August 2017 - openSUSE Security Announce

[security-announce] SUSE-SU-2017:2212-1: important: Security update for openvswitch
by opensuse-security＠opensuse.org 18 Aug '17

18 Aug '17

SUSE Security Update: Security update for openvswitch ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2212-1 Rating: important References: #1002734 #1041447 #1041470 #1050896 Cross-References: CVE-2017-9263 CVE-2017-9265 Affected Products: SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for openvswitch fixes the following issues: - CVE-2017-9263: OpenFlow role status message can cause a call to abort() leading to application crash (bsc#1041470) - CVE-2017-9265: Buffer over-read while parsing message could lead to crash or maybe arbitrary code execution (bsc#1041447) - Do not restart the ovs-vswitchd and ovsdb-server services on package updates (bsc#1002734) - Do not restart the ovs-vswitchd, ovsdb-server and openvswitch services on package removals. This facilitates potential future package moves but also preserves connectivity when the package is removed (bsc#1050896) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1348=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): openvswitch-2.7.0-3.3.1 openvswitch-debuginfo-2.7.0-3.3.1 openvswitch-debugsource-2.7.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-9263.html https://www.suse.com/security/cve/CVE-2017-9265.html https://bugzilla.suse.com/1002734 https://bugzilla.suse.com/1041447 https://bugzilla.suse.com/1041470 https://bugzilla.suse.com/1050896 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:2209-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2209-1 Rating: important References: #1052829 Cross-References: CVE-2017-7753 CVE-2017-7779 CVE-2017-7782 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7798 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7804 CVE-2017-7807 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with marquee during window resizing - CVE-2017-7784: Use-after-free with image observers - CVE-2017-7802: Use-after-free resizing image elements - CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM - CVE-2017-7786: Buffer overflow while painting non-displayable SVG - CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements# - CVE-2017-7787: Same-origin policy bypass with iframes through page reloads - CVE-2017-7807: Domain hijacking through AppCache fallback - CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID - CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher - CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts - CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections - CVE-2017-7803: CSP containing 'sandbox' improperly applied - CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3 The following bugs were fixed: - Unwanted inline images shown in rogue SPAM messages - Deleting message from the POP3 server not working when maildir storage was used - Message disposition flag (replied / forwarded) lost when reply or forwarded message was stored as draft and draft was sent later - Inline images not scaled to fit when printing - Selected text from another message sometimes included in a reply - No authorisation prompt displayed when inserting image into email body although image URL requires authentication - Large attachments taking a long time to open under some circumstances Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-955=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-955=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): MozillaThunderbird-52.3.0-44.1 MozillaThunderbird-buildsymbols-52.3.0-44.1 MozillaThunderbird-debuginfo-52.3.0-44.1 MozillaThunderbird-debugsource-52.3.0-44.1 MozillaThunderbird-devel-52.3.0-44.1 MozillaThunderbird-translations-common-52.3.0-44.1 MozillaThunderbird-translations-other-52.3.0-44.1 - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-52.3.0-41.15.1 MozillaThunderbird-buildsymbols-52.3.0-41.15.1 MozillaThunderbird-debuginfo-52.3.0-41.15.1 MozillaThunderbird-debugsource-52.3.0-41.15.1 MozillaThunderbird-devel-52.3.0-41.15.1 MozillaThunderbird-translations-common-52.3.0-41.15.1 MozillaThunderbird-translations-other-52.3.0-41.15.1 References: https://www.suse.com/security/cve/CVE-2017-7753.html https://www.suse.com/security/cve/CVE-2017-7779.html https://www.suse.com/security/cve/CVE-2017-7782.html https://www.suse.com/security/cve/CVE-2017-7784.html https://www.suse.com/security/cve/CVE-2017-7785.html https://www.suse.com/security/cve/CVE-2017-7786.html https://www.suse.com/security/cve/CVE-2017-7787.html https://www.suse.com/security/cve/CVE-2017-7791.html https://www.suse.com/security/cve/CVE-2017-7792.html https://www.suse.com/security/cve/CVE-2017-7798.html https://www.suse.com/security/cve/CVE-2017-7800.html https://www.suse.com/security/cve/CVE-2017-7801.html https://www.suse.com/security/cve/CVE-2017-7802.html https://www.suse.com/security/cve/CVE-2017-7803.html https://www.suse.com/security/cve/CVE-2017-7804.html https://www.suse.com/security/cve/CVE-2017-7807.html https://bugzilla.suse.com/1052829 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2202-1: important: Security update for freeradius-server
by opensuse-security＠opensuse.org 17 Aug '17

