March 2018 - openSUSE Security Announce

[security-announce] SUSE-SU-2018:0708-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

SUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0708-1 Rating: important References: #1085207 Cross-References: CVE-2017-5715 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-479=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-479=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-479=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-479=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-479=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-479=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-479=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-479=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): ucode-intel-20180312-13.17.1 ucode-intel-debuginfo-20180312-13.17.1 ucode-intel-debugsource-20180312-13.17.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1085207 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0705-1: important: Security update for microcode_ctl
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

SUSE Security Update: Security update for microcode_ctl ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0705-1 Rating: important References: #1085207 Cross-References: CVE-2017-5715 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-microcode_ctl-13514=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-microcode_ctl-13514=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-microcode_ctl-13514=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): microcode_ctl-1.17-102.83.15.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): microcode_ctl-1.17-102.83.15.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): microcode_ctl-1.17-102.83.15.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1085207 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0704-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0704-1 Rating: important References: #1084296 Cross-References: CVE-2017-11215 CVE-2017-11225 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073 CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077 CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081 CVE-2018-6082 CVE-2018-6083 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for Chromium to version 65.0.3325.162 fixes the following issues: - CVE-2017-11215: Use after free in Flash - CVE-2017-11225: Use after free in Flash - CVE-2018-6060: Use after free in Blink - CVE-2018-6061: Race condition in V8 - CVE-2018-6062: Heap buffer overflow in Skia - CVE-2018-6057: Incorrect permissions on shared memory - CVE-2018-6063: Incorrect permissions on shared memory - CVE-2018-6064: Type confusion in V8 - CVE-2018-6065: Integer overflow in V8 - CVE-2018-6066: Same Origin Bypass via canvas - CVE-2018-6067: Buffer overflow in Skia - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab - CVE-2018-6069: Stack buffer overflow in Skia - CVE-2018-6070: CSP bypass through extensions - CVE-2018-6071: Heap bufffer overflow in Skia - CVE-2018-6072: Integer overflow in PDFium - CVE-2018-6073: Heap bufffer overflow in WebGL - CVE-2018-6074: Mark-of-the-Web bypass - CVE-2018-6075: Overly permissive cross origin downloads - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink - CVE-2018-6077: Timing attack using SVG filters - CVE-2018-6078: URL Spoof in OmniBox - CVE-2018-6079: Information disclosure via texture data in WebGL - CVE-2018-6080: Information disclosure in IPC call - CVE-2018-6081: XSS in interstitials - CVE-2018-6082: Circumvention of port blocking - CVE-2018-6083: Incorrect processing of AppManifests Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-65.0.3325.162-146.1 chromedriver-debuginfo-65.0.3325.162-146.1 chromium-65.0.3325.162-146.1 chromium-debuginfo-65.0.3325.162-146.1 chromium-debugsource-65.0.3325.162-146.1 References: https://www.suse.com/security/cve/CVE-2017-11215.html https://www.suse.com/security/cve/CVE-2017-11225.html https://www.suse.com/security/cve/CVE-2018-6057.html https://www.suse.com/security/cve/CVE-2018-6060.html https://www.suse.com/security/cve/CVE-2018-6061.html https://www.suse.com/security/cve/CVE-2018-6062.html https://www.suse.com/security/cve/CVE-2018-6063.html https://www.suse.com/security/cve/CVE-2018-6064.html https://www.suse.com/security/cve/CVE-2018-6065.html https://www.suse.com/security/cve/CVE-2018-6066.html https://www.suse.com/security/cve/CVE-2018-6067.html https://www.suse.com/security/cve/CVE-2018-6068.html https://www.suse.com/security/cve/CVE-2018-6069.html https://www.suse.com/security/cve/CVE-2018-6070.html https://www.suse.com/security/cve/CVE-2018-6071.html https://www.suse.com/security/cve/CVE-2018-6072.html https://www.suse.com/security/cve/CVE-2018-6073.html https://www.suse.com/security/cve/CVE-2018-6074.html https://www.suse.com/security/cve/CVE-2018-6075.html https://www.suse.com/security/cve/CVE-2018-6076.html https://www.suse.com/security/cve/CVE-2018-6077.html https://www.suse.com/security/cve/CVE-2018-6078.html https://www.suse.com/security/cve/CVE-2018-6079.html https://www.suse.com/security/cve/CVE-2018-6080.html https://www.suse.com/security/cve/CVE-2018-6081.html https://www.suse.com/security/cve/CVE-2018-6082.html