June 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1625-1: important: Security update for slf4j
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for slf4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1625-1 Rating: important References: #1085970 Cross-References: CVE-2018-8088 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slf4j fixes the following security issue: - CVE-2018-8088: Remote attackers could have bypassed intended access restrictions via crafted data. Disallow EventData deserialization by default from now on (bsc#1085970). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-601=1 Package List: - openSUSE Leap 15.0 (noarch): slf4j-1.7.12-lp150.4.3.1 slf4j-javadoc-1.7.12-lp150.4.3.1 slf4j-manual-1.7.12-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-8088.html https://bugzilla.suse.com/1085970 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1624-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1624-1 Rating: moderate References: #1092094 #1092098 Cross-References: CVE-2018-1000300 CVE-2018-1000301 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for curl to version 7.60.0 fixes the following issues: These security issues were fixed: - CVE-2018-1000300: Prevent heap-based buffer overflow when closing down an FTP connection with very long server command replies (bsc#1092094). - CVE-2018-1000301: Prevent buffer over-read that could have cause reading data beyond the end of a heap based buffer used to store downloaded RTSP content (bsc#1092098). These non-security issues were fixed: - Add CURLOPT_HAPROXYPROTOCOL, support for the HAProxy PROXY protocol - Add --haproxy-protocol for the command line tool - Add CURLOPT_DNS_SHUFFLE_ADDRESSES, shuffle returned IP addresses - FTP: fix typo in recursive callback detection for seeking - test1208: marked flaky - HTTP: make header-less responses still count correct body size - user-agent.d:: mention --proxy-header as well - http2: fixes typo - cleanup: misc typos in strings and comments - rate-limit: use three second window to better handle high speeds - examples/hiperfifo.c: improved - pause: when changing pause state, update socket state - curl_version_info.3: fix ssl_version description - add_handle/easy_perform: clear errorbuffer on start if set - cmake: add support for brotli - parsedate: support UT timezone - vauth/ntlm.h: fix the #ifdef header guard - lib/curl_path.h: added #ifdef header guard - vauth/cleartext: fix integer overflow check - CURLINFO_COOKIELIST.3: made the example not leak memory - cookie.d: mention that "-" as filename means stdin - CURLINFO_SSL_VERIFYRESULT.3: fixed the example - http2: read pending frames (including GOAWAY) in connection-check - timeval: remove compilation warning by casting - cmake: avoid warn-as-error during config checks - travis-ci: enable -Werror for CMake builds - openldap: fix for NULL return from ldap_get_attribute_ber() - threaded resolver: track resolver time and set suitable timeout values - cmake: Add advapi32 as explicit link library for win32 - docs: fix CURLINFO_*_T examples use of CURL_FORMAT_CURL_OFF_T - test1148: set a fixed locale for the test - cookies: when reading from a file, only remove_expired once - cookie: store cookies per top-level-domain-specific hash table - openssl: RESTORED verify locations when verifypeer==0 - file: restore old behavior for file:////foo/bar URLs - FTP: allow PASV on IPv6 connections when a proxy is being used - build-openssl.bat: allow custom paths for VS and perl - winbuild: make the clean target work without build-type - build-openssl.bat: Refer to VS2017 as VC14.1 instead of VC15 - curl: retry on FTP 4xx, ignore other protocols - configure: detect (and use) sa_family_t - examples/sftpuploadresume: Fix Windows large file seek - build: cleanup to fix clang warnings/errors - winbuild: updated