March 2018 - openSUSE Security Announce

[security-announce] SUSE-SU-2018:0743-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 19 Mar '18

19 Mar '18

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0743-1 Rating: important References: #1057460 #1076390 #1082810 #1085018 #929900 #955131 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_1-ibm fixes the following issue: The version was updated to 7.1.4.20 [bsc#1082810] * Security fixes: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl -- Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl -- SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - IJ02284 JIT Compiler: Division by zero in JIT compiler * SUSE fixes: - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) - Fixed jpackage-java-1_7_1-ibm-webstart.desktop file to allow Java jnlp files run from Firefox. [bsc#1057460, bsc#1076390] - Fix javaws segfaults when java expiration timer has elapsed. [bsc#929900] - Provide IBM Java updates for IBMs PMR 55931,671,760 and for SUSEs SR 110991601735. [bsc#966304] - Ensure that all Java policy files are symlinked into the proper file system locations. Without those symlinks, several OES iManager plugins did not function properly. [bsc#1085018] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-498=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-498=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-498=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-498=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-498=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-498=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-498=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-498=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-devel-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-devel-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-devel-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-devel-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.16.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.16.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.16.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/1085018 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/955131 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0737-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0737-1 Rating: important References: #1085671 Cross-References: CVE-2018-5146 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Mozilla Firefox to version 52.7.2esr fixes security issues and bugs. Security issues fixed: - CVE-2018-5146: Specially crafted vorbis files could have been used to execute arbitrary code via an Out of bounds memory write (bsc#1085671, MFSA 2018-08) - CVE-2018-5147: Specially crafted vorbis files could have been used to execute arbitrary code via an Out of bounds memory write - used on ARM platforms (bsc#1085671, MFSA 2018-08) The following bug fixes are included: - Stability improvements in the Italian locale Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-278=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.7.2-81.1 MozillaFirefox-branding-upstream-52.7.2-81.1 MozillaFirefox-buildsymbols-52.7.2-81.1 MozillaFirefox-debuginfo-52.7.2-81.1 MozillaFirefox-debugsource-52.7.2-81.1 MozillaFirefox-devel-52.7.2-81.1 MozillaFirefox-translations-common-52.7.2-81.1 MozillaFirefox-translations-other-52.7.2-81.1 References: https://www.suse.com/security/cve/CVE-2018-5146.html https://bugzilla.suse.com/1085671 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0734-1: important: Security update for SDL2, SDL2_image
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for SDL2, SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0734-1 Rating: important References: #1025413 #1084256 #1084257 #1084282 #1084288 #1084297 #1084303 #1084304 Cross-References: CVE-2017-12122 CVE-2017-14440 CVE-2017-14441 CVE-2017-14442 CVE-2017-14448 CVE-2017-14449 CVE-2017-14450 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for SDL2 and SDL2_image fixes the following issues: - CVE-2017-14441: Code execution in the ICO image rendering (bsc#1084282). - CVE-2017-14440: Potential code execution in the ILBM image rendering functionality (bsc#1084257). - CVE-2017-12122: Potential code execution in the ILBM image rendering fuctionality (bsc#1084256). - CVE-2017-14448: Heap buffer overflow in the XCF image rendering functionality (bsc#1084303). - CVE-2017-14449: Double-Free in the XCF image rendering (bsc#1084297). - CVE-2017-14442: Stack buffer overflow the BMP image rendering functionality (bsc#1084304). - CVE-2017-14450: Buffer overflow in the GIF image parsing (bsc#1084288). Bug fixes: - boo#1025413: Add dbus-ime.diff and build with fcitx. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): SDL2-debugsource-2.0.8-18.1 SDL2_image-debugsource-2.0.3-13.10.1 libSDL2-2_0-0-2.0.8-18.1 libSDL2-2_0-0-debuginfo-2.0.8-18.1 libSDL2-devel-2.0.8-18.1 libSDL2_image-2_0-0-2.0.3-13.10.1 libSDL2_image-2_0-0-debuginfo-2.0.3-13.10.1 libSDL2_image-devel-2.0.3-13.10.1 - openSUSE Leap 42.3 (x86_64): libSDL2-2_0-0-32bit-2.0.8-18.1 libSDL2-2_0-0-debuginfo-32bit-2.0.8-18.1 libSDL2-devel-32bit-2.0.8-18.1 libSDL2_image-2_0-0-32bit-2.0.3-13.10.1 libSDL2_image-2_0-0-debuginfo-32bit-2.0.3-13.10.1 libSDL2_image-devel-32bit-2.0.3-13.10.1 References: https://www.suse.com/security/cve/CVE-2017-12122.html https://www.suse.com/security/cve/CVE-2017-14440.html https://www.suse.com/security/cve/CVE-2017-14441.html https://www.suse.com/security/cve/CVE-2017-14442.html https://www.suse.com/security/cve/CVE-2017-14448.html https://www.suse.com/security/cve/CVE-2017-14449.html https://www.suse.com/security/cve/CVE-2017-14450.html https://bugzilla.suse.com/1025413 https://bugzilla.suse.com/1084256 https://bugzilla.suse.com/1084257 https://bugzilla.suse.com/1084282 