June 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:1862-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1862-1 Rating: low References: #1075821 #1095812 Cross-References: CVE-2018-10805 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for GraphicsMagick fixes the following issues: The following security fixes were fixed: - CVE-2018-10805: Fixed a memory leak in ReadYCBCRImage in coders/ycbcr.c and rgb.c, cmyk.c and gray.c (boo#1095812) - Fixed invalid memory reads in dcm.c (boo#1075821#c14) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-689=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-689=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-93.1 GraphicsMagick-debuginfo-1.3.25-93.1 GraphicsMagick-debugsource-1.3.25-93.1 GraphicsMagick-devel-1.3.25-93.1 libGraphicsMagick++-Q16-12-1.3.25-93.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-93.1 libGraphicsMagick++-devel-1.3.25-93.1 libGraphicsMagick-Q16-3-1.3.25-93.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-93.1 libGraphicsMagick3-config-1.3.25-93.1 libGraphicsMagickWand-Q16-2-1.3.25-93.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-93.1 perl-GraphicsMagick-1.3.25-93.1 perl-GraphicsMagick-debuginfo-1.3.25-93.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.6.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.6.1 GraphicsMagick-debugsource-1.3.29-lp150.3.6.1 GraphicsMagick-devel-1.3.29-lp150.3.6.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.6.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.6.1 libGraphicsMagick++-devel-1.3.29-lp150.3.6.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.6.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.6.1 libGraphicsMagick3-config-1.3.29-lp150.3.6.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.6.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.6.1 perl-GraphicsMagick-1.3.29-lp150.3.6.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-10805.html https://bugzilla.suse.com/1075821 https://bugzilla.suse.com/1095812

1 0

openSUSE-RU-2018:1861-1: moderate: Recommended update for open-vm-tools
by maintenance＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Recommended Update: Recommended update for open-vm-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1861-1 Rating: moderate References: #1089181 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for open-vm-tools to version 10.2.5 provides the following fixes (bsc#1089181): - Make it compatible with supported versions of VMware vSphere ESXi 5.5 and later, VMware Workstation 14.0 and VMware Fusion 10.0.0. - Quiesced snapshot: Ability to exclude specific file systems from quiesced snapshots on Linux guest operating systems. For more details, see: https://docs.vmware.com/en/VMware-Tools/index.html - Disable display mode setting: A configuration option is introduced to disable normal display mode setting functionality using open-vm-tools. For more details, see: https://kb.vmware.com/s/article/53572 This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-688=1 Package List: - openSUSE Leap 42.3 (x86_64): libvmtools-devel-10.2.5-10.1 libvmtools0-10.2.5-10.1 libvmtools0-debuginfo-10.2.5-10.1 open-vm-tools-10.2.5-10.1 open-vm-tools-debuginfo-10.2.5-10.1 open-vm-tools-debugsource-10.2.5-10.1 open-vm-tools-desktop-10.2.5-10.1 open-vm-tools-desktop-debuginfo-10.2.5-10.1 References: https://bugzilla.suse.com/1089181

1 0

openSUSE-SU-2018:1860-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1860-1 Rating: moderate References: #1047356 #1056277 #1087820 #1094204 #1094237 #1095730 #1095812 #1095813 Cross-References: CVE-2017-10928 CVE-2017-13758 CVE-2017-18271 CVE-2018-10804 CVE-2018-10805 CVE-2018-11251 CVE-2018-11655 CVE-2018-9133 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: These security issues were fixed: - CVE-2017-13758: Prevent heap-based buffer overflow in the TracePoint() function (bsc#1056277). - CVE-2017-10928: Prevent heap-based buffer over-read in the GetNextToken function that allowed remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document (bsc#1047356). - CVE-2018-9133: Long compute times in the tiff decoder have been fixed (bsc#1087820). - CVE-2018-11251: Heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service (bsc#1094237). - CVE-2017-18271: Infinite loop in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (bsc#1094204). - CVE-2018-11655: Memory leak in the GetImagePixelCache in MagickCore/cache.c was fixed (bsc#1095730) - CVE-2018-10804: Memory leak in WriteTIFFImage in coders/tiff.c was fixed (bsc#1095813) - CVE-2018-10805: Fixed memory leaks in bgr.c, rgb.c, cmyk.c, gray.c, ycbcr.c (bsc#1095812) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-690=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-64.1 ImageMagick-debuginfo-6.8.8.1-64.1 ImageMagick-debugsource-6.8.8.1-64.1 ImageMagick-devel-6.8.8.1-64.1 ImageMagick-extra-6.8.8.1-64.1 ImageMagick-extra-debuginfo-6.8.8.1-64.1 libMagick++-6_Q16-3-6.8.8.1-64.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-64.1 libMagick++-devel-6.8.8.1-64.1 libMagickCore-6_Q16-1-6.8.8.1-64.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-64.1 libMagickWand-6_Q16-1-6.8.8.1-64.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-64.1 perl-PerlMagick-6.8.8.1-64.1 perl-PerlMagick-debuginfo-6.8.8.1-64.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-64.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-64.1 libMagick++-6_Q16-3-32bit-6.8.8.1-64.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-64.1 libMagick++-devel-32bit-6.8.8.1-64.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-64.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-64.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-64.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-64.1 References: https://www.suse.com/security/cve/CVE-2017-10928.html https://www.suse.com/security/cve/CVE-2017-13758.html https://www.suse.com/security/cve/CVE-2017-18271.html https://www.suse.com/security/cve/CVE-2018-10804.html https://www.suse.com/security/cve/CVE-2018-10805.html https://www.suse.com/security/cve/CVE-2018-11251.html https://www.suse.com/security/cve/CVE-2018-11655.html https://www.suse.com/security/cve/CVE-2018-9133.html https://bugzilla.suse.com/1047356 https://bugzilla.suse.com/1056277 https://bugzilla.suse.com/1087820 https://bugzilla.suse.com/1094204 https://bugzilla.suse.com/1094237 https://bugzilla.suse.com/1095730 https://bugzilla.suse.com/1095812 https://bugzilla.suse.com/1095813