the documentation - lib: silence null-dereference warnings - travis: bump to clang 6 and gcc 7 - travis: build libpsl and make builds use it - proxy: show getenv proxy use in verbose output - duphandle: make sure CURLOPT_RESOLVE is duplicated - all: Refactor malloc+memset to use calloc - checksrc: Fix typo - system.h: Add sparcv8plus to oracle/sunpro 32-bit detection - vauth: Fix typo - ssh: show libSSH2 error code when closing fails - test1148: tolerate progress updates better - urldata: make service names unconditional - configure: keep LD_LIBRARY_PATH changes local - ntlm_sspi: fix authentication using Credential Manager - schannel: add client certificate authentication - winbuild: Support custom devel paths for each dependency - schannel: add support for CURLOPT_CAINFO - http2: handle on_begin_headers() called more than once - openssl: support OpenSSL 1.1.1 verbose-mode trace messages - openssl: fix subjectAltName check on non-ASCII platforms - http2: avoid strstr() on data not zero terminated - http2: clear the "drain counter" when a stream is closed - http2: handle GOAWAY properly - tool_help: clarify --max-time unit of time is seconds - curl.1: clarify that options and URLs can be mixed - http2: convert an assert to run-time check - curl_global_sslset: always provide available backends - ftplistparser: keep state between invokes - Curl_memchr: zero length input can't match - examples/sftpuploadresume: typecast fseek argument to long - examples/http2-upload: expand buffer to avoid silly warning - ctype: restore character classification for non-ASCII platforms - mime: avoid NULL pointer dereference risk - cookies: ensure that we have cookies before writing jar - os400.c: fix checksrc warnings - configure: provide --with-wolfssl as an alias for --with-cyassl - cyassl: adapt to libraries without TLS 1.0 support built-in - http2: get rid of another strstr - checksrc: force indentation of lines after an else - cookies: remove unused macro - CURLINFO_PROTOCOL.3: mention the existing defined names - tests: provide 'manual' as a feature to optionally require - travis: enable libssh2 on both macos and Linux - CURLOPT_URL.3: added ENCODING section - wolfssl: Fix non-blocking connect - vtls: don't define MD5_DIGEST_LENGTH for wolfssl - docs: remove extraneous commas in man pages - URL: fix ASCII dependency in strcpy_url and strlen_url - ssh-libssh.c: fix left shift compiler warning - configure: only check for CA bundle for file-using SSL backends - travis: add an mbedtls build - http: don't set the "rewind" flag when not uploading anything - configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h - transfer: don't unset writesockfd on setup of multiplexed conns - vtls: use unified "supports" bitfield member in backends - URLs: fix one more http url - travis: add a build using WolfSSL - openssl: change FILE ops to BIO ops - travis: add build using NSS - smb: reject negative file sizes - cookies: accept parameter names as cookie name - http2: getsock fix for uploads - all over: fixed format specifiers - http2: use the correct function pointer typedef Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-589=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.3.1 curl-debuginfo-7.60.0-lp150.2.3.1 curl-debugsource-7.60.0-lp150.2.3.1 curl-mini-7.60.0-lp150.2.3.1 curl-mini-debuginfo-7.60.0-lp150.2.3.1 curl-mini-debugsource-7.60.0-lp150.2.3.1 libcurl-devel-7.60.0-lp150.2.3.1 libcurl-mini-devel-7.60.0-lp150.2.3.1 libcurl4-7.60.0-lp150.2.3.1 libcurl4-debuginfo-7.60.0-lp150.2.3.1 libcurl4-mini-7.60.0-lp150.2.3.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.3.1 libcurl4-32bit-7.60.0-lp150.2.3.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000300.html https://www.suse.com/security/cve/CVE-2018-1000301.html https://bugzilla.suse.com/1092094 https://bugzilla.suse.com/1092098 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1623-1: important: Security update for xen