https://bugzilla.suse.com/1084288 https://bugzilla.suse.com/1084297 https://bugzilla.suse.com/1084303 https://bugzilla.suse.com/1084304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0730-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0730-1 Rating: important References: #1078431 Cross-References: CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: MariaDB was updated to 10.0.34 (bsc#1078431) The following security vulnerabilities are fixed: - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The MariaDB external release notes and changelog for this release: * https://kb.askmonty.org/en/mariadb-10034-release-notes * https://kb.askmonty.org/en/mariadb-10034-changelog This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysqlclient-devel-10.0.34-32.2 libmysqlclient18-10.0.34-32.2 libmysqlclient18-debuginfo-10.0.34-32.2 libmysqlclient_r18-10.0.34-32.2 libmysqld-devel-10.0.34-32.2 libmysqld18-10.0.34-32.2 libmysqld18-debuginfo-10.0.34-32.2 mariadb-10.0.34-32.2 mariadb-bench-10.0.34-32.2 mariadb-bench-debuginfo-10.0.34-32.2 mariadb-client-10.0.34-32.2 mariadb-client-debuginfo-10.0.34-32.2 mariadb-debuginfo-10.0.34-32.2 mariadb-debugsource-10.0.34-32.2 mariadb-errormessages-10.0.34-32.2 mariadb-test-10.0.34-32.2 mariadb-test-debuginfo-10.0.34-32.2 mariadb-tools-10.0.34-32.2 mariadb-tools-debuginfo-10.0.34-32.2 - openSUSE Leap 42.3 (x86_64): libmysqlclient18-32bit-10.0.34-32.2 libmysqlclient18-debuginfo-32bit-10.0.34-32.2 libmysqlclient_r18-32bit-10.0.34-32.2 References: https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1078431 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0710-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0710-1 Rating: important References: #1085207 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ucode-intel-20180312-22.1 ucode-intel-blob-20180312-22.1 ucode-intel-debuginfo-20180312-22.1 ucode-intel-debugsource-20180312-22.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1085207 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0708-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

SUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0708-1 Rating: important References: #1085207 Cross-References: CVE-2017-5715 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-479=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-479=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-479=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-479=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-479=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-479=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-479=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-479=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1085207 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0705-1: important: Security update for microcode_ctl
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

SUSE Security Update: Security update for microcode_ctl ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0705-1 Rating: important References: #1085207 Cross-References: CVE-2017-5715 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-microcode_ctl-13514=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-microcode_ctl-13514=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-microcode_ctl-13514=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): microcode_ctl-1.17-102.83.15.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): microcode_ctl-1.17-102.83.15.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): microcode_ctl-1.17-102.83.15.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1085207 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0704-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0704-1 Rating: important References: #1084296 Cross-References: CVE-2017-11215 CVE-2017-11225 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073 CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077 CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081 CVE-2018-6082 CVE-2018-6083 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for Chromium to version 65.0.3325.162 fixes the following issues: - CVE-2017-11215: Use after free in Flash - CVE-2017-11225: Use after free in Flash - CVE-2018-6060: Use after free in Blink - CVE-2018-6061: Race condition in V8 - CVE-2018-6062: Heap buffer overflow in Skia - CVE-2018-6057: Incorrect permissions on shared memory - CVE-2018-6063: Incorrect permissions on shared memory - CVE-2018-6064: Type confusion in V8 - CVE-2018-6065: Integer overflow in V8 - CVE-2018-6066: Same Origin Bypass via canvas - CVE-2018-6067: Buffer overflow in Skia - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab - CVE-2018-6069: Stack buffer overflow in Skia - CVE-2018-6070: CSP bypass through extensions - CVE-2018-6071: Heap bufffer overflow in Skia - CVE-2018-6072: Integer overflow in PDFium - CVE-2018-6073: Heap bufffer overflow in WebGL - CVE-2018-6074: Mark-of-the-Web bypass - CVE-2018-6075: Overly permissive cross origin downloads - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink - CVE-2018-6077: Timing attack using SVG filters - CVE-2018-6078: URL Spoof in OmniBox - CVE-2018-6079: Information disclosure via texture data in WebGL - CVE-2018-6080: Information disclosure in IPC call - CVE-2018-6081: XSS in interstitials - CVE-2018-6082: Circumvention of port blocking - CVE-2018-6083: Incorrect processing of AppManifests Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-65.0.3325.162-146.1 chromedriver-debuginfo-65.0.3325.162-146.1 chromium-65.0.3325.162-146.1 chromium-debuginfo-65.0.3325.162-146.1 chromium-debugsource-65.0.3325.162-146.1 References: https://www.suse.com/security/cve/CVE-2017-11215.html https://www.suse.com/security/cve/CVE-2017-11225.html https://www.suse.com/security/cve/CVE-2018-6057.html