January 2018 - openSUSE Security Announce

[security-announce] SUSE-SU-2018:0271-1: important: Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP1)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0271-1 Rating: important References: #1069708 #1071471 Cross-References: CVE-2017-15868 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues. The following security issues were fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bsc#1071471). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-188=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-188=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_60-default-5-2.1 kgraft-patch-3_12_74-60_64_60-xen-5-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_60-default-5-2.1 kgraft-patch-3_12_74-60_64_60-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-15868.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1071471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0270-1: important: Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP1)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0270-1 Rating: important References: #1069708 #1071471 Cross-References: CVE-2017-15868 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_63 fixes several issues. The following security issues were fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bsc#1071471). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-187=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-187=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_63-default-3-2.1 kgraft-patch-3_12_74-60_64_63-xen-3-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_63-default-3-2.1 kgraft-patch-3_12_74-60_64_63-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-15868.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1071471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0269-1: important: Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP2)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0269-1 Rating: important References: #1069708 #1070307 #1073230 Cross-References: CVE-2017-16939 CVE-2017-17712 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for the Linux Kernel 4.4.59-92_20 fixes several issues. The following security issues were fixed: - CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230). - CVE-2017-16939: The XFRM dump policy implementation allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2018-197=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_59-92_20-default-8-2.1 References: https://www.suse.com/security/cve/CVE-2017-16939.html https://www.suse.com/security/cve/CVE-2017-17712.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 https://bugzilla.suse.com/1073230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0268-1: important: Security update for the Linux Kernel (Live Patch 18 for SLE 12 SP1)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 18 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0268-1 Rating: important References: #1069708 #1071471 Cross-References: CVE-2017-15868 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues. The following security issues were fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bsc#1071471). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-193=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-193=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_51-default-6-2.1 kgraft-patch-3_12_74-60_64_51-xen-6-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_51-default-6-2.1 kgraft-patch-3_12_74-60_64_51-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-15868.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1071471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0267-1: important: Security update for the Linux Kernel (Live Patch 23 for SLE 12 SP1)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 23 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0267-1 Rating: important References: #1071471 Cross-References: CVE-2017-15868 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.74-60_64_66 fixes one issue. The following security issue was fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bsc#1071471). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-186=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-186=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_66-default-2-2.1 kgraft-patch-3_12_74-60_64_66-xen-2-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_66-default-2-2.1 kgraft-patch-3_12_74-60_64_66-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-15868.html https://bugzilla.suse.com/1071471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0266-1: important: Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP1)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0266-1 Rating: important References: #1069708 #1071471 Cross-References: CVE-2017-15868 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues. The following security issues were fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bsc#1071471). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-189=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-189=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_57-default-6-2.1 kgraft-patch-3_12_74-60_64_57-xen-6-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_57-default-6-2.1 kgraft-patch-3_12_74-60_64_57-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-15868.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1071471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0265-1: important: Security update for the Linux Kernel (Live Patch 19 for SLE 12)
by opensuse-security＠opensuse.org 29 Jan '18

29 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 19 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0265-1 Rating: important References: #1069708 #1071471 Cross-References: CVE-2017-15868 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_66 fixes one issue. The following security issues were fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bsc#1071471). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-185=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_66-default-11-2.1 kgraft-patch-3_12_61-52_66-xen-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-15868.