August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2567-1: important: Security update for libX11
by opensuse-security＠opensuse.org 31 Aug '18

31 Aug '18

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2567-1 Rating: important References: #1102062 #1102068 #1102073 Cross-References: CVE-2018-14598 CVE-2018-14599 CVE-2018-14600 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libX11 fixes the following issues: Security issues fixed: - CVE-2018-14598: Fixed a crash on invalid reply in XListExtensions (boo#1102073) - CVE-2018-14599: Fixed an off-by-one write in XListExtensions (boo#1102062) - CVE-2018-14600: Fixed an out of boundary write in XListExtensions (boo#1102068) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-945=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libX11-6-1.6.3-10.3.1 libX11-6-debuginfo-1.6.3-10.3.1 libX11-debugsource-1.6.3-10.3.1 libX11-devel-1.6.3-10.3.1 libX11-xcb1-1.6.3-10.3.1 libX11-xcb1-debuginfo-1.6.3-10.3.1 - openSUSE Leap 42.3 (noarch): libX11-data-1.6.3-10.3.1 - openSUSE Leap 42.3 (x86_64): libX11-6-32bit-1.6.3-10.3.1 libX11-6-debuginfo-32bit-1.6.3-10.3.1 libX11-devel-32bit-1.6.3-10.3.1 libX11-xcb1-32bit-1.6.3-10.3.1 libX11-xcb1-debuginfo-32bit-1.6.3-10.3.1 References: https://www.suse.com/security/cve/CVE-2018-14598.html https://www.suse.com/security/cve/CVE-2018-14599.html https://www.suse.com/security/cve/CVE-2018-14600.html https://bugzilla.suse.com/1102062 https://bugzilla.suse.com/1102068 https://bugzilla.suse.com/1102073 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2533-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 28 Aug '18

28 Aug '18

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2533-1 Rating: moderate References: #1050305 #1088262 #1091606 #1091772 #1092699 #1094359 #1096673 Cross-References: CVE-2018-10583 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for libreoffice to 6.0.5.2 fixes the following issues: Security issues fixed: - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606) Non security issues fixed: - Bugfix: Table borders appear black in LibreOffice (while white in PowerPoint) (bsc#1088262) - Bugfix: LibreOffice extension 'Language Tool' fails after Tumbleweed update (bsc#1050305) - Bugfix: libreoffice-gnome can no longer be installed in parallel to libreoffice-gtk3 as there is a potential file conflict (bsc#1096673) - Bugfix: LibreOffice Writer: Text in boxes were not visible (bsc#1094359) - Use libreoffice-gtk3 if xfce is present (bsc#1092699) - Various other bug fixes This update was imported fromm the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-942=1 Package List: - openSUSE Leap 15.0 (noarch): libreoffice-branding-upstream-6.0.5.2-lp150.2.3.1 libreoffice-gdb-pretty-printers-6.0.5.2-lp150.2.3.1 libreoffice-glade-6.0.5.2-lp150.2.3.1 libreoffice-icon-themes-6.0.5.2-lp150.2.3.1 libreoffice-l10n-af-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ar-6.0.5.2-lp150.2.3.1 libreoffice-l10n-as-6.0.5.2-lp150.2.3.1 libreoffice-l10n-bg-6.0.5.2-lp150.2.3.1 libreoffice-l10n-bn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-br-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ca-6.0.5.2-lp150.2.3.1 libreoffice-l10n-cs-6.0.5.2-lp150.2.3.1 libreoffice-l10n-cy-6.0.5.2-lp150.2.3.1 libreoffice-l10n-da-6.0.5.2-lp150.2.3.1 libreoffice-l10n-de-6.0.5.2-lp150.2.3.1 libreoffice-l10n-dz-6.0.5.2-lp150.2.3.1 libreoffice-l10n-el-6.0.5.2-lp150.2.3.1 libreoffice-l10n-en-6.0.5.2-lp150.2.3.1 libreoffice-l10n-eo-6.0.5.2-lp150.2.3.1 libreoffice-l10n-es-6.0.5.2-lp150.2.3.1 libreoffice-l10n-et-6.0.5.2-lp150.2.3.1 libreoffice-l10n-eu-6.0.5.2-lp150.2.3.1 libreoffice-l10n-fa-6.0.5.2-lp150.2.3.1 libreoffice-l10n-fi-6.0.5.2-lp150.2.3.1 libreoffice-l10n-fr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ga-6.0.5.2-lp150.2.3.1 libreoffice-l10n-gl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-gu-6.0.5.2-lp150.2.3.1 libreoffice-l10n-he-6.0.5.2-lp150.2.3.1 libreoffice-l10n-hi-6.0.5.2-lp150.2.3.1 libreoffice-l10n-hr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-hu-6.0.5.2-lp150.2.3.1 