https://www.suse.com/security/cve/CVE-2018-6060.html https://www.suse.com/security/cve/CVE-2018-6061.html https://www.suse.com/security/cve/CVE-2018-6062.html https://www.suse.com/security/cve/CVE-2018-6063.html https://www.suse.com/security/cve/CVE-2018-6064.html https://www.suse.com/security/cve/CVE-2018-6065.html https://www.suse.com/security/cve/CVE-2018-6066.html https://www.suse.com/security/cve/CVE-2018-6067.html https://www.suse.com/security/cve/CVE-2018-6068.html https://www.suse.com/security/cve/CVE-2018-6069.html https://www.suse.com/security/cve/CVE-2018-6070.html https://www.suse.com/security/cve/CVE-2018-6071.html https://www.suse.com/security/cve/CVE-2018-6072.html https://www.suse.com/security/cve/CVE-2018-6073.html https://www.suse.com/security/cve/CVE-2018-6074.html https://www.suse.com/security/cve/CVE-2018-6075.html https://www.suse.com/security/cve/CVE-2018-6076.html https://www.suse.com/security/cve/CVE-2018-6077.html https://www.suse.com/security/cve/CVE-2018-6078.html https://www.suse.com/security/cve/CVE-2018-6079.html https://www.suse.com/security/cve/CVE-2018-6080.html https://www.suse.com/security/cve/CVE-2018-6081.html https://www.suse.com/security/cve/CVE-2018-6082.html https://www.suse.com/security/cve/CVE-2018-6083.html https://bugzilla.suse.com/1084296 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0698-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0698-1 Rating: important References: #1064101 #1064115 #1072665 #1078431 Cross-References: CVE-2017-10268 CVE-2017-10378 CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for mariadb to 10.0.34 fixes several issues. These security issues were fixed: - CVE-2017-10378: Vulnerability in subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) (bsc#1064115). - CVE-2017-10268: Vulnerability in subcomponent: Server: Replication. Difficult to exploit vulnerability allowed high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data (bsc#1064101). - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. These non-security issues were fixed: - Relax the required version of mariadb-errormessages to fix the update to MariaDB 10.2. (bsc#1072665) - CHECK TABLE no longer returns an error when run on a CONNECT table - 'Undo log record is too big.' error occurring in very narrow range of string lengths - Race condition between INFORMATION_SCHEMA.INNODB_SYS_TABLESTATS and ALTER/DROP/TRUNCATE TABLE - Wrong result after altering a partitioned table fixed bugs in InnoDB FULLTEXT INDEX - InnoDB FTS duplicate key error * MDEV-13051: InnoDB crash after failed ADD INDEX and table_definition_cache eviction - fts_create_doc_id() unnecessarily allocates 8 bytes for every inserted row - IMPORT TABLESPACE may corrupt ROW_FORMAT=REDUNDANT tables For additional changes please see https://kb.askmonty.org/en/mariadb-10033-changelog and https://kb.askmonty.org/en/mariadb-10034-changelog . Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-477=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-20.43.1 libmysqlclient18-10.0.34-20.43.1 libmysqlclient18-debuginfo-10.0.34-20.43.1 libmysqlclient_r18-10.0.34-20.43.1 libmysqld-devel-10.0.34-20.43.1 libmysqld18-10.0.34-20.43.1 libmysqld18-debuginfo-10.0.34-20.43.1 mariadb-10.0.34-20.43.1 mariadb-client-10.0.34-20.43.1 mariadb-client-debuginfo-10.0.34-20.43.1 mariadb-debuginfo-10.0.34-20.43.1 mariadb-debugsource-10.0.34-20.43.1 mariadb-errormessages-10.0.34-20.43.1 mariadb-tools-10.0.34-20.43.1 mariadb-tools-debuginfo-10.0.34-20.43.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): libmysqlclient18-32bit-10.0.34-20.43.1 libmysqlclient18-debuginfo-32bit-10.0.34-20.43.1 References: https://www.suse.com/security/cve/CVE-2017-10268.html https://www.suse.com/security/cve/CVE-2017-10378.html https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1064101 https://bugzilla.suse.com/1064115 https://bugzilla.suse.com/1072665 https://bugzilla.suse.com/1078431 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0697-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0697-1 Rating: important References: #1078431 Cross-References: CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: MariaDB was updated to 10.0.34 (bsc#1078431) The following security vulnerabilities are fixed: - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The MariaDB external release notes and changelog for this release: * https://kb.askmonty.org/en/mariadb-10034-release-notes * https://kb.askmonty.org/en/mariadb-10034-changelog Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-478=1 - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2018-478=1 - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2018-478=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-478=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-478=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-478=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-478=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-478=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-478=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-478=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-478=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-478=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 References: https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1078431 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0694-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0694-1 Rating: important References: #1057460 #1076390 #1082810 #1085018 #929900 #955131 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_1-ibm fixes the following issues: The version was updated to 7.1.4.20 [bsc#1082810] * Security fixes: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl -- Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl -- SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - IJ02284 JIT Compiler: Division by zero in JIT compiler * SUSE fixes: - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) - Fixed symlinks to policy files on update [bsc#1085018] - Fixed jpackage-java-1_7_1-ibm-webstart.desktop file to allow Java jnlp files run from Firefox. [bsc#1057460, bsc#1076390] - Fix javaws segfaults when java expiration timer has elapsed. [bsc#929900] - Provide IBM Java updates for IBMs PMR 55931,671,760 and for SUSEs SR 110991601735. [bsc#966304] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-475=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-475=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-475=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-475=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.12.