June 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1733-1: Security update for aubio
by opensuse-security＠opensuse.org 19 Jun '18

19 Jun '18

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1733-1 Rating: low References: #1072317 Cross-References: CVE-2017-17554 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for aubio fixes the following security issue: - CVE-2017-17554: Prevent NULL pointer dereference in the function aubio_source_avcodec_readframe which may have lead to DoS when playing a crafted audio file (bsc#1072317). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-651=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aubio-debugsource-0.4.1-9.6.2 aubio-tools-0.4.1-9.6.2 aubio-tools-debuginfo-0.4.1-9.6.2 libaubio-devel-0.4.1-9.6.2 libaubio4-0.4.1-9.6.2 libaubio4-debuginfo-0.4.1-9.6.2 - openSUSE Leap 42.3 (x86_64): libaubio4-32bit-0.4.1-9.6.2 libaubio4-debuginfo-32bit-0.4.1-9.6.2 References: https://www.suse.com/security/cve/CVE-2017-17554.html https://bugzilla.suse.com/1072317 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1727-1: moderate: Security update for samba
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1727-1 Rating: moderate References: #1081024 #1093664 Cross-References: CVE-2018-1057 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Samba was updated to 4.6.14, fixing bugs and security issues: Version update to 4.6.14 (bsc#1093664): + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425). + Fix memory leak in vfs_ceph; (bso#13424). + winbind: avoid using fstrcpy(dcname,...) in _dual_init_connection; (bso#13294). + s3:smb2_server: correctly maintain request counters for compound requests; (bso#13215). + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375). + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338). + vfs_glusterfs: Fix the wrong pointer being sent in glfs_fsync_async; (bso#13297). + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270). + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244). + s3:libsmb: allow -U"\\administrator" to work; (bso#13206). + CVE-2018-1057: s4:dsdb: fix unprivileged password changes; (bso#13272); (bsc#1081024). + s3:smbd: Do not crash if we fail to init the session table; (bso#13315). + libsmb: Use smb2 tcon if conn_protocol >= SMB2_02; (bso#13310). + smbXcli: Add "force_channel_sequence"; (bso#13215). + smbd: Fix channel sequence number checks for long-running requests; (bso#13215). + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197). + s3:smbd: return the correct error for cancelled SMB2 notifies on expired sessions; (bso#13197). + samba: Only use async signal-safe functions in signal handler; (bso#13240). + subnet: Avoid a segfault when renaming subnet objects; (bso#13031). - Fix vfs_ceph with "aio read size" or "aio write size" > 0; (bsc#1093664). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425). + Fix memory leak in vfs_ceph; (bso#13424). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-649=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ctdb-4.6.14+git.150.1540e575faf-15.1 ctdb-debuginfo-4.6.14+git.150.1540e575faf-15.1 ctdb-tests-4.6.14+git.150.1540e575faf-15.1 ctdb-tests-debuginfo-4.6.14+git.150.1540e575faf-15.1 libdcerpc-binding0-4.6.14+git.150.1540e575faf-15.1 libdcerpc-binding0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libdcerpc-devel-4.6.14+git.150.1540e575faf-15.1 libdcerpc-samr-devel-4.6.14+git.150.1540e575faf-15.1 libdcerpc-samr0-4.6.14+git.150.1540e575faf-15.1 libdcerpc-samr0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libdcerpc0-4.6.14+git.150.1540e575faf-15.1 libdcerpc0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libndr-devel-4.6.14+git.150.1540e575faf-15.1 libndr-krb5pac-devel-4.6.14+git.150.1540e575faf-15.1 libndr-krb5pac0-4.6.14+git.150.1540e575faf-15.1 libndr-krb5pac0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libndr-nbt-devel-4.6.14+git.150.1540e575faf-15.1 libndr-nbt0-4.6.14+git.150.1540e575faf-15.1 libndr-nbt0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libndr-standard-devel-4.6.14+git.150.1540e575faf-15.1 