1 0

openSUSE-SU-2018:1859-1: moderate: Security update for Opera
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for Opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1859-1 Rating: moderate References: #1096508 #1099568 Cross-References: CVE-2018-6148 Affected Products: openSUSE Leap 42.3:NonFree openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for Opera 54.0.2952.41 fixes multiple issues. - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) This update to version 54.0.2952.41 also contains all security and bug fixes in this upstream version, including all fixes in the chromium engine. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3:NonFree: zypper in -t patch openSUSE-2018-687=1 - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2018-687=1 Package List: - openSUSE Leap 42.3:NonFree (x86_64): opera-54.0.2952.41-68.1 - openSUSE Leap 15.0:NonFree (x86_64): opera-54.0.2952.41-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-6148.html https://bugzilla.suse.com/1096508 https://bugzilla.suse.com/1099568

1 0

openSUSE-SU-2018:1858-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1858-1 Rating: moderate References: #1099510 Cross-References: CVE-2018-0618 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman to version 2.1.27 fixes the following issues: This security issue was fixed: - CVE-2018-0618: Additional protections against injecting scripts into listinfo and error messages pages (bsc#1099510). These non-security issues were fixed: - The hash generated when SUBSCRIBE_FORM_SECRET is set could have been the same as one generated at the same time for a different list and IP address. - An option has been added to bin/add_members to issue invitations instead of immediately adding members. - A new BLOCK_SPAMHAUS_LISTED_IP_SUBSCRIBE setting has been added to enable blocking web subscribes from IPv4 addresses listed in Spamhaus SBL, CSS or XBL. It will work with IPv6 addresses if Python's py2-ipaddress module is installed. The module can be installed via pip if not included in your Python. - Mailman has a new 'security' log and logs authentication failures to the various web CGI functions. The logged data include the remote IP and can be used to automate blocking of IPs with something like fail2ban. Since Mailman 2.1.14, these have returned an http 401 status and the information should be logged by the web server, but this new log makes that more convenient. Also, the 'mischief' log entries for 'hostile listname' noe include the remote IP if available. - admin notices of (un)subscribes now may give the source of the action. This consists of a %(whence)s replacement that has been added to the admin(un)subscribeack.txt templates. Thanks to Yasuhito FUTATSUKI for updating the non-English templates and help with internationalizing the reasons. - there is a new BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE setting to enable blocking web subscribes for addresses in domains listed in the Spamhaus DBL. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-691=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-691=1 Package List: - openSUSE Leap 42.3 (x86_64): mailman-2.1.27-2.6.1 mailman-debuginfo-2.1.27-2.6.1 mailman-debugsource-2.1.27-2.6.1 - openSUSE Leap 15.0 (x86_64): mailman-2.1.27-lp150.2.3.1 mailman-debuginfo-2.1.27-lp150.2.3.1 mailman-debugsource-2.1.27-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0618.html https://bugzilla.suse.com/1099510

1 0

openSUSE-SU-2018:1854-1: important: Security update for rubygem-sprockets
by opensuse-security＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Security Update: Security update for rubygem-sprockets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1854-1 Rating: important References: #1098369 Cross-References: CVE-2018-3760 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-sprockets fixes the following issues: The following security vulnerability was addressed: - CVE-2018-3760: Fixed a directory traversal issue in sprockets/server.rb:forbidden_request?(), which allowed remote attackers to read arbitrary files via specially crafted requests. (boo#1098369) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-686=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ruby2.1-rubygem-sprockets-3.3.5-5.3.1 ruby2.1-rubygem-sprockets-doc-3.3.5-5.3.1 ruby2.2-rubygem-sprockets-3.3.5-5.3.1 ruby2.2-rubygem-sprockets-doc-3.3.5-5.3.1 ruby2.3-rubygem-sprockets-3.3.5-5.3.1 ruby2.3-rubygem-sprockets-doc-3.3.5-5.3.1 ruby2.4-rubygem-sprockets-3.3.5-5.3.1 ruby2.4-rubygem-sprockets-doc-3.3.5-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-3760.html https://bugzilla.suse.com/1098369