17 Aug '17

SUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2202-1 Rating: important References: #1049086 Cross-References: CVE-2017-10978 CVE-2017-10983 CVE-2017-10984 CVE-2017-10985 CVE-2017-10986 CVE-2017-10987 CVE-2017-10988 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for freeradius-server fixes the following issues: - update to 3.0.15 (bsc#1049086) * Bind the lifetime of program name and python path to the module * CVE-2017-10978: FR-GV-201: Check input / output length in make_secret() (bsc#1049086) * CVE-2017-10983: FR-GV-206: Fix read overflow when decoding DHCP option 63 (bsc#1049086) * CVE-2017-10984: FR-GV-301: Fix write overflow in data2vp_wimax() (bsc#1049086) * CVE-2017-10985: FR-GV-302: Fix infinite loop and memory exhaustion with 'concat' attributes (bsc#1049086) * CVE-2017-10986: FR-GV-303: Fix infinite read in dhcp_attr2vp() (bsc#1049086) * CVE-2017-10987: FR-GV-304: Fix buffer over-read in fr_dhcp_decode_suboptions() (bsc#1049086) * CVE-2017-10988: FR-GV-305: Decode 'signed' attributes correctly. (bsc#1049086) * FR-AD-001: use strncmp() instead of memcmp() for bounded data * Print messages when we see deprecated configuration items * Show reasons why we couldn't parse a certificate expiry time * Be more accepting about truncated ASN1 times. * Fix OpenSSL API issue which could leak small amounts of memory. * For Access-Reject, call rad_authlog() after running the post-auth section, just like for Access-Accept. * Don't crash when reading corrupted data from session resumption cache. * Parse port in dhcpclient. * Don't leak memory for OpenSSL. * Portability fixes taken from OpenBSD port collection. * run rad_authlog after post-auth for Access-Reject. * Don't process VMPS packets twice. * Fix attribute truncation in rlm_perl * Fix bug when processing huntgroups. * FR-AD-002 - Bind the lifetime of program name and python path to the module * FR-AD-003 - Pass correct statement length into sqlite3_prepare[_v2] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1341=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1341=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): freeradius-server-debuginfo-3.0.15-2.3.1 freeradius-server-debugsource-3.0.15-2.3.1 freeradius-server-devel-3.0.15-2.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): freeradius-server-3.0.15-2.3.1 freeradius-server-debuginfo-3.0.15-2.3.1 freeradius-server-debugsource-3.0.15-2.3.1 freeradius-server-doc-3.0.15-2.3.1 freeradius-server-krb5-3.0.15-2.3.1 freeradius-server-krb5-debuginfo-3.0.15-2.3.1 freeradius-server-ldap-3.0.15-2.3.1 freeradius-server-ldap-debuginfo-3.0.15-2.3.1 freeradius-server-libs-3.0.15-2.3.1 freeradius-server-libs-debuginfo-3.0.15-2.3.1 freeradius-server-mysql-3.0.15-2.3.1 freeradius-server-mysql-debuginfo-3.0.15-2.3.1 freeradius-server-perl-3.0.15-2.3.1 freeradius-server-perl-debuginfo-3.0.15-2.3.1 freeradius-server-postgresql-3.0.15-2.3.1 freeradius-server-postgresql-debuginfo-3.0.15-2.3.1 freeradius-server-python-3.0.15-2.3.1 freeradius-server-python-debuginfo-3.0.15-2.3.1 freeradius-server-sqlite-3.0.15-2.3.1 freeradius-server-sqlite-debuginfo-3.0.15-2.3.1 freeradius-server-utils-3.0.15-2.3.1 freeradius-server-utils-debuginfo-3.0.15-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-10978.html https://www.suse.com/security/cve/CVE-2017-10983.html https://www.suse.com/security/cve/CVE-2017-10984.html https://www.suse.com/security/cve/CVE-2017-10985.html https://www.suse.com/security/cve/CVE-2017-10986.html https://www.suse.com/security/cve/CVE-2017-10987.html https://www.suse.com/security/cve/CVE-2017-10988.html https://bugzilla.suse.com/1049086 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2200-1: important: Security update for subversion
by opensuse-security＠opensuse.org 17 Aug '17

