via oss-sec:

    Standard usage of Email::Address module is to parse From/To/Cc headers
    from emails. And standard is also to use that module without setting
    $COMMENT_NEST_LEVEL variable... So because I was thinking about this
    standard usage in other applications I think that one CVE ID could be
    enough.


Thanks for your additional notes. We have decided to choose the option
of a single CVE, although this option is unattractive for some
reasons. Use CVE-2015-7686 for the CWE-407 ("Algorithmic Complexity")
issue in versions 1.908 and earlier. In other words, we consider 1.908
to be an affected version because there are realistic cases in which
COMMENT_NEST_LEVEL must be 2 for usability reasons. There is no CVE ID
corresponding to the behavior change between 1.907 and 1.908.


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7686
http://seclists.org/oss-sec/2015/q4/22



openSUSE affected (by version). There is no upstream release newer than 1.908, nor a patch just now.

Not in SLE.