January 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:0057-1: important: Security update for wget
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for wget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0057-1 Rating: important References: #1120382 Cross-References: CVE-2018-20483 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wget fixes the following issues: Security issue fixed: - CVE-2018-20483: Fixed an information disclosure through file metadata (bsc#1120382) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-57=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): wget-1.19.5-lp150.2.3.1 wget-debuginfo-1.19.5-lp150.2.3.1 wget-debugsource-1.19.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20483.html https://bugzilla.suse.com/1120382 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0063-1: important: Security update for krb5
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0063-1 Rating: important References: #1120489 Cross-References: CVE-2018-20217 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following issues: Security issue fixed: - CVE-2018-20217: Fixed an assertion issue with older encryption types (bsc#1120489) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-63=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): krb5-1.15.2-lp150.5.3.1 krb5-client-1.15.2-lp150.5.3.1 krb5-client-debuginfo-1.15.2-lp150.5.3.1 krb5-debuginfo-1.15.2-lp150.5.3.1 krb5-debugsource-1.15.2-lp150.5.3.1 krb5-devel-1.15.2-lp150.5.3.1 krb5-mini-1.15.2-lp150.5.3.1 krb5-mini-debuginfo-1.15.2-lp150.5.3.1 krb5-mini-debugsource-1.15.2-lp150.5.3.1 krb5-mini-devel-1.15.2-lp150.5.3.1 krb5-plugin-kdb-ldap-1.15.2-lp150.5.3.1 krb5-plugin-kdb-ldap-debuginfo-1.15.2-lp150.5.3.1 krb5-plugin-preauth-otp-1.15.2-lp150.5.3.1 krb5-plugin-preauth-otp-debuginfo-1.15.2-lp150.5.3.1 krb5-plugin-preauth-pkinit-1.15.2-lp150.5.3.1 krb5-plugin-preauth-pkinit-debuginfo-1.15.2-lp150.5.3.1 krb5-server-1.15.2-lp150.5.3.1 krb5-server-debuginfo-1.15.2-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): krb5-32bit-1.15.2-lp150.5.3.1 krb5-32bit-debuginfo-1.15.2-lp150.5.3.1 krb5-devel-32bit-1.15.2-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20217.html https://bugzilla.suse.com/1120489 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0052-1: important: Security update for mutt
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0052-1 Rating: important References: #1061343 #1094717 #1101428 #1101566 #1101567 #1101568 #1101569 #1101570 #1101571 #1101573 #1101576 #1101577 #1101578 #1101581 #1101582 #1101583 #1101588 #1101589 #1120935 #980830 #982129 #986534 Cross-References: CVE-2014-9116 CVE-2018-14349 CVE-2018-14350 CVE-2018-14351 CVE-2018-14352 CVE-2018-14353 CVE-2018-14354 CVE-2018-14355 CVE-2018-14356 CVE-2018-14357 CVE-2018-14358 CVE-2018-14359 CVE-2018-14360 CVE-2018-14361 CVE-2018-14362 CVE-2018-14363 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 6 fixes is now available. Description: This update for mutt fixes the following issues: Security issues fixed: - bsc#1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583). - CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581). - CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567). - CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578). - CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582). - CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576). - CVE-2018-14355: Fix imap/util.c that mishandles ".." directory traversal in a mailbox name (bsc#1101577). - CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589). - CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588). - CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566). - CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570). - CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571). - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569). - CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573). - CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568). Bug fixes: - mutt reports as neomutt and incorrect version (bsc#1094717) - No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830) - mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129) - (neo)mutt displaying times in Zulu time (bsc#1061343) - mutt unconditionally segfaults when displaying a message (bsc#986534) - For openSUSE Leap 42.3, retain split of -lang and -doc (boo#1120935) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-52=1 Package List: - openSUSE Leap 42.3 (noarch): mutt-doc-1.10.1-2.5.1 mutt-lang-1.10.1-2.5.1 - openSUSE Leap 42.3 (x86_64): mutt-1.10.1-2.5.1 mutt-debuginfo-1.10.1-2.5.1 mutt-debugsource-1.10.1-2.5.1 References: https://www.suse.com/security/cve/CVE-2014-9116.html https://www.suse.com/security/cve/CVE-2018-14349.html https://www.suse.com/security/cve/CVE-2018-14350.html https://www.suse.com/security/cve/CVE-2018-14351.html https://www.suse.com/security/cve/CVE-2018-14352.html https://www.suse.com/security/cve/CVE-2018-14353.html https://www.suse.com/security/cve/CVE-2018-14354.html https://www.suse.com/security/cve/CVE-2018-14355.html https://www.suse.com/security/cve/CVE-2018-14356.html https://www.suse.com/security/cve/CVE-2018-14357.html https://www.suse.com/security/cve/CVE-2018-14358.html https://www.suse.com/security/cve/CVE-2018-14359.html https://www.suse.com/security/cve/CVE-2018-14360.html https://www.suse.com/security/cve/CVE-2018-14361.html https://www.suse.com/security/cve/CVE-2018-14362.html https://www.suse.com/security/cve/CVE-2018-14363.html https://bugzilla.suse.com/1061343 https://bugzilla.suse.com/1094717 https://bugzilla.suse.com/1101428 https://bugzilla.suse.com/1101566 https://bugzilla.suse.com/1101567 https://bugzilla.suse.com/1101568 https://bugzilla.suse.com/1101569 https://bugzilla.suse.com/1101570 https://bugzilla.suse.com/1101571 https://bugzilla.suse.com/1101573 https://bugzilla.suse.com/1101576 https://bugzilla.suse.com/1101577 https://bugzilla.suse.com/1101578 https://bugzilla.suse.com/1101581 https://bugzilla.suse.com/1101582 https://bugzilla.suse.com/1101583 https://bugzilla.suse.com/1101588 https://bugzilla.suse.com/1101589 https://bugzilla.suse.com/1120935 https://bugzilla.suse.com/980830 https://bugzilla.suse.com/982129 https://bugzilla.suse.com/986534 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0048-1: important: Security update for irssi
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0048-1 Rating: important References: #1121396 Cross-References: CVE-2019-5882 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: - CVE-2019-5882: Use after free when hidden lines were expired from the scroll buffer (boo#1121396) This update to the 1.1.2 version also fixes a number of stability issues and bugs. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-48=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-48=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-48=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-48=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.1.2-29.1 irssi-debuginfo-1.1.2-29.1 irssi-debugsource-1.1.2-29.1 irssi-devel-1.1.2-29.1 - openSUSE Leap 15.0 (x86_64): irssi-1.1.2-lp150.2.4.1 irssi-debuginfo-1.1.2-lp150.2.4.1 irssi-debugsource-1.1.2-lp150.2.4.1 irssi-devel-1.1.2-lp150.2.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-bp150.3.4.1 irssi-devel-1.1.2-bp150.3.4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-47.1 irssi-devel-1.1.2-47.1 References: https://www.suse.com/security/cve/CVE-2019-5882.html https://bugzilla.suse.com/1121396 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0050-1: moderate: Security update for aria2
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for aria2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0050-1 Rating: moderate References: #1120488 Cross-References: CVE-2019-3500 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for aria2 fixes the following security issue: - CVE-2019-3500: Metadata and potential password leaks via --log= (boo#1120488) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-50=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-50=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-50=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aria2-1.24.0-4.4.1 aria2-debuginfo-1.24.0-4.4.1 aria2-debugsource-1.24.0-4.4.1 aria2-devel-1.24.0-4.4.1 libaria2-0-1.24.0-4.4.1 libaria2-0-debuginfo-1.24.0-4.4.1 - openSUSE Leap 42.3 (noarch): aria2-lang-1.24.0-4.4.1 - openSUSE Leap 15.0 (x86_64): aria2-1.33.1-lp150.2.4.1 aria2-debuginfo-1.33.1-lp150.2.4.1 aria2-debugsource-1.33.1-lp150.2.4.1 aria2-devel-1.33.1-lp150.2.4.1 libaria2-0-1.33.1-lp150.2.4.1 libaria2-0-debuginfo-1.33.1-lp150.2.4.1 - openSUSE Leap 15.0 (noarch): aria2-lang-1.33.1-lp150.2.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aria2-1.33.1-bp150.3.7.1 aria2-devel-1.33.1-bp150.3.7.1 libaria2-0-1.33.1-bp150.3.7.1 - openSUSE Backports SLE-15 (noarch): aria2-lang-1.33.1-bp150.3.7.1 References: https://www.suse.com/security/cve/CVE-2019-3500.html https://bugzilla.suse.com/1120488 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0048-1: important: Security update for irssi