libreoffice-l10n-it-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ja-6.0.5.2-lp150.2.3.1 libreoffice-l10n-kk-6.0.5.2-lp150.2.3.1 libreoffice-l10n-kn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ko-6.0.5.2-lp150.2.3.1 libreoffice-l10n-lt-6.0.5.2-lp150.2.3.1 libreoffice-l10n-lv-6.0.5.2-lp150.2.3.1 libreoffice-l10n-mai-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ml-6.0.5.2-lp150.2.3.1 libreoffice-l10n-mr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nb-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nso-6.0.5.2-lp150.2.3.1 libreoffice-l10n-or-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pa-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pt_BR-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pt_PT-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ro-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ru-6.0.5.2-lp150.2.3.1 libreoffice-l10n-si-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sk-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ss-6.0.5.2-lp150.2.3.1 libreoffice-l10n-st-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sv-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ta-6.0.5.2-lp150.2.3.1 libreoffice-l10n-te-6.0.5.2-lp150.2.3.1 libreoffice-l10n-th-6.0.5.2-lp150.2.3.1 libreoffice-l10n-tn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-tr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ts-6.0.5.2-lp150.2.3.1 libreoffice-l10n-uk-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ve-6.0.5.2-lp150.2.3.1 libreoffice-l10n-xh-6.0.5.2-lp150.2.3.1 libreoffice-l10n-zh_CN-6.0.5.2-lp150.2.3.1 libreoffice-l10n-zh_TW-6.0.5.2-lp150.2.3.1 libreoffice-l10n-zu-6.0.5.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libreoffice-6.0.5.2-lp150.2.3.1 libreoffice-base-6.0.5.2-lp150.2.3.1 libreoffice-base-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-firebird-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-firebird-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-mysql-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-mysql-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-postgresql-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-postgresql-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-calc-6.0.5.2-lp150.2.3.1 libreoffice-calc-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-calc-extensions-6.0.5.2-lp150.2.3.1 libreoffice-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-debugsource-6.0.5.2-lp150.2.3.1 libreoffice-draw-6.0.5.2-lp150.2.3.1 libreoffice-draw-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-filters-optional-6.0.5.2-lp150.2.3.1 libreoffice-gnome-6.0.5.2-lp150.2.3.1 libreoffice-gnome-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-gtk2-6.0.5.2-lp150.2.3.1 libreoffice-gtk2-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-gtk3-6.0.5.2-lp150.2.3.1 libreoffice-gtk3-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-impress-6.0.5.2-lp150.2.3.1 libreoffice-impress-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-kde4-6.0.5.2-lp150.2.3.1 libreoffice-kde4-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-mailmerge-6.0.5.2-lp150.2.3.1 libreoffice-math-6.0.5.2-lp150.2.3.1 libreoffice-math-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-officebean-6.0.5.2-lp150.2.3.1 libreoffice-officebean-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-pyuno-6.0.5.2-lp150.2.3.1 libreoffice-pyuno-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-sdk-6.0.5.2-lp150.2.3.1 libreoffice-sdk-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-sdk-doc-6.0.5.2-lp150.2.3.1 libreoffice-writer-6.0.5.2-lp150.2.3.1 libreoffice-writer-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-writer-extensions-6.0.5.2-lp150.2.3.1 libreofficekit-6.0.5.2-lp150.2.3.1 libreofficekit-devel-6.0.5.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10583.html https://bugzilla.suse.com/1050305 https://bugzilla.suse.com/1088262 https://bugzilla.suse.com/1091606 https://bugzilla.suse.com/1091772 https://bugzilla.suse.com/1092699 https://bugzilla.suse.com/1094359 https://bugzilla.suse.com/1096673 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2532-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 28 Aug '18

