bsc#968025).\n- CVE-2015-5727: The BER decoder in Botan 1.10.x allowed remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field (bsc#968026).\n- CVE-2015-7827: Botan make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding (bsc#968030).\n- CVE-2016-2849: Botan do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allowed remote attackers to obtain ECDSA secret keys via a timing side-channel attack (bsc#977420).\n- CVE-2016-9132: In Botan 1.8.0 when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later caused memory corruption or other failure (bsc#1013209).\n- CVE-2016-2194: The ressol function in Botan allowed remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus (bsc#965621).\n- CVE-2016-2195: Integer overflow in the PointGFp constructor in Botan allowed remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow (bsc#965620).\n- CVE-2017-2801: Incorrect comparison in X.509 DN strings (bsc#1033605).\n- CVE-2014-9742: The Miller-Rabin primality check in Botan improperly used a single random base, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group (bsc#974521).\n\nThese non-security issues were fixed:\n\n- Fixed EAX tag verification to run in constant time\n- The default TLS policy now disables SSLv3.\n- A crash could have occured when reading from a blocking random device if the\n  device initially indicated that entropy was available but a concurrent\n  process drained the entropy pool before the read was initiated.\n- Fixed decoding indefinite length BER constructs that contain a context sensitive\n  tag of zero.\n- The key length limit on HMAC has been raised to 512 bytes, allowing the use\n  of very long passphrases with PBKDF2.\n- OAEP had two bugs, one of which allowed it to be used even if the key was\n  too small, and the other of which would cause a crash during decryption if\n  the EME data was too large for the associated key.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SDK-12-SP1-2017-723,SUSE-SLE-SDK-12-SP2-2017-723",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_1222-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2017:1222-1",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20171222-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2017:1222-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-May/002851.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1013209",
        "url": "https://bugzilla.suse.com/1013209"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1033605",
        "url": "https://bugzilla.suse.com/1033605"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965620",
        "url": "https://bugzilla.suse.com/965620"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965621",
        "url": "https://bugzilla.suse.com/965621"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 968025",
        "url": "https://bugzilla.suse.com/968025"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 968026",
        "url": "https://bugzilla.suse.com/968026"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 968030",
        "url": "https://bugzilla.suse.com/968030"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 974521",
        "url": "https://bugzilla.suse.com/974521"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 977420",
        "url": "https://bugzilla.suse.com/977420"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9742 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9742/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-5726 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-5726/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-5727 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-5727/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7827 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2194 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2194/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2195 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2195/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2849 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2849/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9132 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9132/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-2801 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-2801/"
      }
    ],
    "title": "Security update for Botan",
    "tracking": {
      "current_release_date": "2017-05-09T11:34:34Z",
      "generator": {
        "date": "2017-05-09T11:34:34Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2017:1222-1",
      "initial_release_date": "2017-05-09T11:34:34Z",
      "revision_history": [
        {
          "date": "2017-05-09T11:34:34Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libbotan-1_10-0-1.10.9-3.1.aarch64",
                "product": {
                  "name": "libbotan-1_10-0-1.10.9-3.1.aarch64",
                  "product_id": "libbotan-1_10-0-1.10.9-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libbotan-devel-1.10.9-3.1.aarch64",
                "product": {
                  "name": "libbotan-devel-1.10.9-3.1.aarch64",
                  "product_id": "libbotan-devel-1.10.9-3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libbotan-1_10-0-1.10.9-3.1.ppc64le",
                "product": {
                  "name": "libbotan-1_10-0-1.10.9-3.1.ppc64le",
                  "product_id": "libbotan-1_10-0-1.10.9-3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libbotan-devel-1.10.9-3.1.ppc64le",
                "product": {
                  "name": "libbotan-devel-1.10.9-3.1.ppc64le",
                  "product_id": "libbotan-devel-1.10.9-3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libbotan-1_10-0-1.10.9-3.1.s390x",
                "product": {
                  "name": "libbotan-1_10-0-1.10.9-3.1.s390x",