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0048-1 Rating: important References: #1121396 Cross-References: CVE-2019-5882 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: - CVE-2019-5882: Use after free when hidden lines were expired from the scroll buffer (boo#1121396) This update to the 1.1.2 version also fixes a number of stability issues and bugs. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-48=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-47.1 irssi-devel-1.1.2-47.1 References: https://www.suse.com/security/cve/CVE-2019-5882.html https://bugzilla.suse.com/1121396 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0051-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0051-1 Rating: moderate References: #1010700 #1072728 #1080156 #1087320 #1098377 #1101877 #1110299 Cross-References: CVE-2018-10852 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for sssd provides the following fixes: This security issue was fixed: - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377) These non-security issues were fixed: - Fix a segmentation fault in sss_cache command. (bsc#1072728) - Fix a failure in autofs initialisation sequence upon system boot. (bsc#1010700) - Fix race condition on boot between SSSD and autofs. (bsc#1010700) - Fix a bug where file descriptors were not closed (bsc#1080156) - Fix an issue where sssd logs were not rotated properly (bsc#1080156) - Remove whitespaces from netgroup entries (bsc#1087320) - Remove misleading log messages (bsc#1101877) - exit() the forked process if exec()-ing a child process fails (bsc#1110299) - Do not schedule the machine renewal task if adcli is not executable (bsc#1110299) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-51=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libipa_hbac-devel-1.13.4-12.1 libipa_hbac0-1.13.4-12.1 libipa_hbac0-debuginfo-1.13.4-12.1 libsss_idmap-devel-1.13.4-12.1 libsss_idmap0-1.13.4-12.1 libsss_idmap0-debuginfo-1.13.4-12.1 libsss_nss_idmap-devel-1.13.4-12.1 libsss_nss_idmap0-1.13.4-12.1 libsss_nss_idmap0-debuginfo-1.13.4-12.1 libsss_sudo-1.13.4-12.1 libsss_sudo-debuginfo-1.13.4-12.1 python-ipa_hbac-1.13.4-12.1 python-ipa_hbac-debuginfo-1.13.4-12.1 python-sss_nss_idmap-1.13.4-12.1 python-sss_nss_idmap-debuginfo-1.13.4-12.1 python-sssd-config-1.13.4-12.1 python-sssd-config-debuginfo-1.13.4-12.1 sssd-1.13.4-12.1 sssd-ad-1.13.4-12.1 sssd-ad-debuginfo-1.13.4-12.1 sssd-debuginfo-1.13.4-12.1 sssd-debugsource-1.13.4-12.1 sssd-ipa-1.13.4-12.1 sssd-ipa-debuginfo-1.13.4-12.1 sssd-krb5-1.13.4-12.1 sssd-krb5-common-1.13.4-12.1 sssd-krb5-common-debuginfo-1.13.4-12.1 sssd-krb5-debuginfo-1.13.4-12.1 sssd-ldap-1.13.4-12.1 sssd-ldap-debuginfo-1.13.4-12.1 sssd-proxy-1.13.4-12.1 sssd-proxy-debuginfo-1.13.4-12.1 sssd-tools-1.13.4-12.1 sssd-tools-debuginfo-1.13.4-12.1 - openSUSE Leap 42.3 (x86_64): sssd-32bit-1.13.4-12.1 sssd-debuginfo-32bit-1.13.4-12.1 References: https://www.suse.com/security/cve/CVE-2018-10852.html https://bugzilla.suse.com/1010700 https://bugzilla.suse.com/1072728 https://bugzilla.suse.com/1080156 https://bugzilla.suse.com/1087320 https://bugzilla.suse.com/1098377 https://bugzilla.suse.com/1101877 https://bugzilla.suse.com/1110299 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0022-1: important: Security update for gthumb
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for gthumb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0022-1 Rating: important References: #1113749 Cross-References: CVE-2018-18718 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gthumb fixes the following issues: Security issue fixed: - CVE-2018-18718: Fixed a double-free in add_themes_from_dir function from dlg-contact-sheet.c (boo#1113749) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-22=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-22=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-22=1 Package List: - openSUSE Leap 42.3 (noarch): gthumb-lang-3.4.2-7.3.1 - openSUSE Leap 42.3 (x86_64): gthumb-3.4.2-7.3.1 gthumb-debuginfo-3.4.2-7.3.1 gthumb-debugsource-3.4.2-7.3.1 gthumb-devel-3.4.2-7.3.1 - openSUSE Leap 15.0 (x86_64): gthumb-3.6.1-lp150.3.3.1 gthumb-debuginfo-3.6.1-lp150.3.3.1 gthumb-debugsource-3.6.1-lp150.3.3.1 gthumb-devel-3.6.1-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): gthumb-lang-3.6.1-lp150.3.3.1 - openSUSE Backports SLE-15 (x86_64): gthumb-3.6.1-bp150.2.3.1 gthumb-devel-3.6.1-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): gthumb-lang-3.6.