libndr-standard0-4.6.14+git.150.1540e575faf-15.1 libndr-standard0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libndr0-4.6.14+git.150.1540e575faf-15.1 libndr0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libnetapi-devel-4.6.14+git.150.1540e575faf-15.1 libnetapi0-4.6.14+git.150.1540e575faf-15.1 libnetapi0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamba-credentials-devel-4.6.14+git.150.1540e575faf-15.1 libsamba-credentials0-4.6.14+git.150.1540e575faf-15.1 libsamba-credentials0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamba-errors-devel-4.6.14+git.150.1540e575faf-15.1 libsamba-errors0-4.6.14+git.150.1540e575faf-15.1 libsamba-errors0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamba-hostconfig-devel-4.6.14+git.150.1540e575faf-15.1 libsamba-hostconfig0-4.6.14+git.150.1540e575faf-15.1 libsamba-hostconfig0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamba-passdb-devel-4.6.14+git.150.1540e575faf-15.1 libsamba-passdb0-4.6.14+git.150.1540e575faf-15.1 libsamba-passdb0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamba-policy-devel-4.6.14+git.150.1540e575faf-15.1 libsamba-policy0-4.6.14+git.150.1540e575faf-15.1 libsamba-policy0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamba-util-devel-4.6.14+git.150.1540e575faf-15.1 libsamba-util0-4.6.14+git.150.1540e575faf-15.1 libsamba-util0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsamdb-devel-4.6.14+git.150.1540e575faf-15.1 libsamdb0-4.6.14+git.150.1540e575faf-15.1 libsamdb0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsmbclient-devel-4.6.14+git.150.1540e575faf-15.1 libsmbclient0-4.6.14+git.150.1540e575faf-15.1 libsmbclient0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsmbconf-devel-4.6.14+git.150.1540e575faf-15.1 libsmbconf0-4.6.14+git.150.1540e575faf-15.1 libsmbconf0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libsmbldap-devel-4.6.14+git.150.1540e575faf-15.1 libsmbldap0-4.6.14+git.150.1540e575faf-15.1 libsmbldap0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libtevent-util-devel-4.6.14+git.150.1540e575faf-15.1 libtevent-util0-4.6.14+git.150.1540e575faf-15.1 libtevent-util0-debuginfo-4.6.14+git.150.1540e575faf-15.1 libwbclient-devel-4.6.14+git.150.1540e575faf-15.1 libwbclient0-4.6.14+git.150.1540e575faf-15.1 libwbclient0-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-4.6.14+git.150.1540e575faf-15.1 samba-client-4.6.14+git.150.1540e575faf-15.1 samba-client-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-core-devel-4.6.14+git.150.1540e575faf-15.1 samba-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-debugsource-4.6.14+git.150.1540e575faf-15.1 samba-libs-4.6.14+git.150.1540e575faf-15.1 samba-libs-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-pidl-4.6.14+git.150.1540e575faf-15.1 samba-python-4.6.14+git.150.1540e575faf-15.1 samba-python-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-test-4.6.14+git.150.1540e575faf-15.1 samba-test-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-winbind-4.6.14+git.150.1540e575faf-15.1 samba-winbind-debuginfo-4.6.14+git.150.1540e575faf-15.1 - openSUSE Leap 42.3 (noarch): samba-doc-4.6.14+git.150.1540e575faf-15.1 - openSUSE Leap 42.3 (x86_64): libdcerpc-binding0-32bit-4.6.14+git.150.1540e575faf-15.1 libdcerpc-binding0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libdcerpc-samr0-32bit-4.6.14+git.150.1540e575faf-15.1 libdcerpc-samr0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libdcerpc0-32bit-4.6.14+git.150.1540e575faf-15.1 libdcerpc0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libndr-krb5pac0-32bit-4.6.14+git.150.1540e575faf-15.1 libndr-krb5pac0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libndr-nbt0-32bit-4.6.14+git.150.1540e575faf-15.1 libndr-nbt0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libndr-standard0-32bit-4.6.14+git.150.1540e575faf-15.1 libndr-standard0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libndr0-32bit-4.6.14+git.150.1540e575faf-15.1 libndr0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libnetapi0-32bit-4.6.14+git.150.1540e575faf-15.1 