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1623-1 Rating: important References: #1027519 #1074562 #1079730 #1092631 Cross-References: CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-3639 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for xen to version 4.10.1 fixes several issues (bsc#1027519). These security issues were fixed: - CVE-2018-3639: Prevent attackers with local user access from extracting information via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1092631). - CVE-2017-5753,CVE-2017-5715,CVE-2017-5754: Improved Spectre v2 mitigations (bsc#1074562). This non-security issue was fixed: - Always call qemus xen-save-devices-state in suspend/resume to fix migration with qcow2 images (bsc#1079730) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-599=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xen-debugsource-4.10.1_04-lp150.2.3.1 xen-devel-4.10.1_04-lp150.2.3.1 xen-libs-4.10.1_04-lp150.2.3.1 xen-libs-debuginfo-4.10.1_04-lp150.2.3.1 xen-tools-domU-4.10.1_04-lp150.2.3.1 xen-tools-domU-debuginfo-4.10.1_04-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): xen-4.10.1_04-lp150.2.3.1 xen-doc-html-4.10.1_04-lp150.2.3.1 xen-libs-32bit-4.10.1_04-lp150.2.3.1 xen-libs-32bit-debuginfo-4.10.1_04-lp150.2.3.1 xen-tools-4.10.1_04-lp150.2.3.1 xen-tools-debuginfo-4.10.1_04-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1079730 https://bugzilla.suse.com/1092631 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1622-1: moderate: Security update for libvorbis
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for libvorbis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1622-1 Rating: moderate References: #1091070 Cross-References: CVE-2018-10392 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvorbis fixes the following issues: The following security issue was fixed: - Fixed the validation of channels in mapping0_forward(), which previously allowed remote attackers to cause a denial of service via specially crafted files (CVE-2018-10392, bsc#1091070) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-591=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvorbis-debugsource-1.3.3-17.1 libvorbis-devel-1.3.3-17.1 libvorbis0-1.3.3-17.1 libvorbis0-debuginfo-1.3.3-17.1 libvorbisenc2-1.3.3-17.1 libvorbisenc2-debuginfo-1.3.3-17.1 libvorbisfile3-1.3.3-17.1 libvorbisfile3-debuginfo-1.3.3-17.1 - openSUSE Leap 42.3 (noarch): libvorbis-doc-1.3.3-17.1 - openSUSE Leap 42.3 (x86_64): libvorbis0-32bit-1.3.3-17.1 libvorbis0-debuginfo-32bit-1.3.3-17.1 libvorbisenc2-32bit-1.3.3-17.1 libvorbisenc2-debuginfo-32bit-1.3.3-17.1 libvorbisfile3-32bit-1.3.3-17.1 libvorbisfile3-debuginfo-32bit-1.3.3-17.1 References: https://www.suse.com/security/cve/CVE-2018-10392.html https://bugzilla.suse.com/1091070 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1621-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1621-1 Rating: important References: #1092885 Cross-References: CVE-2018-3639 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvirt fixes the following issues: This update fixes the following security issue: - Added support for 'ssbd' and 'virt-ssbd' CPUID feature bits (CVE-2018-3639, boo#1092885) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-602=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvirt-4.0.0-lp150.7.3.1 libvirt-admin-4.0.0-lp150.7.3.1 libvirt-admin-debuginfo-4.0.0-lp150.7.3.1 libvirt-client-4.0.0-lp150.7.3.1 libvirt-client-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-4.0.0-lp150.7.3.1 libvirt-daemon-config-network-4.0.0-lp150.7.3.1 libvirt-daemon-config-nwfilter-4.0.0-lp150.7.3.1 libvirt-daemon-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-interface-4.0.0-lp150.7.3.1 