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/1085018 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/955131 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0684-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0684-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-256=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.171-48.3 java-1_7_0-openjdk-accessibility-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-devel-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-headless-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-debugsource-1.7.0.171-48.3 java-1_7_0-openjdk-demo-1.7.0.171-48.3 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-devel-1.7.0.171-48.3 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-headless-1.7.0.171-48.3 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-src-1.7.0.171-48.3 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.171-48.3 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0681-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0681-1 Rating: important References: #1076907 #1085130 Cross-References: CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5130 CVE-2018-5131 CVE-2018-5144 CVE-2018-5145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for Mozilla Firefox to version 52.7.0esr fixes multiple issues. Security issues fixed (bsc#1085130, MFSA 2018-07): - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption - CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources - CVE-2018-5144: Integer overflow during Unicode conversion - CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 - CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7 The following bug fixes are included: - bsc#1076907: provide mimehandler(text/html) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-255=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.7-78.1 MozillaFirefox-branding-upstream-52.7-78.1 MozillaFirefox-buildsymbols-52.7-78.1 MozillaFirefox-debuginfo-52.7-78.1 MozillaFirefox-debugsource-52.7-78.1 MozillaFirefox-devel-52.7-78.1 MozillaFirefox-translations-common-52.7-78.1 MozillaFirefox-translations-other-52.7-78.1 References: https://www.suse.com/security/cve/CVE-2018-5125.html https://www.suse.com/security/cve/CVE-2018-5127.html https://www.suse.com/security/cve/CVE-2018-5129.html https://www.suse.com/security/cve/CVE-2018-5130.html https://www.suse.com/security/cve/CVE-2018-5131.html https://www.suse.com/security/cve/CVE-2018-5144.html https://www.suse.com/security/cve/CVE-2018-5145.html https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1085130 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0679-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0679-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Security issues fix in jdk8u161 (icedtea 3.7.0)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2582: Better interface invocations - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming deserialization cases This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-254=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.161-21.1 java-1_8_0-openjdk-accessibility-1.8.0.161-21.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-debugsource-1.8.0.161-21.1 java-1_8_0-openjdk-demo-1.8.0.161-21.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-devel-1.8.0.161-21.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-headless-1.8.0.161-21.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-src-1.8.0.161-21.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.161-21.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0678-1: important: Security update for xen
by opensuse-security＠opensuse.org 14 Mar '18

14 Mar '18

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0678-1 Rating: important References: #1024307 #1030144 #1061081 #1068032 #1070158 #1070159 #1070160 #1070163 #1074562 #1076116 #1076180 #1080635 #1080662 Cross-References: CVE-2017-11334 CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-5898 CVE-2018-5683 CVE-2018-7540 CVE-2018-7541 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307) - Unprivileged domains could have issued well-timed writes to xenstore which conflict with transactions to stall progress of the control domain or driver domain, possibly leading to DoS (bsc#1030144, XSA-206). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13511=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13511=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13511=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.14-45.19.1 xen-libs-4.2.5_21-45.19.1 xen-tools-domU-4.2.5_21-45.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-45.19.1 xen-doc-html-4.2.5_21-45.19.1 xen-doc-pdf-4.2.5_21-45.19.1 xen-libs-32bit-4.2.5_21-45.19.1 xen-tools-4.2.5_21-45.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.14-45.19.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.14-45.19.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.14-45.19.1 xen-libs-4.2.5_21-45.19.1 xen-tools-domU-4.2.5_21-45.