libnetapi0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-credentials0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-credentials0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-errors0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-errors0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-hostconfig0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-hostconfig0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-passdb0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-passdb0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-policy0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-policy0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-util0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamba-util0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsamdb0-32bit-4.6.14+git.150.1540e575faf-15.1 libsamdb0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsmbclient0-32bit-4.6.14+git.150.1540e575faf-15.1 libsmbclient0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsmbconf0-32bit-4.6.14+git.150.1540e575faf-15.1 libsmbconf0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libsmbldap0-32bit-4.6.14+git.150.1540e575faf-15.1 libsmbldap0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libtevent-util0-32bit-4.6.14+git.150.1540e575faf-15.1 libtevent-util0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 libwbclient0-32bit-4.6.14+git.150.1540e575faf-15.1 libwbclient0-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 samba-ceph-4.6.14+git.150.1540e575faf-15.1 samba-ceph-debuginfo-4.6.14+git.150.1540e575faf-15.1 samba-client-32bit-4.6.14+git.150.1540e575faf-15.1 samba-client-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 samba-libs-32bit-4.6.14+git.150.1540e575faf-15.1 samba-libs-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 samba-winbind-32bit-4.6.14+git.150.1540e575faf-15.1 samba-winbind-debuginfo-32bit-4.6.14+git.150.1540e575faf-15.1 References: https://www.suse.com/security/cve/CVE-2018-1057.html https://bugzilla.suse.com/1081024 https://bugzilla.suse.com/1093664 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1724-1: important: Security update for gpg2
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1724-1 Rating: important References: #1096745 Cross-References: CVE-2018-12020 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gpg2 fixes the following security issue: - CVE-2018-12020: GnuPG mishandled the original filename during decryption and verification actions, which allowed remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option (bsc#1096745) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-640=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-640=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gpg2-2.0.24-9.3.1 gpg2-debuginfo-2.0.24-9.3.1 gpg2-debugsource-2.0.24-9.3.1 - openSUSE Leap 42.3 (noarch): gpg2-lang-2.0.24-9.3.1 - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.3.1 gpg2-debuginfo-2.2.5-lp150.3.3.1 gpg2-debugsource-2.2.5-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12020.html https://bugzilla.suse.com/1096745 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1722-1: moderate: Security update for python-python-gnupg
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for python-python-gnupg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1722-1 Rating: moderate References: #1096745 Cross-References: CVE-2018-12020 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-python-gnupg to version 0.4.3 fixes the following issues: The following security vulnerabilities were addressed: - Sanitize diagnostic output of the original file name in verbose mode (CVE-2018-12020 boo#1096745) The following other changes were made: - Add --no-verbose to the gpg command line, in case verbose is specified is gpg.conf. - Add expect_passphrase password for use on GnuPG >= 2.1 when passing passphrase to gpg via pinentry - Provide a trust_keys method to allow setting the trust level for keys - When the gpg executable is not found, note the path used in the exception message - Make error messages more informational Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-646=1 Package List: - openSUSE Leap 15.0 (noarch): python2-python-gnupg-0.4.3-lp150.2.3.1 python3-python-gnupg-0.4.3-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12020.html https://bugzilla.suse.com/1096745 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1721-1: moderate: Security update for poppler