1 0

openSUSE-SU-2018:1848-1: moderate: Security update for procps
by opensuse-security＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Security Update: Security update for procps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1848-1 Rating: moderate References: #1092100 Cross-References: CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for procps fixes the following security issues: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-685=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libprocps3-3.3.9-20.1 libprocps3-debuginfo-3.3.9-20.1 procps-3.3.9-20.1 procps-debuginfo-3.3.9-20.1 procps-debugsource-3.3.9-20.1 procps-devel-3.3.9-20.1 References: https://www.suse.com/security/cve/CVE-2018-1122.html https://www.suse.com/security/cve/CVE-2018-1123.html https://www.suse.com/security/cve/CVE-2018-1124.html https://www.suse.com/security/cve/CVE-2018-1125.html https://www.suse.com/security/cve/CVE-2018-1126.html https://bugzilla.suse.com/1092100

1 0

openSUSE-SU-2018:1845-1: moderate: Security update for unixODBC
by opensuse-security＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Security Update: Security update for unixODBC ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1845-1 Rating: moderate References: #1044970 #1082060 #1082290 #1082484 Cross-References: CVE-2018-7409 CVE-2018-7485 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for unixODBC to version 2.3.6 fixes the following issues: - CVE-2018-7409: Buffer overflow in unicode_to_ansi_copy() was fixed in 2.3.5 (bsc#1082290) - CVE-2018-7485: Swapped arguments in SQLWriteFileDSN() in odbcinst/SQLWriteFileDSN.c (bsc#1082484) Other fixes: - Enabled --enable-fastvalidate option in configure (bsc#1044970) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-684=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): unixODBC-2.3.6-8.1 unixODBC-debuginfo-2.3.6-8.1 unixODBC-debugsource-2.3.6-8.1 unixODBC-devel-2.3.6-8.1 - openSUSE Leap 42.3 (x86_64): unixODBC-32bit-2.3.6-8.1 unixODBC-debuginfo-32bit-2.3.6-8.1 References: https://www.suse.com/security/cve/CVE-2018-7409.html https://www.suse.com/security/cve/CVE-2018-7485.html https://bugzilla.suse.com/1044970 https://bugzilla.suse.com/1082060 https://bugzilla.suse.com/1082290 https://bugzilla.suse.com/1082484

1 0

openSUSE-RU-2018:1844-1: moderate: Recommended update for putty
by maintenance＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Recommended Update: Recommended update for putty ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1844-1 Rating: moderate References: #1098962 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for putty fixes the following issues: - putty did not start under Wayland (boo#1098962) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-681=1 Package List: - openSUSE Leap 15.0 (x86_64): putty-0.70-lp150.4.3.1 putty-debuginfo-0.70-lp150.4.3.1 putty-debugsource-0.70-lp150.4.3.1 References: https://bugzilla.suse.com/1098962

1 0

openSUSE-OU-2018:1843-1: moderate: Optional update for znc
by maintenance＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Optional Update: Optional update for znc ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:1843-1 Rating: moderate References: #1095999 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update makes available znc version 1.7.0 with multiple useful features: - Implement IRCv3.2 capabilities away-notify, account-notify, extended-join - Implement IRCv3.2 capabilities echo-message, cap-notify on the "client side" - Update capability names as they are named in IRCv3.2 - Make ZNC request server-time from server when available (#839) - Increase accepted line length from 1024 to 2048 to give some space to message tags - Support separate SSLKeyFile and SSLDHParamFile configuration in addition to existing SSLCertFile - Add modules: pyeval, stripcontrols - Add new substitutions to ExpandString: %empty% and %network% - Add ClearAllBuffers command - Set HttpOnly and SameSite=strict for session cookies - Add SNI SSL client support (#1200) - Add support for CIDR notation in allowed hosts list and in trusted proxy list - Add network-specific config for cert validation in addition to user-supplied fingerprints - Add /attach command for symmetry with /detach Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-682=1 Package List: - openSUSE Leap 15.0 (x86_64): znc-1.7.0-lp150.2.3.1 znc-debuginfo-1.7.0-lp150.2.3.1 znc-debugsource-1.7.0-lp150.2.3.1 znc-devel-1.7.0-lp150.2.3.1 znc-perl-1.7.0-lp150.2.3.1 znc-perl-debuginfo-1.7.0-lp150.2.3.1 znc-python3-1.7.0-lp150.2.3.1 znc-python3-debuginfo-1.7.0-lp150.2.3.1 znc-tcl-1.7.0-lp150.2.3.1 znc-tcl-debuginfo-1.7.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): znc-lang-1.7.0-lp150.2.3.1 References: https://bugzilla.suse.com/1095999

1 0