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-45.19.1 xen-debugsource-4.2.5_21-45.19.1 References: https://www.suse.com/security/cve/CVE-2017-11334.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-17563.html https://www.suse.com/security/cve/CVE-2017-17564.html https://www.suse.com/security/cve/CVE-2017-17565.html https://www.suse.com/security/cve/CVE-2017-17566.html https://www.suse.com/security/cve/CVE-2017-18030.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-5898.html https://www.suse.com/security/cve/CVE-2018-5683.html https://www.suse.com/security/cve/CVE-2018-7540.html https://www.suse.com/security/cve/CVE-2018-7541.html https://bugzilla.suse.com/1024307 https://bugzilla.suse.com/1030144 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070158 https://bugzilla.suse.com/1070159 https://bugzilla.suse.com/1070160 https://bugzilla.suse.com/1070163 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1076116 https://bugzilla.suse.com/1076180 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0665-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0665-1 Rating: important References: #1076390 #1082810 #929900 #955131 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2638 CVE-2018-2639 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for java-1_8_0-ibm fixes the following issues: - Removed java-1_8_0-ibm-alsa and java-1_8_0-ibm-plugin entries in baselibs.conf due to errors in osc source_validator Version update to 8.0.5.10 [bsc#1082810] * Security fixes: CVE-2018-2639 CVE-2018-2638 CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ02608 Class Libraries: Change of namespace definitions with handlers that implement javax.xml.ws.handler.soap.soaphandler - IJ04280 Class Libraries: Deploy Upgrade to Oracle level 8u161-b12 - IJ03390 Class Libraries: JCL Upgrade to Oracle level 8u161-b12 - IJ04001 Class Libraries: Performance improvement with child process on AIX - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03440 Java Virtual Machine: Assertion failure during class creation - IJ03717 Java Virtual Machine: Assertion for gencon with concurrent scavenger on ZOS64 - IJ03513 Java Virtual Machine: Assertion in concurrent scavenger if initial heap memory size -Xms is set too low - IJ03994 Java Virtual Machine: Class.getmethods() does not return all methods - IJ03413 Java Virtual Machine: Hang creating thread after redefining classes - IJ03852 Java Virtual Machine: ICH408I message when groupaccess is specified with -xshareclasses - IJ03716 Java Virtual Machine: java/lang/linkageerror from sun/misc/unsafe.definean onymousclass() - IJ03116 Java Virtual Machine: java.fullversion string contains an extra space - IJ03347 Java Virtual Machine: java.lang.IllegalStateException in related class MemoryMXBean - IJ03878 Java Virtual Machine: java.lang.StackOverflowError is thrown when custom security manager in place - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ04248 JIT Compiler: ArrayIndexOutOfBoundsException is thrown when converting BigDecimal to String - IJ04250 JIT Compiler: Assertion failure with concurrentScavenge on Z14 - IJ03606 JIT Compiler: Java crashes with -version - IJ04251 JIT Compiler: JIT compiled method that takes advantage of AutoSIMD produces an incorrect result on x86 - IJ03854 JIT Compiler: JVM info message appears in stdout - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ03715 Security: Add additional support for the IBMJCEPlus provider, add support for new IBMJCEPlusFIPS provider - IJ03800 Security: A fix in CMS provider for KDB integrity - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - PI93233 z/OS Extentions: Cipher.doFinal() fails when using AES/GCM/nopadding with AAD data of 13 bytes and a block size of 4081 to 4096 * Fixes in 8.0.5.7: - IJ02605 Class Libraries: Update IBM-1371 charset with new specification support - IJ02541 Java Virtual Machine: Assertions in GC when jvmti runs with Concurrent Scavenger - IJ02443 Java Virtual Machine: Committed eden region size is bigger than maximum eden region size - IJ02378 Java Virtual Machine: Existing signal action for SIG_IGN/SIG_DFL is not detected properly - IJ02758 JIT Compiler: Crash in JIT module during method compilation - IJ02733 JIT Compiler: Crash in jit module when compiling in non-default configuration * Fixes in 8.0.5.6: - IJ02283 Java Virtual Machine: IllegalAccessException due to a missing access check for the same class in MethodHandle apis - IJ02082 Java Virtual Machine: The default value for class unloading kick off threshold is not set - IJ02018 JIT Compiler: Crash or assertion while attempting to acquire VM access - IJ02284 JIT Compiler: Division by zero in JIT compiler - IV88941 JIT Compiler: JIT compiler takes far too long to compile a method - IJ02285 JIT Compiler: Performance degradation during class unloading in Java 8 SR5 - Support Java jnlp files run from Firefox. [bsc#1076390] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-447=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-447=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-447=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-447=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-447=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-447=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-447=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2638.html https://www.suse.com/security/cve/CVE-2018-2639.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/955131 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0664-1: important: Security update for the Linux Kernel (Live Patch 32 for SLE 12)