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for poppler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1721-1 Rating: moderate References: #1045939 #1059066 #1059101 #1059155 #1060220 #1061092 #1061263 #1061264 #1061265 #1064593 #1074453 Cross-References: CVE-2017-1000456 CVE-2017-14517 CVE-2017-14518 CVE-2017-14520 CVE-2017-14617 CVE-2017-14928 CVE-2017-14975 CVE-2017-14976 CVE-2017-14977 CVE-2017-15565 CVE-2017-9865 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for poppler fixes the following issues: These security issues were fixed: - CVE-2017-14517: Prevent NULL Pointer dereference in the XRef::parseEntry() function via a crafted PDF document (bsc#1059066). - CVE-2017-9865: Fixed a stack-based buffer overflow vulnerability in GfxState.cc that would have allowed attackers to facilitate a denial-of-service attack via specially crafted PDF documents. (bsc#1045939) - CVE-2017-14518: Remedy a floating point exception in isImageInterpolationRequired() that could have been exploited using a specially crafted PDF document. (bsc#1059101) - CVE-2017-14520: Remedy a floating point exception in Splash::scaleImageYuXd() that could have been exploited using a specially crafted PDF document. (bsc#1059155) - CVE-2017-14617: Fixed a floating point exception in Stream.cc, which may lead to a potential attack when handling malicious PDF files. (bsc#1060220) - CVE-2017-14928: Fixed a NULL Pointer dereference in AnnotRichMedia::Configuration::Configuration() in Annot.cc, which may lead to a potential attack when handling malicious PDF files. (bsc#1061092) - CVE-2017-14975: Fixed a NULL pointer dereference vulnerability, that existed because a data structure in FoFiType1C.cc was not initialized, which allowed an attacker to launch a denial of service attack. (bsc#1061263) - CVE-2017-14976: Fixed a heap-based buffer over-read vulnerability in FoFiType1C.cc that occurred when an out-of-bounds font dictionary index was encountered, which allowed an attacker to launch a denial of service attack. (bsc#1061264) - CVE-2017-14977: Fixed a NULL pointer dereference vulnerability in the FoFiTrueType::getCFFBlock() function in FoFiTrueType.cc that occurred due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack. (bsc#1061265) - CVE-2017-15565: Prevent NULL Pointer dereference in the GfxImageColorMap::getGrayLine() function via a crafted PDF document (bsc#1064593). - CVE-2017-1000456: Validate boundaries in TextPool::addWord to prevent overflows in subsequent calculations (bsc#1074453). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-648=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpoppler-cpp0-0.43.0-8.1 libpoppler-cpp0-debuginfo-0.43.0-8.1 libpoppler-devel-0.43.0-8.1 libpoppler-glib-devel-0.43.0-8.1 libpoppler-glib8-0.43.0-8.1 libpoppler-glib8-debuginfo-0.43.0-8.1 libpoppler-qt4-4-0.43.0-8.1 libpoppler-qt4-4-debuginfo-0.43.0-8.1 libpoppler-qt4-devel-0.43.0-8.1 libpoppler-qt5-1-0.43.0-8.1 libpoppler-qt5-1-debuginfo-0.43.0-8.1 libpoppler-qt5-devel-0.43.0-8.1 libpoppler60-0.43.0-8.1 libpoppler60-debuginfo-0.43.0-8.1 poppler-debugsource-0.43.0-8.1 poppler-qt-debugsource-0.43.0-8.1 poppler-qt5-debugsource-0.43.0-8.1 poppler-tools-0.43.0-8.1 poppler-tools-debuginfo-0.43.0-8.1 typelib-1_0-Poppler-0_18-0.43.0-8.1 - openSUSE Leap 42.3 (x86_64): libpoppler-cpp0-32bit-0.43.0-8.1 libpoppler-cpp0-debuginfo-32bit-0.43.0-8.1 libpoppler-glib8-32bit-0.43.0-8.1 libpoppler-glib8-debuginfo-32bit-0.43.0-8.1 libpoppler-qt4-4-32bit-0.43.0-8.1 libpoppler-qt4-4-debuginfo-32bit-0.43.0-8.1 libpoppler-qt5-1-32bit-0.43.0-8.1 libpoppler-qt5-1-debuginfo-32bit-0.43.0-8.1 libpoppler60-32bit-0.43.0-8.1 libpoppler60-debuginfo-32bit-0.43.0-8.1 