libvirt-daemon-driver-interface-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-lxc-4.0.0-lp150.7.3.1 libvirt-daemon-driver-lxc-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-network-4.0.0-lp150.7.3.1 libvirt-daemon-driver-network-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-nodedev-4.0.0-lp150.7.3.1 libvirt-daemon-driver-nodedev-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-nwfilter-4.0.0-lp150.7.3.1 libvirt-daemon-driver-nwfilter-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-qemu-4.0.0-lp150.7.3.1 libvirt-daemon-driver-qemu-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-secret-4.0.0-lp150.7.3.1 libvirt-daemon-driver-secret-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-core-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-core-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-disk-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-disk-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-iscsi-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-iscsi-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-logical-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-logical-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-mpath-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-mpath-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-scsi-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-scsi-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-uml-4.0.0-lp150.7.3.1 libvirt-daemon-driver-uml-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-vbox-4.0.0-lp150.7.3.1 libvirt-daemon-driver-vbox-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-hooks-4.0.0-lp150.7.3.1 libvirt-daemon-lxc-4.0.0-lp150.7.3.1 libvirt-daemon-qemu-4.0.0-lp150.7.3.1 libvirt-daemon-uml-4.0.0-lp150.7.3.1 libvirt-daemon-vbox-4.0.0-lp150.7.3.1 libvirt-debugsource-4.0.0-lp150.7.3.1 libvirt-devel-4.0.0-lp150.7.3.1 libvirt-doc-4.0.0-lp150.7.3.1 libvirt-libs-4.0.0-lp150.7.3.1 libvirt-libs-debuginfo-4.0.0-lp150.7.3.1 libvirt-lock-sanlock-4.0.0-lp150.7.3.1 libvirt-lock-sanlock-debuginfo-4.0.0-lp150.7.3.1 libvirt-nss-4.0.0-lp150.7.3.1 libvirt-nss-debuginfo-4.0.0-lp150.7.3.1 wireshark-plugin-libvirt-4.0.0-lp150.7.3.1 wireshark-plugin-libvirt-debuginfo-4.0.0-lp150.7.3.1 - openSUSE Leap 15.0 (x86_64): libvirt-client-32bit-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-libxl-4.0.0-lp150.7.3.1 libvirt-daemon-driver-libxl-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-rbd-4.0.0-lp150.7.3.1 libvirt-daemon-driver-storage-rbd-debuginfo-4.0.0-lp150.7.3.1 libvirt-daemon-xen-4.0.0-lp150.7.3.1 libvirt-devel-32bit-4.0.0-lp150.7.3.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1092885 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1616-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 08 Jun '18

08 Jun '18

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1616-1 Rating: important References: #1093059 #1094747 #1096449 #1096515 Cross-References: CVE-2018-6126 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: Security issue fixed in Mozilla Firefox 60.0.2 ESR: - CVE-2018-6126: Heap buffer overflow rasterizing paths in SVG with Skia (MFSA 2018-14, boo#1096449) The following bugs were fixed: - In KDE Open with option in download dialog has no effect with kmozillahelper (boo#1094747) - Startup crashes on aarch64 (boo#1093059) Mozilla Firefox now requires NSS 3.36.4 (boo#1096515). The following changes are included in NSS: - Fix issues connecting to servers recently upgraded to TLS 1.3 (SSL_RX_MALFORMED_SERVER_HELLO error) - Fix a rare bug with PKCS#12 files - Apply additional harding (relro linker option) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-575=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-575=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libfreebl3-3.36.4-50.1 libfreebl3-debuginfo-3.36.4-50.1 