17 Aug '17

SUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2200-1 Rating: important References: #1011552 #1026936 #1051362 #897033 #909935 #911620 #916286 #923793 #923794 #923795 #939514 #939517 #942819 #958300 #969159 #976849 #976850 #977424 #983938 Cross-References: CVE-2014-3580 CVE-2014-8108 CVE-2015-0202 CVE-2015-0248 CVE-2015-0251 CVE-2015-3184 CVE-2015-3187 CVE-2015-5343 CVE-2016-2167 CVE-2016-2168 CVE-2016-8734 CVE-2017-9800 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 7 fixes is now available. Description: This update for subversion fixes the following issues: - CVE-2017-9800: A malicious, compromised server or MITM may cause svn client to execute arbitrary commands by sending repository content with svn:externals definitions pointing to crafted svn+ssh URLs. (bsc#1051362) - Malicious user may commit SHA-1 collisions and cause repository inconsistencies (bsc#1026936) - CVE-2016-8734: Unrestricted XML entity expansion in mod_dontdothat and Subversion clients using http(s):// could lead to denial of service (bsc#1011552) - CVE-2016-2167: svnserve/sasl may authenticate users using the wrong realm (bsc#976849) - CVE-2016-2168: Remotely triggerable DoS vulnerability in mod_authz_svn during COPY/MOVE authorization check (bsc#976850) - mod_authz_svn: fix authz with mod_auth_kerb/mod_auth_ntlm (bsc#977424) - make the subversion package conflict with KWallet and Gnome Keyring packages with do not require matching subversion versions in SLE 12 and openSUSE Leap 42.1 and thus break the main package upon partial upgrade. (bsc#969159) - CVE-2015-5343: Remotely triggerable heap overflow and out-of-bounds read in mod_dav_svn caused by integer overflow when parsing skel-encoded request bodies. (bsc#958300) - Avoid recommending 180+ new pkgs for installation on minimal setup due subversion-password-store (bsc#942819) - CVE-2015-3184: mod_authz_svn: mixed anonymous/authenticated httpd (dav) configurations could lead to information leak (bsc#939514) - CVE-2015-3187: do not leak paths that were hidden by path-based authz (bsc#939517) - CVE-2015-0202: Subversion HTTP servers with FSFS repositories were vulnerable to a remotely triggerable excessive memory use with certain REPORT requests. (bsc#923793) - CVE-2015-0248: Subversion mod_dav_svn and svnserve were vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers. (bsc#923794) - CVE-2015-0251: Subversion HTTP servers allow spoofing svn:author property values for new revisions (bsc#923795) - fix sample configuration comments in subversion.conf (bsc#916286) - fix sysconfig file generation (bsc#911620) - CVE-2014-3580: mod_dav_svn invalid REPORT requests could lead to denial of service (bsc#909935) - CVE-2014-8108: mod_dav_svn use of invalid transaction names could lead to denial of service (bsc#909935) - INSTALL#SQLite says 'Subversion 1.8 requires SQLite version 3.7.12 or above'; therefore I lowered the sqlite requirement to make the subversion run on older system versions, tooi. [bsc#897033] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1340=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1340=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libsvn_auth_gnome_keyring-1-0-1.8.19-25.3.