                  "product_id": "libbotan-1_10-0-1.10.9-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libbotan-devel-1.10.9-3.1.s390x",
                "product": {
                  "name": "libbotan-devel-1.10.9-3.1.s390x",
                  "product_id": "libbotan-devel-1.10.9-3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libbotan-1_10-0-1.10.9-3.1.x86_64",
                "product": {
                  "name": "libbotan-1_10-0-1.10.9-3.1.x86_64",
                  "product_id": "libbotan-1_10-0-1.10.9-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libbotan-devel-1.10.9-3.1.x86_64",
                "product": {
                  "name": "libbotan-devel-1.10.9-3.1.x86_64",
                  "product_id": "libbotan-devel-1.10.9-3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP1",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-1_10-0-1.10.9-3.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64"
        },
        "product_reference": "libbotan-1_10-0-1.10.9-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libbotan-devel-1.10.9-3.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        },
        "product_reference": "libbotan-devel-1.10.9-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-9742",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9742"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9742",
          "url": "https://www.suse.com/security/cve/CVE-2014-9742"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 974521 for CVE-2014-9742",
          "url": "https://bugzilla.suse.com/974521"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "low"
        }
      ],
      "title": "CVE-2014-9742"
    },
    {
      "cve": "CVE-2015-5726",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-5726"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-5726",
          "url": "https://www.suse.com/security/cve/CVE-2015-5726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 968025 for CVE-2015-5726",
          "url": "https://bugzilla.suse.com/968025"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-5726"
    },
    {
      "cve": "CVE-2015-5727",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-5727"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-5727",
          "url": "https://www.suse.com/security/cve/CVE-2015-5727"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 968026 for CVE-2015-5727",
          "url": "https://bugzilla.suse.com/968026"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-5727"
    },
    {
      "cve": "CVE-2015-7827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7827",
          "url": "https://www.suse.com/security/cve/CVE-2015-7827"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 968030 for CVE-2015-7827",
          "url": "https://bugzilla.suse.com/968030"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-7827"
    },
    {
      "cve": "CVE-2016-2194",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2194"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2194",
          "url": "https://www.suse.com/security/cve/CVE-2016-2194"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965618 for CVE-2016-2194",
          "url": "https://bugzilla.suse.com/965618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965620 for CVE-2016-2194",
          "url": "https://bugzilla.suse.com/965620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965621 for CVE-2016-2194",
          "url": "https://bugzilla.suse.com/965621"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-2194"
    },
    {
      "cve": "CVE-2016-2195",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2195"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2195",
          "url": "https://www.suse.com/security/cve/CVE-2016-2195"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965618 for CVE-2016-2195",
          "url": "https://bugzilla.suse.com/965618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965620 for CVE-2016-2195",
          "url": "https://bugzilla.suse.com/965620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965621 for CVE-2016-2195",
          "url": "https://bugzilla.suse.com/965621"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-2195"
    },
    {
      "cve": "CVE-2016-2849",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2849"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2849",
          "url": "https://www.suse.com/security/cve/CVE-2016-2849"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 977420 for CVE-2016-2849",
          "url": "https://bugzilla.suse.com/977420"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 977421 for CVE-2016-2849",
          "url": "https://bugzilla.suse.com/977421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-2849"
    },
    {
      "cve": "CVE-2016-9132",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9132"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9132",
          "url": "https://www.suse.com/security/cve/CVE-2016-9132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1013209 for CVE-2016-9132",
          "url": "https://bugzilla.suse.com/1013209"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9132"
    },
    {
      "cve": "CVE-2017-2801",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-2801"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-2801",
          "url": "https://www.suse.com/security/cve/CVE-2017-2801"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1033605 for CVE-2017-2801",
          "url": "https://bugzilla.suse.com/1033605"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:libbotan-devel-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-1_10-0-1.10.9-3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:libbotan-devel-1.10.9-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-05-09T11:34:34Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-2801"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.