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18718.html https://bugzilla.suse.com/1113749 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0042-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0042-1 Rating: important References: #1101644 #1101645 #1101651 #1101656 #1112142 #1112143 #1112144 #1112146 #1112147 #1112152 #1112153 Cross-References: CVE-2018-13785 CVE-2018-16435 CVE-2018-2938 CVE-2018-2940 CVE-2018-2952 CVE-2018-2973 CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3214 CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 7u201 fixes the following issues: Security issues fixed: - CVE-2018-3136: Manifest better support (bsc#1112142) - CVE-2018-3139: Better HTTP Redirection (bsc#1112143) - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144) - CVE-2018-3169: Improve field accesses (bsc#1112146) - CVE-2018-3180: Improve TLS connections stability (bsc#1112147) - CVE-2018-3214: Better RIFF reading support (bsc#1112152) - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153) - CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile - CVE-2018-2938: Support Derby connections (bsc#1101644) - CVE-2018-2940: Better stack walking (bsc#1101645) - CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651) - CVE-2018-2973: Improve LDAP support (bsc#1101656) - CVE-2018-3639 cpu speculative store bypass mitigation This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-42=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.201-54.1 java-1_7_0-openjdk-accessibility-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-debugsource-1.7.0.201-54.1 java-1_7_0-openjdk-demo-1.7.0.201-54.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-devel-1.7.0.201-54.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-headless-1.7.0.201-54.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-src-1.7.0.201-54.1 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.201-54.1 References: https://www.suse.com/security/cve/CVE-2018-13785.html https://www.suse.com/security/cve/CVE-2018-16435.html https://www.suse.com/security/cve/CVE-2018-2938.html https://www.suse.com/security/cve/CVE-2018-2940.html https://www.suse.com/security/cve/CVE-2018-2952.html https://www.suse.com/security/cve/CVE-2018-2973.html https://www.suse.com/security/cve/CVE-2018-3136.html https://www.suse.com/security/cve/CVE-2018-3139.html https://www.suse.com/security/cve/CVE-2018-3149.html https://www.suse.com/security/cve/CVE-2018-3169.html https://www.suse.com/security/cve/CVE-2018-3180.html https://www.suse.com/security/cve/CVE-2018-3214.html https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1101644 https://bugzilla.suse.com/1101645 https://bugzilla.suse.com/1101651 https://bugzilla.suse.com/1101656 https://bugzilla.suse.com/1112142 https://bugzilla.suse.com/1112143 https://bugzilla.suse.com/1112144 https://bugzilla.suse.com/1112146 https://bugzilla.suse.com/1112147 https://bugzilla.suse.com/1112152 https://bugzilla.suse.com/1112153 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0045-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0045-1 Rating: important References: #1120114 #1120115 #1120116 #1120117 #1120118 #1120119 #1120120 #1120121 #1120122 Cross-References: CVE-2018-15126 CVE-2018-15127 CVE-2018-20019 CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20023 CVE-2018-20024 CVE-2018-6307 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-45=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): LibVNCServer-debugsource-0.9.9-16.6.1 LibVNCServer-devel-0.9.9-16.6.1 libvncclient0-0.9.9-16.6.1 libvncclient0-debuginfo-0.9.9-16.6.1 libvncserver0-0.9.9-16.6.1 libvncserver0-debuginfo-0.9.9-16.6.1 linuxvnc-0.9.9-16.6.1 linuxvnc-debuginfo-0.9.9-16.6.1 References: https://www.suse.com/security/cve/CVE-2018-15126.html https://www.suse.com/security/cve/CVE-2018-15127.html https://www.suse.com/security/cve/CVE-2018-20019.html https://www.suse.com/security/cve/CVE-2018-20020.html https://www.suse.com/security/cve/CVE-2018-20021.html https://www.suse.com/security/cve/CVE-2018-20022.html https://www.suse.com/security/cve/CVE-2018-20023.html https://www.suse.com/security/cve/CVE-2018-20024.html https://www.suse.com/security/cve/CVE-2018-6307.html https://bugzilla.suse.com/1120114 https://bugzilla.suse.com/1120115 https://bugzilla.suse.com/1120116 https://bugzilla.suse.com/1120117 https://bugzilla.suse.com/1120118 https://bugzilla.suse.com/1120119 https://bugzilla.suse.com/1120120 https://bugzilla.suse.com/1120121 https://bugzilla.suse.com/1120122 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0