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.19-25.3.1 subversion-1.8.19-25.3.1 subversion-debuginfo-1.8.19-25.3.1 subversion-debugsource-1.8.19-25.3.1 subversion-devel-1.8.19-25.3.1 subversion-perl-1.8.19-25.3.1 subversion-perl-debuginfo-1.8.19-25.3.1 subversion-python-1.8.19-25.3.1 subversion-python-debuginfo-1.8.19-25.3.1 subversion-server-1.8.19-25.3.1 subversion-server-debuginfo-1.8.19-25.3.1 subversion-tools-1.8.19-25.3.1 subversion-tools-debuginfo-1.8.19-25.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): subversion-bash-completion-1.8.19-25.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libsvn_auth_gnome_keyring-1-0-1.8.19-25.3.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.19-25.3.1 subversion-1.8.19-25.3.1 subversion-debuginfo-1.8.19-25.3.1 subversion-debugsource-1.8.19-25.3.1 subversion-devel-1.8.19-25.3.1 subversion-perl-1.8.19-25.3.1 subversion-perl-debuginfo-1.8.19-25.3.1 subversion-python-1.8.19-25.3.1 subversion-python-debuginfo-1.8.19-25.3.1 subversion-server-1.8.19-25.3.1 subversion-server-debuginfo-1.8.19-25.3.1 subversion-tools-1.8.19-25.3.1 subversion-tools-debuginfo-1.8.19-25.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): subversion-bash-completion-1.8.19-25.3.1 References: https://www.suse.com/security/cve/CVE-2014-3580.html https://www.suse.com/security/cve/CVE-2014-8108.html https://www.suse.com/security/cve/CVE-2015-0202.html https://www.suse.com/security/cve/CVE-2015-0248.html https://www.suse.com/security/cve/CVE-2015-0251.html https://www.suse.com/security/cve/CVE-2015-3184.html https://www.suse.com/security/cve/CVE-2015-3187.html https://www.suse.com/security/cve/CVE-2015-5343.html https://www.suse.com/security/cve/CVE-2016-2167.html https://www.suse.com/security/cve/CVE-2016-2168.html https://www.suse.com/security/cve/CVE-2016-8734.html https://www.suse.com/security/cve/CVE-2017-9800.html https://bugzilla.suse.com/1011552 https://bugzilla.suse.com/1026936 https://bugzilla.suse.com/1051362 https://bugzilla.suse.com/897033 https://bugzilla.suse.com/909935 https://bugzilla.suse.com/911620 https://bugzilla.suse.com/916286 https://bugzilla.suse.com/923793 https://bugzilla.suse.com/923794 https://bugzilla.suse.com/923795 https://bugzilla.suse.com/939514 https://bugzilla.suse.com/939517 https://bugzilla.suse.com/942819 https://bugzilla.suse.com/958300 https://bugzilla.suse.com/969159 https://bugzilla.suse.com/976849 https://bugzilla.suse.com/976850 https://bugzilla.suse.com/977424 https://bugzilla.suse.com/983938 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2199-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 17 Aug '17