libsoftokn3-3.36.4-50.1 libsoftokn3-debuginfo-3.36.4-50.1 mozilla-nss-3.36.4-50.1 mozilla-nss-certs-3.36.4-50.1 mozilla-nss-certs-debuginfo-3.36.4-50.1 mozilla-nss-debuginfo-3.36.4-50.1 mozilla-nss-debugsource-3.36.4-50.1 mozilla-nss-devel-3.36.4-50.1 mozilla-nss-sysinit-3.36.4-50.1 mozilla-nss-sysinit-debuginfo-3.36.4-50.1 mozilla-nss-tools-3.36.4-50.1 mozilla-nss-tools-debuginfo-3.36.4-50.1 - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.0.2-101.1 MozillaFirefox-branding-upstream-60.0.2-101.1 MozillaFirefox-buildsymbols-60.0.2-101.1 MozillaFirefox-debuginfo-60.0.2-101.1 MozillaFirefox-debugsource-60.0.2-101.1 MozillaFirefox-devel-60.0.2-101.1 MozillaFirefox-translations-common-60.0.2-101.1 MozillaFirefox-translations-other-60.0.2-101.1 libfreebl3-32bit-3.36.4-50.1 libfreebl3-debuginfo-32bit-3.36.4-50.1 libsoftokn3-32bit-3.36.4-50.1 libsoftokn3-debuginfo-32bit-3.36.4-50.1 mozilla-nss-32bit-3.36.4-50.1 mozilla-nss-certs-32bit-3.36.4-50.1 mozilla-nss-certs-debuginfo-32bit-3.36.4-50.1 mozilla-nss-debuginfo-32bit-3.36.4-50.1 mozilla-nss-sysinit-32bit-3.36.4-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.36.4-50.1 - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.36.4-lp150.2.3.1 libfreebl3-debuginfo-3.36.4-lp150.2.3.1 libsoftokn3-3.36.4-lp150.2.3.1 libsoftokn3-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-3.36.4-lp150.2.3.1 mozilla-nss-certs-3.36.4-lp150.2.3.1 mozilla-nss-certs-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-debugsource-3.36.4-lp150.2.3.1 mozilla-nss-devel-3.36.4-lp150.2.3.1 mozilla-nss-sysinit-3.36.4-lp150.2.3.1 mozilla-nss-sysinit-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-tools-3.36.4-lp150.2.3.1 mozilla-nss-tools-debuginfo-3.36.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.0.2-lp150.3.6.1 MozillaFirefox-branding-upstream-60.0.2-lp150.3.6.1 MozillaFirefox-buildsymbols-60.0.2-lp150.3.6.1 MozillaFirefox-debuginfo-60.0.2-lp150.3.6.1 MozillaFirefox-debugsource-60.0.2-lp150.3.6.1 MozillaFirefox-devel-60.0.2-lp150.3.6.1 MozillaFirefox-translations-common-60.0.2-lp150.3.6.1 MozillaFirefox-translations-other-60.0.2-lp150.3.6.1 libfreebl3-32bit-3.36.4-lp150.2.3.1 libfreebl3-32bit-debuginfo-3.36.4-lp150.2.3.1 libsoftokn3-32bit-3.36.4-lp150.2.3.1 libsoftokn3-32bit-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-32bit-3.36.4-lp150.2.3.1 mozilla-nss-32bit-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-certs-32bit-3.36.4-lp150.2.3.1 mozilla-nss-certs-32bit-debuginfo-3.36.4-lp150.2.3.1 mozilla-nss-sysinit-32bit-3.36.4-lp150.2.3.1 mozilla-nss-sysinit-32bit-debuginfo-3.36.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-6126.html https://bugzilla.suse.com/1093059 https://bugzilla.suse.com/1094747 https://bugzilla.suse.com/1096449 https://bugzilla.suse.com/1096515 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1600-1: important: Security update for glibc
by opensuse-security＠opensuse.org 07 Jun '18

07 Jun '18

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1600-1 Rating: important References: #1086690 #1094150 #1094154 #1094161 Cross-References: CVE-2017-18269 CVE-2018-11236 CVE-2018-11237 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for glibc fixes the following issues: - CVE-2017-18269: Fix SSE2 memmove issue when crossing 2GB boundary (bsc#1094150) - CVE-2018-11236: Fix overflow in path length computation (bsc#1094161) - CVE-2018-11237: Don't write beyond buffer destination in __mempcpy_avx512_no_vzeroupper (bsc#1094154) Non security bugs fixed: - Fix crash in resolver on memory allocation failure (bsc#1086690) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-567=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): glibc-2.22-19.1 glibc-debuginfo-2.22-19.1 glibc-debugsource-2.22-19.1 glibc-devel-2.22-19.1 glibc-devel-debuginfo-2.22-19.1 glibc-devel-static-2.22-19.1 