28 Aug '18

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2532-1 Rating: moderate References: #1050305 #1088262 #1088263 #1091606 #1091772 #1092699 #1094359 #1095601 #1095639 #1096673 #1098891 Cross-References: CVE-2018-10583 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 10 fixes is now available. Description: This update for libreoffice to 6.0.5.2 fixes the following issues: Security issues fixed: - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606) Non security issues fixed: - Bugfix: Table borders appear black in LibreOffice (while white in PowerPoint) (bsc#1088262) - Bugfix: LibreOffice extension 'Language Tool' fails after Tumbleweed update (bsc#1050305) - Bugfix: libreoffice-gnome can no longer be installed in parallel to libreoffice-gtk3 as there is a potential file conflict (bsc#1096673) - Bugfix: LibreOffice Writer: Text in boxes were not visible (bsc#1094359) - Use libreoffice-gtk3 if xfce is present (bsc#1092699) - Various other bug fixes - Exporting to PPTX results in vertical labels being shown horizontally (bsc#1095639) - Table in PPTX misplaced and partly blue (bsc#1098891) - Labels in chart change (from white and other colors) to black when saving as PPTX (bsc#1088263) - Exporting to PPTX shifts arrow shapes quite a bit bsc#1095601 This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-941=1 Package List: - openSUSE Leap 42.3 (x86_64): libreoffice-6.0.5.2-24.2 libreoffice-base-6.0.5.2-24.2 libreoffice-base-debuginfo-6.0.5.2-24.2 libreoffice-base-drivers-mysql-6.0.5.2-24.2 libreoffice-base-drivers-mysql-debuginfo-6.0.5.2-24.2 libreoffice-base-drivers-postgresql-6.0.5.2-24.2 libreoffice-base-drivers-postgresql-debuginfo-6.0.5.2-24.2 libreoffice-calc-6.0.5.2-24.2 libreoffice-calc-debuginfo-6.0.5.2-24.2 libreoffice-calc-extensions-6.0.5.2-24.2 libreoffice-debuginfo-6.0.5.2-24.2 libreoffice-debugsource-6.0.5.2-24.2 libreoffice-draw-6.0.5.2-24.2 libreoffice-draw-debuginfo-6.0.5.2-24.2 libreoffice-filters-optional-6.0.5.2-24.2 libreoffice-gnome-6.0.5.2-24.2 libreoffice-gnome-debuginfo-6.0.5.2-24.2 libreoffice-gtk2-6.0.5.2-24.2 libreoffice-gtk2-debuginfo-6.0.5.2-24.2 libreoffice-gtk3-6.0.5.2-24.2 libreoffice-gtk3-debuginfo-6.0.5.2-24.2 libreoffice-impress-6.0.5.2-24.2 libreoffice-impress-debuginfo-6.0.5.2-24.2 libreoffice-kde4-6.0.5.2-24.2 libreoffice-kde4-debuginfo-6.0.5.2-24.2 libreoffice-mailmerge-6.0.5.2-24.2 libreoffice-math-6.0.5.2-24.2 libreoffice-math-debuginfo-6.0.5.2-24.2 libreoffice-officebean-6.0.5.2-24.2 libreoffice-officebean-debuginfo-6.0.5.2-24.2 libreoffice-pyuno-6.0.5.2-24.2 libreoffice-pyuno-debuginfo-6.0.5.2-24.2 libreoffice-sdk-6.0.5.2-24.2 libreoffice-sdk-debuginfo-6.0.5.2-24.2 libreoffice-sdk-doc-6.0.5.2-24.2 libreoffice-writer-6.0.5.2-24.2 libreoffice-writer-debuginfo-6.0.5.2-24.2 libreoffice-writer-extensions-6.0.5.2-24.2 libreofficekit-6.0.5.2-24.2 libreofficekit-devel-6.0.5.2-24.2 - openSUSE Leap 42.3 (noarch): libreoffice-branding-upstream-6.0.5.2-24.2 libreoffice-gdb-pretty-printers-6.0.5.2-24.2 libreoffice-glade-6.0.5.2-24.2 libreoffice-icon-themes-6.0.5.2-24.2 libreoffice-l10n-af-6.0.5.2-24.2 libreoffice-l10n-ar-6.0.5.2-24.2 libreoffice-l10n-as-6.0.5.2-24.2 libreoffice-l10n-bg-6.0.5.2-24.2 libreoffice-l10n-bn-6.0.5.2-24.2 libreoffice-l10n-br-6.0.5.2-24.2 libreoffice-l10n-ca-6.0.5.2-24.2 libreoffice-l10n-cs-6.0.5.2-24.2 libreoffice-l10n-cy-6.0.5.2-24.2 libreoffice-l10n-da-6.0.5.2-24.2 libreoffice-l10n-de-6.0.5.2-24.2 libreoffice-l10n-dz-6.0.5.2-24.2 libreoffice-l10n-el-6.0.5.2-24.2 libreoffice-l10n-en-6.0.5.2-24.2 libreoffice-l10n-eo-6.0.5.2-24.2 libreoffice-l10n-es-6.0.5.2-24.2 libreoffice-l10n-et-6.0.5.2-24.2 libreoffice-l10n-eu-6.0.5.2-24.2 libreoffice-l10n-fa-6.0.5.2-24.2 libreoffice-l10n-fi-6.0.5.2-24.2 libreoffice-l10n-fr-6.0.5.2-24.2 libreoffice-l10n-ga-6.0.5.2-24.2 libreoffice-l10n-gl-6.0.5.2-24.2 