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1071471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0259-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0259-1 Rating: important References: #1073323 #1077571 #1077722 Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032 CVE-2018-6033 CVE-2018-6034 CVE-2018-6035 CVE-2018-6036 CVE-2018-6037 CVE-2018-6038 CVE-2018-6039 CVE-2018-6040 CVE-2018-6041 CVE-2018-6042 CVE-2018-6043 CVE-2018-6045 CVE-2018-6046 CVE-2018-6047 CVE-2018-6048 CVE-2018-6049 CVE-2018-6050 CVE-2018-6051 CVE-2018-6052 CVE-2018-6053 CVE-2018-6054 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium to 64.0.3282.119 fixes several issues. These security issues were fixed: - CVE-2018-6031: Use after free in PDFium (boo#1077571) - CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571) - CVE-2018-6033: Race when opening downloaded files (boo#1077571) - CVE-2018-6034: Integer overflow in Blink (boo#1077571) - CVE-2018-6035: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571) - CVE-2018-6037: Insufficient user gesture requirements in autofill (boo#1077571) - CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571) - CVE-2018-6039: XSS in DevTools (boo#1077571) - CVE-2018-6040: Content security policy bypass (boo#1077571) - CVE-2018-6041: URL spoof in Navigation (boo#1077571) - CVE-2018-6042: URL spoof in OmniBox (boo#1077571) - CVE-2018-6043: Insufficient escaping with external URL handlers (boo#1077571) - CVE-2018-6045: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6046: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571) - CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571) - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571) - CVE-2018-6049: UI spoof in Permissions (boo#1077571) - CVE-2018-6050: URL spoof in OmniBox (boo#1077571) - CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571) - CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571) - CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571) - CVE-2018-6054: Use after free in WebUI (boo#1077571) Re was updated to version 2018-01-01 (boo#1073323) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-103=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libre2-0-20180101-9.1 libre2-0-debuginfo-20180101-9.1 re2-debugsource-20180101-9.1 re2-devel-20180101-9.1 - openSUSE Leap 42.3 (x86_64): chromedriver-64.0.3282.119-135.1 chromedriver-debuginfo-64.0.3282.119-135.1 chromium-64.0.3282.119-135.1 chromium-debuginfo-64.0.3282.119-135.1 chromium-debugsource-64.0.3282.119-135.1 libre2-0-32bit-20180101-9.1 libre2-0-debuginfo-32bit-20180101-9.1 References: https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2018-6031.html https://www.suse.com/security/cve/CVE-2018-6032.html https://www.suse.com/security/cve/CVE-2018-6033.html https://www.suse.com/security/cve/CVE-2018-6034.html https://www.suse.com/security/cve/CVE-2018-6035.html https://www.suse.com/security/cve/CVE-2018-6036.html https://www.suse.com/security/cve/CVE-2018-6037.html https://www.suse.com/security/cve/CVE-2018-6038.html https://www.suse.com/security/cve/CVE-2018-6039.html https://www.suse.com/security/cve/CVE-2018-6040.html https://www.suse.com/security/cve/CVE-2018-6041.html https://www.suse.com/security/cve/CVE-2018-6042.html https://www.suse.com/security/cve/CVE-2018-6043.html https://www.suse.com/security/cve/CVE-2018-6045.html https://www.suse.com/security/cve/CVE-2018-6046.html https://www.suse.com/security/cve/CVE-2018-6047.html https://www.suse.com/security/cve/CVE-2018-6048.html https://www.suse.com/security/cve/CVE-2018-6049.html https://www.suse.com/security/cve/CVE-2018-6050.html https://www.suse.com/security/cve/CVE-2018-6051.html https://www.suse.com/security/cve/CVE-2018-6052.html https://www.suse.com/security/cve/CVE-2018-6053.html https://www.suse.com/security/cve/CVE-2018-6054.html https://bugzilla.suse.com/1073323 https://bugzilla.suse.com/1077571 https://bugzilla.suse.com/1077722 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0258-1: important: Security update for clamav
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0258-1 Rating: important References: #1040662 #1049423 #1052448 #1052449 #1052466 #1077732 Cross-References: CVE-2017-11423 CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 CVE-2017-6418 CVE-2017-6419 CVE-2017-6420 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for clamav fixes the following issues: - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. - update upstream keys in the keyring - provide and obsolete clamav-nodb to trigger it's removal in Leap bsc#1040662 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-102=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.99.3-20.1 clamav-debuginfo-0.99.3-20.1 clamav-debugsource-0.99.3-20.1 References: https://www.suse.com/security/cve/CVE-2017-11423.html https://www.suse.com/security/cve/CVE-2017-12374.html https://www.suse.com/security/cve/CVE-2017-12375.html https://www.suse.com/security/cve/CVE-2017-12376.html https://www.suse.com/security/cve/CVE-2017-12377.html https://www.suse.com/security/cve/CVE-2017-12378.html https://www.suse.com/security/cve/CVE-2017-12379.html https://www.suse.com/security/cve/CVE-2017-12380.html https://www.suse.com/security/cve/CVE-2017-6418.html https://www.suse.com/security/cve/CVE-2017-6419.html https://www.suse.com/security/cve/CVE-2017-6420.html https://bugzilla.suse.com/1040662 https://bugzilla.suse.com/1049423 https://bugzilla.suse.com/1052448 https://bugzilla.suse.com/1052449 https://bugzilla.suse.com/1052466 https://bugzilla.suse.com/1077732 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0257-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0257-1 Rating: important References: #1077291 Cross-References: CVE-2018-5089 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-101=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-52.6-56.2 MozillaThunderbird-buildsymbols-52.6-56.2 MozillaThunderbird-debuginfo-52.6-56.2 MozillaThunderbird-debugsource-52.6-56.2 MozillaThunderbird-devel-52.6-56.2 MozillaThunderbird-translations-common-52.6-56.2 MozillaThunderbird-translations-other-52.6-56.2 - openSUSE Leap 42.3 (i586): MozillaThunderbird-52.6-56.1 MozillaThunderbird-buildsymbols-52.6-56.1 MozillaThunderbird-debuginfo-52.6-56.1 MozillaThunderbird-debugsource-52.6-56.1 MozillaThunderbird-devel-52.6-56.1 MozillaThunderbird-translations-common-52.6-56.1 MozillaThunderbird-translations-other-52.6-56.1 References: https://www.suse.com/security/cve/CVE-2018-5089.html https://www.suse.com/security/cve/CVE-2018-5095.html https://www.suse.com/security/cve/CVE-2018-5096.html https://www.suse.com/security/cve/CVE-2018-5097.html https://www.suse.com/security/cve/CVE-2018-5098.html https://www.suse.com/security/cve/CVE-2018-5099.html https://www.suse.com/security/cve/CVE-2018-5102.html https://www.suse.com/security/cve/CVE-2018-5103.html https://www.suse.com/security/cve/CVE-2018-5104.html https://www.suse.com/security/cve/CVE-2018-5117.html https://bugzilla.suse.com/1077291 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0