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 32 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0664-1 Rating: important References: #1064392 Cross-References: CVE-2017-15649 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.61-52_122 fixes several issues. The following security issue was fixed: - CVE-2017-15649: net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346 (bsc#1064392) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-450=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_122-default-2-2.1 kgraft-patch-3_12_61-52_122-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-15649.html https://bugzilla.suse.com/1064392 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0663-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0663-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Security issues fix in jdk8u161 (icedtea 3.7.0)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2582: Better interface invocations - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming deserialization cases Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-449=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-449=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-449=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-449=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-449=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-449=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-449=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-449=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0661-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0661-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-448=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-448=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-448=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-448=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-448=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0660-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0660-1 Rating: important References: #1012382 #1054305 #1060279 #1068032 #1068984 #1070781 #1073311 #1074488 #1074621 #1075091 #1075410 #1075617 #1075621 #1075908 #1075994 #1076017 #1076154 #1076278 #1076849 #1077406 #1077560 #1077922 Cross-References: CVE-2017-13215 CVE-2017-17741 CVE-2017-18017 CVE-2017-18079 CVE-2017-5715 CVE-2018-1000004 CVE-2018-5332 CVE-2018-5333 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 14 fixes is now available. Description: The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032). The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka "retpolines". - CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621). - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617). - CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488). - CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922). - CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311). - CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908). - CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017). The following non-security bugs were fixed: - cdc-acm: apply quirk for card reader (bsc#1060279). - Enable CPU vulnerabilities reporting via sysfs - fork: clear thread stack upon allocation (bsc#1077560). - kaiser: Set _PAGE_NX only if supported (bnc#1012382, bnc#1076278). - kbuild: modversions for EXPORT_SYMBOL() for asm (bsc#1074621 bsc#1068032). - Move kABI fixup for retpolines to proper place. - powerpc/vdso64: Use double word compare on pointers (bsc#1070781). - s390: add ppa to the idle loop (bnc#1077406, LTC#163910). - s390/cpuinfo: show facilities as reported by stfle (bnc#1076849, LTC#163741). - storvsc: do not assume SG list is continuous when doing bounce buffers (bsc#1075410). - sysfs/cpu: Add vulnerability folder (bnc#1012382). - sysfs/cpu: Fix typos in vulnerability documentation (bnc#1012382). - sysfs: spectre_v2, handle spec_ctrl (bsc#1075994 bsc#1075091). - x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984). - x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984). - x86/boot: Fix early command-line parsing when matching at end (bsc#1068032). - x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091). - x86/cpu: Implement CPU vulnerabilites sysfs functions (bnc#1012382). - x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091). - x86/kaiser: Populate shadow PGD with NX bit only if supported by platform (bsc#1076154 bsc#1076278). - x86/kaiser: use trampoline stack for kernel entry. - x86/microcode/intel: Disable late loading on model 79 (bsc#1054305). - x86/microcode/intel: Extend BDW late-loading further with LLC size check (bsc#1054305). - x86/microcode/intel: Extend BDW late-loading with a revision check (bsc#1054305). - x86/microcode: Rescan feature flags upon late loading (bsc#1075994 bsc#1075091). - x86/retpolines/spec_ctrl: disable IBRS on !SKL if retpolines are active (bsc#1068032). - x86/spec_ctrl: handle late setting of X86_FEATURE_SPEC_CTRL properly (bsc#1075994 bsc#1075091). - x86/spectre_v2: fix ordering in IBRS initialization (bsc#1075994 bsc#1075091). - x86/spectre_v2: nospectre_v2 means nospec too (bsc#1075994 bsc#1075091). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-kernel-20180212-13505=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-20180212-13505=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-kernel-20180212-13505=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-20180212-13505=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.47.106.19.1 kernel-default-base-3.0.101-0.47.106.19.1 kernel-default-devel-3.0.101-0.47.106.19.1 kernel-source-3.0.101-0.47.106.19.1 kernel-syms-3.0.101-0.47.106.19.1 kernel-trace-3.0.101-0.47.106.19.1 kernel-trace-base-3.0.101-0.47.106.19.1 kernel-trace-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.47.106.19.1 kernel-ec2-base-3.0.101-0.47.106.19.1 kernel-ec2-devel-3.0.101-0.47.106.19.1 kernel-xen-3.0.101-0.47.106.19.1 kernel-xen-base-3.0.101-0.47.106.19.1 kernel-xen-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): kernel-bigsmp-3.0.101-0.47.106.19.1 kernel-bigsmp-base-3.0.101-0.47.106.19.1 