libreoffice-l10n-gu-6.0.5.2-24.2 libreoffice-l10n-he-6.0.5.2-24.2 libreoffice-l10n-hi-6.0.5.2-24.2 libreoffice-l10n-hr-6.0.5.2-24.2 libreoffice-l10n-hu-6.0.5.2-24.2 libreoffice-l10n-it-6.0.5.2-24.2 libreoffice-l10n-ja-6.0.5.2-24.2 libreoffice-l10n-kk-6.0.5.2-24.2 libreoffice-l10n-kn-6.0.5.2-24.2 libreoffice-l10n-ko-6.0.5.2-24.2 libreoffice-l10n-lt-6.0.5.2-24.2 libreoffice-l10n-lv-6.0.5.2-24.2 libreoffice-l10n-mai-6.0.5.2-24.2 libreoffice-l10n-ml-6.0.5.2-24.2 libreoffice-l10n-mr-6.0.5.2-24.2 libreoffice-l10n-nb-6.0.5.2-24.2 libreoffice-l10n-nl-6.0.5.2-24.2 libreoffice-l10n-nn-6.0.5.2-24.2 libreoffice-l10n-nr-6.0.5.2-24.2 libreoffice-l10n-nso-6.0.5.2-24.2 libreoffice-l10n-or-6.0.5.2-24.2 libreoffice-l10n-pa-6.0.5.2-24.2 libreoffice-l10n-pl-6.0.5.2-24.2 libreoffice-l10n-pt_BR-6.0.5.2-24.2 libreoffice-l10n-pt_PT-6.0.5.2-24.2 libreoffice-l10n-ro-6.0.5.2-24.2 libreoffice-l10n-ru-6.0.5.2-24.2 libreoffice-l10n-si-6.0.5.2-24.2 libreoffice-l10n-sk-6.0.5.2-24.2 libreoffice-l10n-sl-6.0.5.2-24.2 libreoffice-l10n-sr-6.0.5.2-24.2 libreoffice-l10n-ss-6.0.5.2-24.2 libreoffice-l10n-st-6.0.5.2-24.2 libreoffice-l10n-sv-6.0.5.2-24.2 libreoffice-l10n-ta-6.0.5.2-24.2 libreoffice-l10n-te-6.0.5.2-24.2 libreoffice-l10n-th-6.0.5.2-24.2 libreoffice-l10n-tn-6.0.5.2-24.2 libreoffice-l10n-tr-6.0.5.2-24.2 libreoffice-l10n-ts-6.0.5.2-24.2 libreoffice-l10n-uk-6.0.5.2-24.2 libreoffice-l10n-ve-6.0.5.2-24.2 libreoffice-l10n-xh-6.0.5.2-24.2 libreoffice-l10n-zh_CN-6.0.5.2-24.2 libreoffice-l10n-zh_TW-6.0.5.2-24.2 libreoffice-l10n-zu-6.0.5.2-24.2 References: https://www.suse.com/security/cve/CVE-2018-10583.html https://bugzilla.suse.com/1050305 https://bugzilla.suse.com/1088262 https://bugzilla.suse.com/1088263 https://bugzilla.suse.com/1091606 https://bugzilla.suse.com/1091772 https://bugzilla.suse.com/1092699 https://bugzilla.suse.com/1094359 https://bugzilla.suse.com/1095601 https://bugzilla.suse.com/1095639 https://bugzilla.suse.com/1096673 https://bugzilla.suse.com/1098891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2525-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2525-1 Rating: moderate References: #1105726 Cross-References: CVE-2018-15605 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.3 addresses multiple issues. Security issues fixed: - CVE-2018-15605: vulnerability in the file import feature allowed cross-site scripting via importing a specially-crafted file (PMASA-2018-5, boo#1105726) This update also contains a number of upstream bug fixes in the UI and behavior. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-939=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-939=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.8.3-21.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.8.3-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-15605.html https://bugzilla.suse.com/1105726 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2524-1: important: Security update for kbuild, virtualbox
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for kbuild, virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2524-1 Rating: important References: #1039375 #1076372 #1079838 #1093731 #1097248 #1098050 #1101667 Cross-References: CVE-2017-5715 CVE-2018-0739 CVE-2018-2676 CVE-2018-2685 CVE-2018-2686 CVE-2018-2687 CVE-2018-2688 CVE-2018-2689 CVE-2018-2690 CVE-2018-2693 CVE-2018-2694 CVE-2018-2698 CVE-2018-2830 CVE-2018-2831 CVE-2018-2835 CVE-2018-2836 CVE-2018-2837 CVE-2018-2842 CVE-2018-2843 CVE-2018-2844 CVE-2018-2845 CVE-2018-2860 CVE-2018-3005 CVE-2018-3055 CVE-2018-3085 CVE-2018-3086 CVE-2018-3087 CVE-2018-3088 CVE-2018-3089 CVE-2018-3090 CVE-2018-3091 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. Description: This update for kbuild, virtualbox fixes the following issues: kbuild changes: - Update to version 0.1.9998svn3110 - Do not assume glibc glob internals - Support GLIBC glob interface version 2 - Fix build failure (boo#1079838) - Fix build with GCC7 (boo#1039375) - Fix build by disabling vboxvideo_drv.so virtualbox security fixes (boo#1101667, boo#1076372): - CVE-2018-3005 - CVE-2018-3055 - CVE-2018-3085 - CVE-2018-3086 - CVE-2018-3087 - CVE-2018-3088 - CVE-2018-3089 - CVE-2018-3090 - CVE-2018-3091 - CVE-2018-2694 - CVE-2018-2698 - CVE-2018-2685 - CVE-2018-2686 - CVE-2018-2687 - CVE-2018-2688 - CVE-2018-2689 - CVE-2018-2690 - CVE-2018-2676 - CVE-2018-2693 - CVE-2017-5715 virtualbox other changes: - Version bump to 5.2.16 - Use %{?linux_make_arch} when building kernel modules (boo#1098050) - Fixed vboxguestconfig.sh script - Update warning regarding the security hole in USB passthrough. (boo#1097248) - Fixed include for build with Qt 5.11 (boo#1093731) - You can find a detailed list of changes [here](https://www.virtualbox.org/wiki/Changelog#v16) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-938=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kbuild-0.1.9998svn3110-4.3.1 kbuild-debuginfo-0.1.9998svn3110-4.3.1 kbuild-debugsource-0.1.9998svn3110-4.3.1 - openSUSE Leap 42.3 (x86_64): python-virtualbox-5.2.18-56.1 python-virtualbox-debuginfo-5.2.18-56.1 virtualbox-5.2.18-56.1 virtualbox-debuginfo-5.2.18-56.1 virtualbox-debugsource-5.2.18-56.1 virtualbox-devel-5.2.18-56.1 virtualbox-guest-kmp-default-5.2.18_k4.4.143_65-56.1 virtualbox-guest-kmp-default-debuginfo-5.2.18_k4.4.143_65-56.1 virtualbox-guest-tools-5.2.18-56.1 virtualbox-guest-tools-debuginfo-5.2.18-56.1 virtualbox-guest-x11-5.2.18-56.1 virtualbox-guest-x11-debuginfo-5.2.18-56.1 virtualbox-host-kmp-default-5.2.18_k4.4.143_65-56.1 virtualbox-host-kmp-default-debuginfo-5.2.18_k4.4.143_65-56.1 virtualbox-qt-5.2.18-56.1 virtualbox-qt-debuginfo-5.2.18-56.1 virtualbox-vnc-5.2.18-56.1 virtualbox-websrv-5.2.18-56.1 virtualbox-websrv-debuginfo-5.2.18-56.1 - openSUSE Leap 42.3 (noarch): virtualbox-guest-desktop-icons-5.2.18-56.1 virtualbox-guest-source-5.2.18-56.1 virtualbox-host-source-5.2.18-56.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-0739.html https://www.suse.com/security/cve/CVE-2018-2676.html https://www.suse.com/security/cve/CVE-2018-2685.html https://www.suse.com/security/cve/CVE-2018-2686.html https://www.suse.com/security/cve/CVE-2018-2687.html https://www.suse.com/security/cve/CVE-2018-2688.html https://www.suse.com/security/cve/CVE-2018-2689.html https://www.suse.com/security/cve/CVE-2018-2690.html https://www.suse.com/security/cve/CVE-2018-2693.html https://www.suse.com/security/cve/CVE-2018-2694.html https://www.suse.com/security/cve/CVE-2018-2698.html https://www.suse.com/security/cve/CVE-2018-2830.html https://www.suse.com/security/cve/CVE-2018-2831.html https://www.suse.com/security/cve/CVE-2018-2835.html https://www.suse.com/security/cve/CVE-2018-2836.html https://www.suse.com/security/cve/CVE-2018-2837.html https://www.suse.com/security/cve/CVE-2018-2842.html https://www.suse.com/security/cve/CVE-2018-2843.html https://www.suse.com/security/cve/CVE-2018-2844.html https://www.suse.com/security/cve/CVE-2018-2845.html https://www.suse.com/security/cve/CVE-2018-2860.html https://www.suse.com/security/cve/CVE-2018-3005.html https://www.suse.com/security/cve/CVE-2018-3055.html https://www.suse.com/security/cve/CVE-2018-3085.html https://www.suse.com/security/cve/CVE-2018-3086.html https://www.suse.com/security/cve/CVE-2018-3087.html https://www.suse.com/security/cve/CVE-2018-3088.html https://www.suse.com/security/cve/CVE-2018-3089.html https://www.suse.com/security/cve/CVE-2018-3090.html https://www.suse.com/security/cve/CVE-2018-3091.html https://bugzilla.suse.com/1039375 https://bugzilla.suse.com/1076372 https://bugzilla.suse.com/1079838 https://bugzilla.suse.com/1093731 https://bugzilla.suse.com/1097248 https://bugzilla.suse.com/1098050 https://bugzilla.suse.com/1101667 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2523-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2523-1 Rating: moderate References: #1105726 Cross-References: CVE-2018-15605 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.3 addresses multiple issues. Security issues fixed: - CVE-2018-15605: vulnerability in the file import feature allowed cross-site scripting via importing a specially-crafted file (PMASA-2018-5, boo#1105726) This update also contains a number of upstream bug fixes in the UI and behavior. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-939=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.3-29.1 References: https://www.suse.com/security/cve/CVE-2018-15605.html https://bugzilla.suse.com/1105726 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2521-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2521-1 Rating: moderate References: #1105598 Cross-References: CVE-2018-3780 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. (boo#1105598) Other bugs fixed: - Fix highlighting of the upload drop zone - Apply ldapUserFilter on members of group - Make the DELETION of groups match greedy on the groupID - Add parent index to share table - Log full exception in cron instead of only the message - Properly lock the target file on dav upload when not using part files - LDAP backup server should not be queried when auth fails - Fix filenames in sharing integration tests - Lower log level for quota manipulation cases - Let user set avatar in nextcloud if LDAP provides invalid image data - Improved logging of smb connection errors - Allow admin to disable fetching of avatars as well as a specific attribute - Allow to disable encryption - Update message shown when unsharing a file - Fixed English grammatical error on Settings page. - Request a valid property for DAV opendir - Allow updating the token on session regeneration - Prevent lock values from going negative with memcache backend - Correctly handle users with numeric user ids - Correctly parse the subject parameters for link (un)shares of calendars - Fix "parsing" of email-addresses in comments and chat messages - Sanitize parameters in createSessionToken() while logging - Also retry rename operation on InvalidArgumentException - Improve url detection in comments - Only bind to ldap if configuration for the first server is set - Use download manager from PDF.js to download the file - Fix trying to load removed scripts - Only pull for new messages if the session is allowed to be kept alive - Always push object data - Add prioritization for Talk Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-936=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-936=1 Package List: - openSUSE Leap 42.3 (noarch): nextcloud-13.0.5-12.1 - openSUSE Leap 15.0 (noarch): nextcloud-13.0.5-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1105598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2516-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2516-1 Rating: important References: #1105592 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - Disable PS, PS2, PS3 and PDF coders by default, remove gs calls from delegates.mgk (boo#1105592) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-937=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-937=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-99.1 GraphicsMagick-debuginfo-1.3.25-99.1 GraphicsMagick-debugsource-1.3.25-99.1 GraphicsMagick-devel-1.3.25-99.1 libGraphicsMagick++-Q16-12-1.3.25-99.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-99.1 libGraphicsMagick++-devel-1.3.25-99.1 libGraphicsMagick-Q16-3-1.3.25-99.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-99.1 libGraphicsMagick3-config-1.3.25-99.1 libGraphicsMagickWand-Q16-2-1.3.25-99.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-99.1 perl-GraphicsMagick-1.3.25-99.1 perl-GraphicsMagick-debuginfo-1.3.25-99.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.9.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.9.1 GraphicsMagick-debugsource-1.3.29-lp150.3.9.1 GraphicsMagick-devel-1.3.29-lp150.3.9.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.9.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.9.1 libGraphicsMagick++-devel-1.3.29-lp150.3.9.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.9.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.9.1 libGraphicsMagick3-config-1.3.29-lp150.3.9.