17 Aug '17

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2199-1 Rating: important References: #1042812 #1042826 #1043289 #1049072 Cross-References: CVE-2017-11403 CVE-2017-9439 CVE-2017-9440 CVE-2017-9501 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2017-9439: A memory leak was found in the function ReadPDBImage incoders/pdb.c (bsc#1042826) - CVE-2017-9440: A memory leak was found in the function ReadPSDChannelin coders/psd.c (bsc#1042812) - CVE-2017-9501: An assertion failure could cause a denial of service via a crafted file (bsc#1043289) - CVE-2017-11403: ReadMNGImage function in coders/png.c has an out-of-order CloseBlob call, resulting in a use-after-free via acrafted file (bsc#1049072) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-1343=1 - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-1343=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1343=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1343=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1343=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1343=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1343=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1343=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1343=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): ImageMagick-6.8.8.1-71.5.3 ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagick++-6_Q16-3-6.8.8.1-71.5.3 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.5.3 - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): ImageMagick-6.8.8.1-71.5.3 ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagick++-6_Q16-3-6.8.8.1-71.5.3 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.5.3 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): ImageMagick-6.8.8.1-71.5.3 ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 ImageMagick-devel-6.8.8.1-71.5.3 libMagick++-6_Q16-3-6.8.8.1-71.5.3 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.5.3 libMagick++-devel-6.8.8.1-71.5.3 perl-PerlMagick-6.8.8.1-71.5.3 perl-PerlMagick-debuginfo-6.8.8.1-71.5.3 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): ImageMagick-6.8.8.1-71.5.3 ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 ImageMagick-devel-6.8.8.1-71.5.3 libMagick++-6_Q16-3-6.8.8.1-71.5.3 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.5.3 libMagick++-devel-6.8.8.1-71.5.3 perl-PerlMagick-6.8.8.1-71.5.3 perl-PerlMagick-debuginfo-6.8.8.1-71.5.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.5.3 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.5.3 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.5.3 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): ImageMagick-6.8.8.1-71.5.3 ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagick++-6_Q16-3-6.8.8.1-71.5.3 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.5.3 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): ImageMagick-6.8.8.1-71.5.3 ImageMagick-debuginfo-6.8.8.1-71.5.3 ImageMagick-debugsource-6.8.8.1-71.5.3 libMagick++-6_Q16-3-6.8.8.1-71.5.3 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.5.3 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-6.8.8.1-71.5.3 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.5.3 References: https://www.suse.com/security/cve/CVE-2017-11403.html https://www.suse.com/security/cve/CVE-2017-9439.html https://www.suse.com/security/cve/CVE-2017-9440.html https://www.suse.com/security/cve/CVE-2017-9501.html https://bugzilla.suse.com/1042812 https://bugzilla.suse.com/1042826 https://bugzilla.suse.com/1043289 https://bugzilla.suse.com/1049072 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:2186-1: important: Security update for openjpeg2
by opensuse-security＠opensuse.org 17 Aug '17

17 Aug '17

openSUSE Security Update: Security update for openjpeg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2186-1 Rating: important References: #979907 #997857 Cross-References: CVE-2015-8871 CVE-2016-7163 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openjpeg2 fixes the following issues: - CVE 2016-7163: Integer Overflow could lead to remote code execution (bsc#997857) - CVE 2015-8871: Use-after-free in opj_j2k_write_mco function could lead to denial of service (bsc#979907) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-943=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-943=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenjp2-7-2.1.0-16.1 libopenjp2-7-debuginfo-2.1.0-16.1 openjpeg2-2.1.0-16.1 openjpeg2-debuginfo-2.1.0-16.1 openjpeg2-debugsource-2.1.0-16.1 openjpeg2-devel-2.1.0-16.1 - openSUSE Leap 42.3 (x86_64): libopenjp2-7-32bit-2.1.0-16.1 libopenjp2-7-debuginfo-32bit-2.1.0-16.1 - openSUSE Leap 42.2 (i586 x86_64): libopenjp2-7-2.1.0-13.3.1 libopenjp2-7-debuginfo-2.1.0-13.3.1 openjpeg2-2.1.0-13.3.1 openjpeg2-debuginfo-2.1.0-13.3.1 openjpeg2-debugsource-2.1.0-13.3.1 openjpeg2-devel-2.1.0-13.3.1 - openSUSE Leap 42.2 (x86_64): libopenjp2-7-32bit-2.1.0-13.3.1 libopenjp2-7-debuginfo-32bit-2.1.0-13.3.1 References: https://www.suse.com/security/cve/CVE-2015-8871.html https://www.suse.com/security/cve/CVE-2016-7163.html https://bugzilla.suse.com/979907 https://bugzilla.suse.com/997857 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:2183-1: important: Security update for subversion
by opensuse-security＠opensuse.org 17 Aug '17