glibc-extra-2.22-19.1 glibc-extra-debuginfo-2.22-19.1 glibc-locale-2.22-19.1 glibc-locale-debuginfo-2.22-19.1 glibc-profile-2.22-19.1 glibc-utils-2.22-19.1 glibc-utils-debuginfo-2.22-19.1 glibc-utils-debugsource-2.22-19.1 nscd-2.22-19.1 nscd-debuginfo-2.22-19.1 - openSUSE Leap 42.3 (noarch): glibc-html-2.22-19.1 glibc-i18ndata-2.22-19.1 glibc-info-2.22-19.1 - openSUSE Leap 42.3 (x86_64): glibc-32bit-2.22-19.2 glibc-debuginfo-32bit-2.22-19.2 glibc-devel-32bit-2.22-19.2 glibc-devel-debuginfo-32bit-2.22-19.2 glibc-devel-static-32bit-2.22-19.2 glibc-locale-32bit-2.22-19.2 glibc-locale-debuginfo-32bit-2.22-19.2 glibc-profile-32bit-2.22-19.2 glibc-utils-32bit-2.22-19.1 glibc-utils-debuginfo-32bit-2.22-19.1 - openSUSE Leap 42.3 (i586): glibc-obsolete-2.22-19.1 glibc-obsolete-debuginfo-2.22-19.1 - openSUSE Leap 42.3 (i686): glibc-2.22-19.2 glibc-debuginfo-2.22-19.2 glibc-debugsource-2.22-19.2 glibc-devel-2.22-19.2 glibc-devel-debuginfo-2.22-19.2 glibc-devel-static-2.22-19.2 glibc-locale-2.22-19.2 glibc-locale-debuginfo-2.22-19.2 glibc-profile-2.22-19.2 References: https://www.suse.com/security/cve/CVE-2017-18269.html https://www.suse.com/security/cve/CVE-2018-11236.html https://www.suse.com/security/cve/CVE-2018-11237.html https://bugzilla.suse.com/1086690 https://bugzilla.suse.com/1094150 https://bugzilla.suse.com/1094154 https://bugzilla.suse.com/1094161 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1596-1: important: Security update for xdg-utils
by opensuse-security＠opensuse.org 07 Jun '18

07 Jun '18

openSUSE Security Update: Security update for xdg-utils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1596-1 Rating: important References: #1093086 Cross-References: CVE-2017-18266 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xdg-utils fixes this security issues: - CVE-2017-18266: The open_envvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL (bsc#1093086). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-573=1 Package List: - openSUSE Leap 15.0 (noarch): xdg-utils-20170508-lp150.3.3.2 References: https://www.suse.com/security/cve/CVE-2017-18266.html https://bugzilla.suse.com/1093086 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1595-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 07 Jun '18

07 Jun '18

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1595-1 Rating: moderate References: #1088681 #1089987 #1090518 #1092544 Cross-References: CVE-2018-2755 CVE-2018-2759 CVE-2018-2761 CVE-2018-2766 CVE-2018-2767 CVE-2018-2771 CVE-2018-2777 CVE-2018-2781 CVE-2018-2782 CVE-2018-2784 CVE-2018-2786 CVE-2018-2787 CVE-2018-2810 CVE-2018-2813 CVE-2018-2817 CVE-2018-2819 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for mariadb to version 10.2.15 fixes the following issues: These security issues were fixed: - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library (Return of BACKRONYM) (bsc#1088681). - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1089987). - CVE-2018-2759: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987). - CVE-2018-2777: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987). - CVE-2018-2810: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987). - CVE-2018-2782: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2784: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2787: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1089987, bsc#1090518). - CVE-2018-2766: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2755: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Difficult to exploit vulnerability allowed unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2819: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2817: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2761: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2781: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2771: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Locking). Difficult