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.9.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.9.1 perl-GraphicsMagick-1.3.29-lp150.3.9.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.9.1 References: https://bugzilla.suse.com/1105592 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2510-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2510-1 Rating: moderate References: #1105598 Cross-References: CVE-2018-3780 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. (boo#1105598) Other bugs fixed: - Fix highlighting of the upload drop zone - Apply ldapUserFilter on members of group - Make the DELETION of groups match greedy on the groupID - Add parent index to share table - Log full exception in cron instead of only the message - Properly lock the target file on dav upload when not using part files - LDAP backup server should not be queried when auth fails - Fix filenames in sharing integration tests - Lower log level for quota manipulation cases - Let user set avatar in nextcloud if LDAP provides invalid image data - Improved logging of smb connection errors - Allow admin to disable fetching of avatars as well as a specific attribute - Allow to disable encryption - Update message shown when unsharing a file - Fixed English grammatical error on Settings page. - Request a valid property for DAV opendir - Allow updating the token on session regeneration - Prevent lock values from going negative with memcache backend - Correctly handle users with numeric user ids - Correctly parse the subject parameters for link (un)shares of calendars - Fix "parsing" of email-addresses in comments and chat messages - Sanitize parameters in createSessionToken() while logging - Also retry rename operation on InvalidArgumentException - Improve url detection in comments - Only bind to ldap if configuration for the first server is set - Use download manager from PDF.js to download the file - Fix trying to load removed scripts - Only pull for new messages if the session is allowed to be kept alive - Always push object data - Add prioritization for Talk Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-936=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-13.0.5-5.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1105598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2503-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2503-1 Rating: moderate References: #1094741 #1102003 #1102004 #1102005 #1102007 Cross-References: CVE-2018-14434 CVE-2018-14435 CVE-2018-14436 CVE-2018-14437 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: * CVE-2018-14434: A memory leak for a colormap in WriteMPCImage incoders/mpc.c was fixed. (bsc#1102003) * CVE-2018-14435: A memory leak in DecodeImage in coders/pcd.c was fixed. (bsc#1102007) * CVE-2018-14436: A memory leak in ReadMIFFImage in coders/miff.c was fixed. (bsc#1102005) * CVE-2018-14437: A memory leak in parse8BIM in coders/meta.c was fixed. (bsc#1102004) Bug fix: - bsc#1094741: Fix unexpected result with `convert -compose`. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-925=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.9.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.9.1 ImageMagick-debugsource-7.0.7.34-lp150.2.9.1 ImageMagick-devel-7.0.7.34-lp150.2.9.1 ImageMagick-extra-7.0.7.34-lp150.2.9.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.9.1 libMagick++-devel-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.9.1 perl-PerlMagick-7.0.7.34-lp150.2.9.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.9.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-14434.html https://www.suse.com/security/cve/CVE-2018-14435.html https://www.suse.com/security/cve/CVE-2018-14436.html https://www.suse.com/security/cve/CVE-2018-14437.html https://bugzilla.suse.com/1094741 https://bugzilla.suse.com/1102003 https://bugzilla.suse.com/1102004 https://bugzilla.suse.com/1102005 https://bugzilla.suse.com/1102007 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0