17 Aug '17

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2183-1 Rating: important References: #1026936 #1049448 #1051362 Cross-References: CVE-2017-9800 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for subversion to 1.9.7 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-9800: A remote attacker could have caused svn clients to execute arbitrary code via specially crafted URLs in svn:externals and svn:sync-from-url properties. (boo#1051362) - CVE-2005-4900: SHA-1 collisions may cause repository inconsistencies (boo#1026936) The following bugfix changes are included: - Add instructions for running svnserve as a user different from "svn", and remove sysconfig variables that are no longer effective with the systemd unit. (boo#1049448) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-940=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-940=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.9.7-8.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.9.7-8.1 libsvn_auth_kwallet-1-0-1.9.7-8.1 libsvn_auth_kwallet-1-0-debuginfo-1.9.7-8.1 subversion-1.9.7-8.1 subversion-debuginfo-1.9.7-8.1 subversion-debugsource-1.9.7-8.1 subversion-devel-1.9.7-8.1 subversion-perl-1.9.7-8.1 subversion-perl-debuginfo-1.9.7-8.1 subversion-python-1.9.7-8.1 subversion-python-ctypes-1.9.7-8.1 subversion-python-debuginfo-1.9.7-8.1 subversion-ruby-1.9.7-8.1 subversion-ruby-debuginfo-1.9.7-8.1 subversion-server-1.9.7-8.1 subversion-server-debuginfo-1.9.7-8.1 subversion-tools-1.9.7-8.1 subversion-tools-debuginfo-1.9.7-8.1 - openSUSE Leap 42.3 (noarch): subversion-bash-completion-1.9.7-8.1 - openSUSE Leap 42.2 (x86_64): libsvn_auth_gnome_keyring-1-0-1.9.7-5.3.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.9.7-5.3.1 libsvn_auth_kwallet-1-0-1.9.7-5.3.1 libsvn_auth_kwallet-1-0-debuginfo-1.9.7-5.3.1 subversion-1.9.7-5.3.1 subversion-debuginfo-1.9.7-5.3.1 subversion-debugsource-1.9.7-5.3.1 subversion-devel-1.9.7-5.3.1 subversion-perl-1.9.7-5.3.1 subversion-perl-debuginfo-1.9.7-5.3.1 subversion-python-1.9.7-5.3.1 subversion-python-ctypes-1.9.7-5.3.1 subversion-python-debuginfo-1.9.7-5.3.1 subversion-ruby-1.9.7-5.3.1 subversion-ruby-debuginfo-1.9.7-5.3.1 subversion-server-1.9.7-5.3.1 subversion-server-debuginfo-1.9.7-5.3.1 subversion-tools-1.9.7-5.3.1 subversion-tools-debuginfo-1.9.7-5.3.1 - openSUSE Leap 42.2 (noarch): subversion-bash-completion-1.9.7-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-9800.html https://bugzilla.suse.com/1026936 https://bugzilla.suse.com/1049448 https://bugzilla.suse.com/1051362 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:2182-1: important: Security update for git
by opensuse-security＠opensuse.org 17 Aug '17