to exploit vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518). - CVE-2018-2813: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data (bsc#1089987, bsc#1090518). These non-security issues were fixed: - PCRE updated to 8.42 - Incomplete validation of missing tablespace during recovery - ib_buffer_pool unnecessarily includes the temporary tablespace - InnoDB may write uninitialized garbage to redo log - Virtual Columns: Assertion failed in dict_table_get_col_name - slow innodb startup/shutdown can exceed systemd timeout - Assertion failed in dict_check_sys_tables on upgrade from 5.5 - Change buffer crash during TRUNCATE or DROP TABLE - temporary table ROLLBACK fixes For additional details please see - https://mariadb.com/kb/en/library/mariadb-10215-release-notes - https://mariadb.com/kb/en/library/mariadb-10215-changelog Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-572=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmysqld-devel-10.2.15-lp150.2.3.2 libmysqld19-10.2.15-lp150.2.3.2 libmysqld19-debuginfo-10.2.15-lp150.2.3.2 mariadb-10.2.15-lp150.2.3.2 mariadb-bench-10.2.15-lp150.2.3.2 mariadb-bench-debuginfo-10.2.15-lp150.2.3.2 mariadb-client-10.2.15-lp150.2.3.2 mariadb-client-debuginfo-10.2.15-lp150.2.3.2 mariadb-debuginfo-10.2.15-lp150.2.3.2 mariadb-debugsource-10.2.15-lp150.2.3.2 mariadb-galera-10.2.15-lp150.2.3.2 mariadb-test-10.2.15-lp150.2.3.2 mariadb-test-debuginfo-10.2.15-lp150.2.3.2 mariadb-tools-10.2.15-lp150.2.3.2 mariadb-tools-debuginfo-10.2.15-lp150.2.3.2 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.15-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-2755.html https://www.suse.com/security/cve/CVE-2018-2759.html https://www.suse.com/security/cve/CVE-2018-2761.html https://www.suse.com/security/cve/CVE-2018-2766.html https://www.suse.com/security/cve/CVE-2018-2767.html https://www.suse.com/security/cve/CVE-2018-2771.html https://www.suse.com/security/cve/CVE-2018-2777.html https://www.suse.com/security/cve/CVE-2018-2781.html https://www.suse.com/security/cve/CVE-2018-2782.html https://www.suse.com/security/cve/CVE-2018-2784.html https://www.suse.com/security/cve/CVE-2018-2786.html https://www.suse.com/security/cve/CVE-2018-2787.html https://www.suse.com/security/cve/CVE-2018-2810.html https://www.suse.com/security/cve/CVE-2018-2813.html https://www.suse.com/security/cve/CVE-2018-2817.html https://www.suse.com/security/cve/CVE-2018-2819.html https://bugzilla.suse.com/1088681 https://bugzilla.suse.com/1089987 https://bugzilla.suse.com/1090518 https://bugzilla.suse.com/1092544 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1564-1: moderate: Security update for zziplib
by opensuse-security＠opensuse.org 07 Jun '18

07 Jun '18

openSUSE Security Update: Security update for zziplib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1564-1 Rating: moderate References: #1079094 Cross-References: CVE-2018-6542 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zziplib fixes the following issues: Security issue fixed: - CVE-2018-6542: Reject file if the size of the central directory is too big and display an error message (bsc#1079094). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-560=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libzzip-0-13-0.13.67-13.9.1 libzzip-0-13-debuginfo-0.13.67-13.9.1 zziplib-debugsource-0.13.67-13.9.1 zziplib-devel-0.13.67-13.9.1 zziplib-devel-debuginfo-0.13.67-13.9.1 - openSUSE Leap 42.3 (x86_64): libzzip-0-13-32bit-0.13.67-13.9.1 libzzip-0-13-debuginfo-32bit-0.13.67-13.9.1 zziplib-devel-32bit-0.13.67-13.9.1 zziplib-devel-debuginfo-32bit-0.13.67-13.9.1 References: https://www.suse.com/security/cve/CVE-2018-6542.html https://bugzilla.suse.com/1079094 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0