References: https://www.suse.com/security/cve/CVE-2017-1000456.html https://www.suse.com/security/cve/CVE-2017-14517.html https://www.suse.com/security/cve/CVE-2017-14518.html https://www.suse.com/security/cve/CVE-2017-14520.html https://www.suse.com/security/cve/CVE-2017-14617.html https://www.suse.com/security/cve/CVE-2017-14928.html https://www.suse.com/security/cve/CVE-2017-14975.html https://www.suse.com/security/cve/CVE-2017-14976.html https://www.suse.com/security/cve/CVE-2017-14977.html https://www.suse.com/security/cve/CVE-2017-15565.html https://www.suse.com/security/cve/CVE-2017-9865.html https://bugzilla.suse.com/1045939 https://bugzilla.suse.com/1059066 https://bugzilla.suse.com/1059101 https://bugzilla.suse.com/1059155 https://bugzilla.suse.com/1060220 https://bugzilla.suse.com/1061092 https://bugzilla.suse.com/1061263 https://bugzilla.suse.com/1061264 https://bugzilla.suse.com/1061265 https://bugzilla.suse.com/1064593 https://bugzilla.suse.com/1074453 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1719-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1719-1 Rating: important References: #1087066 #1090023 #1090024 #1090025 #1090026 #1090027 #1090028 #1090029 #1090030 #1090032 #1090033 Cross-References: CVE-2018-2790 CVE-2018-2794 CVE-2018-2795 CVE-2018-2796 CVE-2018-2797 CVE-2018-2798 CVE-2018-2799 CVE-2018-2800 CVE-2018-2814 CVE-2018-2815 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-openjdk to version 8u171 fixes the following issues: These security issues were fixed: - S8180881: Better packaging of deserialization - S8182362: Update CipherOutputStream Usage - S8183032: Upgrade to LittleCMS 2.9 - S8189123: More consistent classloading - S8189969, CVE-2018-2790, bsc#1090023: Manifest better manifest entries - S8189977, CVE-2018-2795, bsc#1090025: Improve permission portability - S8189981, CVE-2018-2796, bsc#1090026: Improve queuing portability - S8189985, CVE-2018-2797, bsc#1090027: Improve tabular data portability - S8189989, CVE-2018-2798, bsc#1090028: Improve container portability - S8189993, CVE-2018-2799, bsc#1090029: Improve document portability - S8189997, CVE-2018-2794, bsc#1090024: Enhance keystore mechanisms - S8190478: Improved interface method selection - S8190877: Better handling of abstract classes - S8191696: Better mouse positioning - S8192025, CVE-2018-2814, bsc#1090032: Less referential references - S8192030: Better MTSchema support - S8192757, CVE-2018-2815, bsc#1090033: Improve stub classes implementation - S8193409: Improve AES supporting classes - S8193414: Improvements in MethodType lookups - S8193833, CVE-2018-2800, bsc#1090030: Better RMI connection support For other changes please consult the changelog. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-641=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-641=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.171-24.1 java-1_8_0-openjdk-accessibility-1.8.0.171-24.1 java-1_8_0-openjdk-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-debugsource-1.8.0.171-24.1 java-1_8_0-openjdk-demo-1.8.0.171-24.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-devel-1.8.0.171-24.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-headless-1.8.0.171-24.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-src-1.8.0.171-24.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.171-24.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-accessibility-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-debugsource-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-demo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-devel-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-headless-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-src-1.8.0.171-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.171-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-2790.html https://www.suse.com/security/cve/CVE-2018-2794.html https://www.suse.com/security/cve/CVE-2018-2795.html https://www.suse.com/security/cve/CVE-2018-2796.html https://www.suse.com/security/cve/CVE-2018-2797.html