kernel-bigsmp-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x): kernel-default-man-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): kernel-pae-3.0.101-0.47.106.19.1 kernel-pae-base-3.0.101-0.47.106.19.1 kernel-pae-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-bigsmp-extra-3.0.101-0.47.106.19.1 kernel-trace-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): kernel-default-3.0.101-0.47.106.19.1 kernel-default-base-3.0.101-0.47.106.19.1 kernel-default-devel-3.0.101-0.47.106.19.1 kernel-ec2-3.0.101-0.47.106.19.1 kernel-ec2-base-3.0.101-0.47.106.19.1 kernel-ec2-devel-3.0.101-0.47.106.19.1 kernel-pae-3.0.101-0.47.106.19.1 kernel-pae-base-3.0.101-0.47.106.19.1 kernel-pae-devel-3.0.101-0.47.106.19.1 kernel-source-3.0.101-0.47.106.19.1 kernel-syms-3.0.101-0.47.106.19.1 kernel-trace-3.0.101-0.47.106.19.1 kernel-trace-base-3.0.101-0.47.106.19.1 kernel-trace-devel-3.0.101-0.47.106.19.1 kernel-xen-3.0.101-0.47.106.19.1 kernel-xen-base-3.0.101-0.47.106.19.1 kernel-xen-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.47.106.19.1 kernel-default-debugsource-3.0.101-0.47.106.19.1 kernel-trace-debuginfo-3.0.101-0.47.106.19.1 kernel-trace-debugsource-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.47.106.19.1 kernel-ec2-debugsource-3.0.101-0.47.106.19.1 kernel-xen-debuginfo-3.0.101-0.47.106.19.1 kernel-xen-debugsource-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-bigsmp-debuginfo-3.0.101-0.47.106.19.1 kernel-bigsmp-debugsource-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586): kernel-pae-debuginfo-3.0.101-0.47.106.19.1 kernel-pae-debugsource-3.0.101-0.47.106.19.1 References: https://www.suse.com/security/cve/CVE-2017-13215.html https://www.suse.com/security/cve/CVE-2017-17741.html https://www.suse.com/security/cve/CVE-2017-18017.html https://www.suse.com/security/cve/CVE-2017-18079.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-5332.html https://www.suse.com/security/cve/CVE-2018-5333.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1054305 https://bugzilla.suse.com/1060279 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1068984 https://bugzilla.suse.com/1070781 https://bugzilla.suse.com/1073311 https://bugzilla.suse.com/1074488 https://bugzilla.suse.com/1074621 https://bugzilla.suse.com/1075091 https://bugzilla.suse.com/1075410 https://bugzilla.suse.com/1075617 https://bugzilla.suse.com/1075621 https://bugzilla.suse.com/1075908 https://bugzilla.suse.com/1075994 https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1076154 https://bugzilla.suse.com/1076278 https://bugzilla.suse.com/1076849 https://bugzilla.suse.com/1077406 https://bugzilla.suse.com/1077560 https://bugzilla.suse.com/1077922 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0645-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0645-1 Rating: important References: #1057460 #1076390 #1082810 #929900 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_0-ibm provides the following fixes: The version was updated to 7.0.10.20 [bsc#1082810]: * Following security issues were fixed: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ02284 JIT Compiler: Division by zero in JIT compiler - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-java-1_7_0-ibm-13503=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-java-1_7_0-ibm-13503=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): java-1_7_0-ibm-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-devel-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-jdbc-1.7.0_sr10.20-65.13.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-plugin-1.7.0_sr10.20-65.13.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): java-1_7_0-ibm-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-alsa-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-devel-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-jdbc-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-plugin-1.7.0_sr10.20-65.13.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0638-1: important: Security update for xen
by opensuse-security＠opensuse.org 08 Mar '18

08 Mar '18

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0638-1 Rating: important References: #1027519 #1031382 #1035442 #1061081 #1068032 #1070158 #1070159 #1070160 #1070163 #1074562 #1076116 #1076180 #1080635 #1080662 Cross-References: CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-5683 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for xen fixes several issues. This new feature was included: - add script and sysv service to watch for vcpu online/offline events in a HVM domU These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). These non-security issues were fixed: - bsc#1035442: Increased the value of LIBXL_DESTROY_TIMEOUT from 10 to 100 seconds. If many domUs shutdown in parallel the backends couldn't keep up - bsc#1031382: Prevent VMs from crashing when migrating between dom0 hosts in case read() returns zero on the receiver side. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-13501=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-13501=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-13501=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.4_28-61.23.2 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.4_28_3.0.101_108.35-61.23.2 xen-libs-4.4.4_28-61.23.2 xen-tools-domU-4.4.4_28-61.23.2 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.4_28-61.23.2 xen-doc-html-4.4.4_28-61.23.2 xen-libs-32bit-4.4.4_28-61.23.2 xen-tools-4.4.4_28-61.23.2 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.4_28_3.0.101_108.35-61.23.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.4_28-61.23.2 xen-debugsource-4.4.4_28-61.23.2 References: https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-17563.html https://www.suse.com/security/cve/CVE-2017-17564.html https://www.suse.com/security/cve/CVE-2017-17565.html https://www.suse.com/security/cve/CVE-2017-17566.html https://www.suse.com/security/cve/CVE-2017-18030.