17 Aug '17

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2182-1 Rating: important References: #1052481 Cross-References: CVE-2017-1000117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following security issues: - CVE-2017-1000117: A malicious third-party could have caused a git client to execute arbitrary commands via crafted "ssh://..." URLs, including submodules (boo#1052481) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-939=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): git-2.13.5-3.1 git-arch-2.13.5-3.1 git-core-2.13.5-3.1 git-core-debuginfo-2.13.5-3.1 git-credential-gnome-keyring-2.13.5-3.1 git-credential-gnome-keyring-debuginfo-2.13.5-3.1 git-cvs-2.13.5-3.1 git-daemon-2.13.5-3.1 git-daemon-debuginfo-2.13.5-3.1 git-debugsource-2.13.5-3.1 git-email-2.13.5-3.1 git-gui-2.13.5-3.1 git-svn-2.13.5-3.1 git-svn-debuginfo-2.13.5-3.1 git-web-2.13.5-3.1 gitk-2.13.5-3.1 - openSUSE Leap 42.3 (noarch): git-doc-2.13.5-3.1 References: https://www.suse.com/security/cve/CVE-2017-1000117.html https://bugzilla.suse.com/1052481 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2176-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2176-1 Rating: important References: #1042826 #1043289 #1049072 Cross-References: CVE-2017-11403 CVE-2017-9439 CVE-2017-9501 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2017-9439: A memory leak was found in the function ReadPDBImage incoders/pdb.c (bsc#1042826) - CVE-2017-9501: An assertion failure could cause a denial of service via a crafted file (bsc#1043289) - CVE-2017-11403: ReadMNGImage function in coders/png.c has an out-of-order CloseBlob call, resulting in a use-after-free via acrafted file (bsc#1049072) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ImageMagick-13232=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ImageMagick-13232=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ImageMagick-13232=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-6.4.3.6-7.78.5.2 ImageMagick-devel-6.4.3.6-7.78.5.2 libMagick++-devel-6.4.3.6-7.78.5.2 libMagick++1-6.4.3.6-7.78.5.2 libMagickWand1-6.4.3.6-7.78.5.2 perl-PerlMagick-6.4.3.6-7.78.5.2 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libMagickWand1-32bit-6.4.3.6-7.78.5.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libMagickCore1-6.4.3.6-7.78.5.2 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.78.5.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.78.5.2 ImageMagick-debugsource-6.4.3.6-7.78.5.2 References: https://www.suse.com/security/cve/CVE-2017-11403.html https://www.suse.com/security/cve/CVE-2017-9439.html https://www.suse.com/security/cve/CVE-2017-9501.html https://bugzilla.suse.com/1042826 https://bugzilla.suse.com/1043289 https://bugzilla.suse.com/1049072 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2175-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2175-1 Rating: important References: #1049302 #1049305 #1049306 #1049307 #1049308 #1049309 #1049310 #1049311 #1049312 #1049313 #1049314 #1049315 #1049316 #1049317 #1049318 #1049319 #1049320 #1049321 #1049322 #1049323 #1049324 #1049325 #1049326 #1049327 #1049328 #1049329 #1049330 #1049331 #1049332 Cross-References: CVE-2017-10053 CVE-2017-10067 CVE-2017-10074 CVE-2017-10078 CVE-2017-10081 CVE-2017-10086 CVE-2017-10087 CVE-2017-10089 CVE-2017-10090 CVE-2017-10096 CVE-2017-10101 CVE-2017-10102 CVE-2017-10105 CVE-2017-10107 CVE-2017-10108 CVE-2017-10109 CVE-2017-10110 CVE-2017-10111 CVE-2017-10114 CVE-2017-10115 CVE-2017-10116 CVE-2017-10118 CVE-2017-10125 CVE-2017-10135 CVE-2017-10176 CVE-2017-10193 CVE-2017-10198 CVE-2017-10243 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves 28 vulnerabilities and has one errata is now available. Description: This java-1_8_0-openjdk update to version jdk8u141 (icedtea 3.5.0) fixes the following issues: Security issues fixed: - CVE-2017-10053: Improved image post-processing steps (bsc#1049305) - CVE-2017-10067: Additional jar validation steps (bsc#1049306) - CVE-2017-10074: Image conversion improvements (bsc#1049307) - CVE-2017-10078: Better script accessibility for JavaScript (bsc#1049308) - CVE-2017-10081: Right parenthesis issue (bsc#1049309) - CVE-2017-10086: Unspecified vulnerability in subcomponent JavaFX (bsc#1049310) - CVE-2017-10087: Better Thread Pool execution (bsc#1049311) - CVE-2017-10089: Service Registration Lifecycle (bsc#1049312) - CVE-2017-10090: Better handling of channel groups (bsc#1049313) - CVE-2017-10096: Transform Transformer Exceptions (bsc#1049314) - CVE-2017-10101: Better reading of text catalogs (bsc#1049315) - CVE-2017-10102: Improved garbage collection (bsc#1049316) - CVE-2017-10105: Unspecified vulnerability in subcomponent deployment (bsc#1049317) - CVE-2017-10107: Less Active Activations (bsc#1049318) - CVE-2017-10108: Better naming attribution (bsc#1049319) - CVE-2017-10109: Better sourcing of code (bsc#1049320) - CVE-2017-10110: Better image fetching (bsc#1049321) - CVE-2017-10111: Rearrange MethodHandle arrangements (bsc#1049322) - CVE-2017-10114: Unspecified vulnerability in subcomponent JavaFX (bsc#1049323) - CVE-2017-10115: Higher quality DSA operations (bsc#1049324) - CVE-2017-10116: Proper directory lookup processing (bsc#1049325) - CVE-2017-10118: Higher quality ECDSA operations (bsc#1049326) - CVE-2017-10125: Unspecified vulnerability in subcomponent deployment (bsc#1049327) - CVE-2017-10135: Better handling of PKCS8 material (bsc#1049328) - CVE-2017-10176: Additional elliptic curve support (bsc#1049329) - CVE-2017-10193: Improve algorithm constraints implementation (bsc#1049330) - CVE-2017-10198: Clear certificate chain connections (bsc#1049331) - CVE-2017-10243: Unspecified vulnerability in subcomponent JAX-WS (bsc#1049332) Bug fixes: - Check registry registration location - Improved certificate processing - JMX diagnostic improvements - Update to libpng 1.6.28 - Import of OpenJDK 8 u141 build 15 (bsc#1049302) New features: - Support using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1337=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1337=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1337=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1337=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1337=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1337=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1337=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1337=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-1.8.0.144-27.5.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-devel-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): java-1_8_0-openjdk-1.8.0.144-27.5.3 java-1_8_0-openjdk-debuginfo-1.8.0.144-27.5.3 java-1_8_0-openjdk-debugsource-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-1.8.0.144-27.5.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-27.5.3 References: https://www.suse.com/security/cve/CVE-2017-10053.html https://www.suse.com/security/cve/CVE-2017-10067.html https://www.suse.com/security/cve/CVE-2017-10074.html https://www.suse.com/security/cve/CVE-2017-10078.html https://www.suse.com/security/cve/CVE-2017-10081.html https://www.suse.com/security/cve/CVE-2017-10086.html https://www.suse.com/security/cve/CVE-2017-10087.html https://www.suse.com/security/cve/CVE-2017-10089.html https://www.suse.com/security/cve/CVE-2017-10090.html https://www.suse.com/security/cve/CVE-2017-10096.html https://www.suse.com/security/cve/CVE-2017-10101.html https://www.suse.com/security/cve/CVE-2017-10102.html https://www.suse.com/security/cve/CVE-2017-10105.html https://www.suse.com/security/cve/CVE-2017-10107.html https://www.suse.com/security/cve/CVE-2017-10108.html https://www.suse.com/security/cve/CVE-2017-10109.html https://www.suse.com/security/cve/CVE-2017-10110.html https://www.suse.com/security/cve/CVE-2017-10111.html https://www.suse.com/security/cve/CVE-2017-10114.html https://www.suse.com/security/cve/CVE-2017-10115.html https://www.suse.com/security/cve/CVE-2017-10116.html https://www.suse.com/security/cve/CVE-2017-10118.html https://www.suse.com/security/cve/CVE-2017-10125.html https://www.suse.com/security/cve/CVE-2017-10135.html https://www.suse.com/security/cve/CVE-2017-10176.html https://www.suse.com/security/cve/CVE-2017-10193.html https://www.suse.com/security/cve/CVE-2017-10198.html https://www.suse.com/security/cve/CVE-2017-10243.html https://bugzilla.suse.com/1049302 https://bugzilla.suse.com/1049305 https://bugzilla.suse.com/1049306 https://bugzilla.suse.com/1049307 https://bugzilla.suse.com/1049308 https://bugzilla.suse.com/1049309 https://bugzilla.suse.com/1049310 https://bugzilla.suse.com/1049311 https://bugzilla.suse.com/1049312 https://bugzilla.suse.com/1049313 https://bugzilla.suse.com/1049314 https://bugzilla.suse.com/1049315 https://bugzilla.suse.com/1049316 https://bugzilla.suse.com/1049317 https://bugzilla.suse.com/1049318 https://bugzilla.suse.com/1049319 https://bugzilla.suse.com/1049320 https://bugzilla.suse.com/1049321 https://bugzilla.suse.com/1049322 https://bugzilla.suse.com/1049323 https://bugzilla.suse.com/1049324 https://bugzilla.suse.com/1049325 https://bugzilla.suse.com/1049326 https://bugzilla.suse.com/1049327 https://bugzilla.suse.com/1049328 https://bugzilla.suse.com/1049329 https://bugzilla.suse.com/1049330 https://bugzilla.suse.com/1049331 https://bugzilla.suse.com/1049332 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0