https://www.suse.com/security/cve/CVE-2018-2798.html https://www.suse.com/security/cve/CVE-2018-2799.html https://www.suse.com/security/cve/CVE-2018-2800.html https://www.suse.com/security/cve/CVE-2018-2814.html https://www.suse.com/security/cve/CVE-2018-2815.html https://bugzilla.suse.com/1087066 https://bugzilla.suse.com/1090023 https://bugzilla.suse.com/1090024 https://bugzilla.suse.com/1090025 https://bugzilla.suse.com/1090026 https://bugzilla.suse.com/1090027 https://bugzilla.suse.com/1090028 https://bugzilla.suse.com/1090029 https://bugzilla.suse.com/1090030 https://bugzilla.suse.com/1090032 https://bugzilla.suse.com/1090033 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1710-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1710-1 Rating: important References: #1090023 #1090024 #1090025 #1090026 #1090027 #1090028 #1090029 #1090030 #1090032 #1090033 Cross-References: CVE-2018-2790 CVE-2018-2794 CVE-2018-2795 CVE-2018-2796 CVE-2018-2797 CVE-2018-2798 CVE-2018-2799 CVE-2018-2800 CVE-2018-2814 CVE-2018-2815 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 7u181 fixes the following issues: + S8162488: JDK should be updated to use LittleCMS 2.8 + S8180881: Better packaging of deserialization + S8182362: Update CipherOutputStream Usage + S8183032: Upgrade to LittleCMS 2.9 + S8189123: More consistent classloading + S8190478: Improved interface method selection + S8190877: Better handling of abstract classes + S8191696: Better mouse positioning + S8192030: Better MTSchema support + S8193409: Improve AES supporting classes + S8193414: Improvements in MethodType lookups + S8189969, CVE-2018-2790, bsc#1090023: Manifest better manifest entries + S8189977, CVE-2018-2795, bsc#1090025: Improve permission portability + S8189981, CVE-2018-2796, bsc#1090026: Improve queuing portability + S8189985, CVE-2018-2797, bsc#1090027: Improve tabular data portability + S8189989, CVE-2018-2798, bsc#1090028: Improve container portability + S8189993, CVE-2018-2799, bsc#1090029: Improve document portability + S8189997, CVE-2018-2794, bsc#1090024: Enhance keystore mechanisms + S8192025, CVE-2018-2814, bsc#1090032: Less referential references + S8192757, CVE-2018-2815, bsc#1090033: Improve stub classes implementation + S8193833, CVE-2018-2800, bsc#1090030: Better RMI connection support For additional changes please consult the changelog. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-637=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.181-51.1 java-1_7_0-openjdk-accessibility-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-debugsource-1.7.0.181-51.1 java-1_7_0-openjdk-demo-1.7.0.181-51.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-devel-1.7.0.181-51.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-headless-1.7.0.181-51.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-src-1.7.0.181-51.1 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.181-51.1 References: https://www.suse.com/security/cve/CVE-2018-2790.html https://www.suse.com/security/cve/CVE-2018-2794.html https://www.suse.com/security/cve/CVE-2018-2795.html https://www.suse.com/security/cve/CVE-2018-2796.html https://www.suse.com/security/cve/CVE-2018-2797.html https://www.suse.com/security/cve/CVE-2018-2798.html https://www.suse.com/security/cve/CVE-2018-2799.html https://www.suse.com/security/cve/CVE-2018-2800.html https://www.suse.com/security/cve/CVE-2018-2814.html https://www.suse.com/security/cve/CVE-2018-2815.html https://bugzilla.suse.com/1090023 https://bugzilla.suse.com/1090024 https://bugzilla.suse.com/1090025 https://bugzilla.suse.com/1090026 https://bugzilla.suse.com/1090027 https://bugzilla.suse.com/1090028 https://bugzilla.suse.com/1090029 https://bugzilla.suse.com/1090030 https://bugzilla.suse.com/1090032 https://bugzilla.suse.com/1090033 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1709-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1709-1 Rating: moderate References: #1091610 Cross-References: CVE-2018-1115 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: PostgreSQL was updated