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2018-5683.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1031382 https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070158 https://bugzilla.suse.com/1070159 https://bugzilla.suse.com/1070160 https://bugzilla.suse.com/1070163 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1076116 https://bugzilla.suse.com/1076180 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0630-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0630-1 Rating: important References: #1057460 #1076390 #1082810 #929900 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_1-ibm provides the following fix: The version was updated to 7.1.4.20 [bsc#1082810] * Security fixes: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - IJ02284 JIT Compiler: Division by zero in JIT compiler - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-java-1_7_1-ibm-13500=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-java-1_7_1-ibm-13500=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-26.13.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-26.13.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-26.13.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-26.13.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-26.13.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0618-1: important: Security update for cups
by opensuse-security＠opensuse.org 06 Mar '18

06 Mar '18

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0618-1 Rating: important References: #1081557 Cross-References: CVE-2017-18190 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cups fixes the following issues: - CVE-2017-18190: Removed localhost.localdomain from list of trustworthy hosts in scheduler/client.c to avoid arbitrary IPP command execution in conjunction with DNS rebinding. (bsc#1081557) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-225=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cups-1.7.5-12.3.1 cups-client-1.7.5-12.3.1 cups-client-debuginfo-1.7.5-12.3.1 cups-ddk-1.7.5-12.3.1 cups-ddk-debuginfo-1.7.5-12.3.1 cups-debuginfo-1.7.5-12.3.1 cups-debugsource-1.7.5-12.3.1 cups-devel-1.7.5-12.3.1 cups-libs-1.7.5-12.3.1 cups-libs-debuginfo-1.7.5-12.3.1 - openSUSE Leap 42.3 (x86_64): cups-libs-32bit-1.7.5-12.3.1 cups-libs-debuginfo-32bit-1.7.5-12.3.1 References: https://www.suse.com/security/cve/CVE-2017-18190.html https://bugzilla.suse.com/1081557 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0609-1: important: Security update for xen
by opensuse-security＠opensuse.org 05 Mar '18

05 Mar '18

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0609-1 Rating: important References: #1035442 #1061081 #1068032 #1070158 #1070159 #1070160 #1070163 #1074562 #1076116 #1076180 #1080635 #1080662 Cross-References: CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-5683 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that solves 10 vulnerabilities and has two fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). This non-security issue was fixed: - bsc#1035442: Increased the value of LIBXL_DESTROY_TIMEOUT from 10 to 100 seconds. If many domUs shutdown in parallel the backends couldn't keep up Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-415=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-415=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-415=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): xen-4.5.5_24-22.43.1 xen-debugsource-4.5.5_24-22.43.1 xen-doc-html-4.5.5_24-22.43.1 xen-kmp-default-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-kmp-default-debuginfo-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-libs-32bit-4.5.5_24-22.43.1 xen-libs-4.5.5_24-22.43.1 xen-libs-debuginfo-32bit-4.5.5_24-22.43.1 xen-libs-debuginfo-4.5.5_24-22.43.1 xen-tools-4.5.5_24-22.43.1 xen-tools-debuginfo-4.5.5_24-22.43.1 xen-tools-domU-4.5.5_24-22.43.1 xen-tools-domU-debuginfo-4.5.5_24-22.43.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): xen-4.5.5_24-22.43.1 xen-debugsource-4.5.5_24-22.43.1 xen-doc-html-4.5.5_24-22.43.1 xen-kmp-default-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-kmp-default-debuginfo-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-libs-32bit-4.5.5_24-22.43.1 xen-libs-4.5.5_24-22.43.1 xen-libs-debuginfo-32bit-4.5.5_24-22.43.1 xen-libs-debuginfo-4.5.5_24-22.43.1 xen-tools-4.5.5_24-22.43.1 xen-tools-debuginfo-4.5.5_24-22.43.1 xen-tools-domU-4.5.5_24-22.43.1 xen-tools-domU-debuginfo-4.5.5_24-22.43.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): xen-4.5.5_24-22.43.1 xen-debugsource-4.5.5_24-22.43.1 xen-doc-html-4.5.5_24-22.43.1 xen-kmp-default-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-kmp-default-debuginfo-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-libs-32bit-4.5.5_24-22.43.1 xen-libs-4.5.5_24-22.43.1 xen-libs-debuginfo-32bit-4.5.5_24-22.43.1 xen-libs-debuginfo-4.5.5_24-22.43.1 xen-tools-4.5.5_24-22.43.1 xen-tools-debuginfo-4.5.5_24-22.43.1 xen-tools-domU-4.5.5_24-22.43.1 xen-tools-domU-debuginfo-4.5.5_24-22.43.1 References: https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-17563.html https://www.suse.com/security/cve/CVE-2017-17564.html https://www.suse.com/security/cve/CVE-2017-17565.html https://www.suse.com/security/cve/CVE-2017-17566.html https://www.suse.com/security/cve/CVE-2017-18030.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2018-5683.html https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070158 https://bugzilla.suse.com/1070159 https://bugzilla.suse.com/1070160 https://bugzilla.suse.com/1070163 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1076116 https://bugzilla.suse.com/1076180 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0