to 9.6.9 fixing bugs and security issues: Release notes: - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-9-6-9.html A dump/restore is not required for those running 9.6.X. However, if you use the adminpack extension, you should update it as per the first changelog entry below. Also, if the function marking mistakes mentioned in the second and third changelog entries below affect you, you will want to take steps to correct your database catalogs. Security issue fixed: - CVE-2018-1115: Remove public execute privilege from contrib/adminpack's pg_logfile_rotate() function pg_logfile_rotate() is a deprecated wrapper for the core function pg_rotate_logfile(). When that function was changed to rely on SQL privileges for access control rather than a hard-coded superuser check, pg_logfile_rotate() should have been updated as well, but the need for this was missed. Hence, if adminpack is installed, any user could request a logfile rotation, creating a minor security issue. After installing this update, administrators should update adminpack by performing ALTER EXTENSION adminpack UPDATE in each database in which adminpack is installed. (bsc#1091610) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-638=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libecpg6-9.6.9-18.1 libecpg6-debuginfo-9.6.9-18.1 libpq5-9.6.9-18.1 libpq5-debuginfo-9.6.9-18.1 postgresql96-9.6.9-18.1 postgresql96-contrib-9.6.9-18.1 postgresql96-contrib-debuginfo-9.6.9-18.1 postgresql96-debuginfo-9.6.9-18.1 postgresql96-debugsource-9.6.9-18.1 postgresql96-devel-9.6.9-18.1 postgresql96-devel-debuginfo-9.6.9-18.1 postgresql96-libs-debugsource-9.6.9-18.1 postgresql96-plperl-9.6.9-18.1 postgresql96-plperl-debuginfo-9.6.9-18.1 postgresql96-plpython-9.6.9-18.1 postgresql96-plpython-debuginfo-9.6.9-18.1 postgresql96-pltcl-9.6.9-18.1 postgresql96-pltcl-debuginfo-9.6.9-18.1 postgresql96-server-9.6.9-18.1 postgresql96-server-debuginfo-9.6.9-18.1 postgresql96-test-9.6.9-18.1 - openSUSE Leap 42.3 (x86_64): libecpg6-32bit-9.6.9-18.1 libecpg6-debuginfo-32bit-9.6.9-18.1 libpq5-32bit-9.6.9-18.1 libpq5-debuginfo-32bit-9.6.9-18.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.9-18.1 References: https://www.suse.com/security/cve/CVE-2018-1115.html https://bugzilla.suse.com/1091610 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1708-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1708-1 Rating: moderate References: #1096745 #1097525 Cross-References: CVE-2018-12019 CVE-2018-12020 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures: - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs (boo#1097525) - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode (boo#1096745) This mitigation prevents CVE-2018-12020 from being exploited even if GnuPG is not patched. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-630=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-630=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): enigmail-2.0.7-21.1 - openSUSE Leap 15.0 (x86_64): enigmail-2.0.7-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-12019.html https://www.suse.com/security/cve/CVE-2018-12020.html https://bugzilla.suse.com/1096745 https://bugzilla.suse.com/1097525 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1706-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1706-1 Rating: moderate References: #1096745 #1097525 Cross-References: CVE-2018-12019 CVE-2018-12020 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures: - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs (boo#1097525) - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode (boo#1096745) This mitigation prevents CVE-2018-12020 from being exploited even if GnuPG is not patched. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-630=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.7-18.1 References: https://www.suse.com/security/cve/CVE-2018-12019.html https://www.suse.com/security/cve/CVE-2018-12020.html https://bugzilla.suse.com/1096745 https://bugzilla.suse.com/1097525 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0