https://www.suse.com/security/cve/CVE-2018-6083.html https://bugzilla.suse.com/1084296 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0698-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0698-1 Rating: important References: #1064101 #1064115 #1072665 #1078431 Cross-References: CVE-2017-10268 CVE-2017-10378 CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for mariadb to 10.0.34 fixes several issues. These security issues were fixed: - CVE-2017-10378: Vulnerability in subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) (bsc#1064115). - CVE-2017-10268: Vulnerability in subcomponent: Server: Replication. Difficult to exploit vulnerability allowed high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data (bsc#1064101). - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. These non-security issues were fixed: - Relax the required version of mariadb-errormessages to fix the update to MariaDB 10.2. (bsc#1072665) - CHECK TABLE no longer returns an error when run on a CONNECT table - 'Undo log record is too big.' error occurring in very narrow range of string lengths - Race condition between INFORMATION_SCHEMA.INNODB_SYS_TABLESTATS and ALTER/DROP/TRUNCATE TABLE - Wrong result after altering a partitioned table fixed bugs in InnoDB FULLTEXT INDEX - InnoDB FTS duplicate key error * MDEV-13051: InnoDB crash after failed ADD INDEX and table_definition_cache eviction - fts_create_doc_id() unnecessarily allocates 8 bytes for every inserted row - IMPORT TABLESPACE may corrupt ROW_FORMAT=REDUNDANT tables For additional changes please see https://kb.askmonty.org/en/mariadb-10033-changelog and https://kb.askmonty.org/en/mariadb-10034-changelog . Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-477=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-20.43.1 libmysqlclient18-10.0.34-20.43.1 libmysqlclient18-debuginfo-10.0.34-20.43.1 libmysqlclient_r18-10.0.34-20.43.1 libmysqld-devel-10.0.34-20.43.1 libmysqld18-10.0.34-20.43.1 libmysqld18-debuginfo-10.0.34-20.43.1 mariadb-10.0.34-20.43.1 mariadb-client-10.0.34-20.43.1 mariadb-client-debuginfo-10.0.34-20.43.1 mariadb-debuginfo-10.0.34-20.43.1 mariadb-debugsource-10.0.34-20.43.1 mariadb-errormessages-10.0.34-20.43.1 mariadb-tools-10.0.34-20.43.1 mariadb-tools-debuginfo-10.0.34-20.43.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): libmysqlclient18-32bit-10.0.34-20.43.1 libmysqlclient18-debuginfo-32bit-10.0.34-20.43.1 References: https://www.suse.com/security/cve/CVE-2017-10268.html https://www.suse.com/security/cve/CVE-2017-10378.html https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1064101 https://bugzilla.suse.com/1064115 https://bugzilla.suse.com/1072665 https://bugzilla.suse.com/1078431 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0697-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0697-1 Rating: important References: #1078431 Cross-References: CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: MariaDB was updated to 10.0.34 (bsc#1078431) The following security vulnerabilities are fixed: - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The MariaDB external release notes and changelog for this release: * https://kb.askmonty.org/en/mariadb-10034-release-notes * https://kb.askmonty.org/en/mariadb-10034-changelog Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-478=1 - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2018-478=1 - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2018-478=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-478=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-478=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-478=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-478=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-478=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-478=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-478=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-478=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-478=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): libmysqlclient-devel-10.0.34-29.16.1 libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqld-devel-10.0.34-29.16.1 libmysqld18-10.0.34-29.16.1 libmysqld18-debuginfo-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 mariadb-tools-10.0.34-29.16.1 mariadb-tools-debuginfo-10.0.34-29.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x x86_64): libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libmysqlclient18-10.0.34-29.16.1 libmysqlclient18-32bit-10.0.34-29.16.1 libmysqlclient18-debuginfo-10.0.34-29.16.1 libmysqlclient18-debuginfo-32bit-10.0.34-29.16.1 libmysqlclient_r18-10.0.34-29.16.1 libmysqlclient_r18-32bit-10.0.34-29.16.1 mariadb-10.0.34-29.16.1 mariadb-client-10.0.34-29.16.1 mariadb-client-debuginfo-10.0.34-29.16.1 mariadb-debuginfo-10.0.34-29.16.1 mariadb-debugsource-10.0.34-29.16.1 mariadb-errormessages-10.0.34-29.16.1 References: https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1078431 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0694-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0694-1 Rating: important References: #1057460 #1076390 #1082810 #1085018 #929900 #955131 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_1-ibm fixes the following issues: The version was updated to 7.1.4.20 [bsc#1082810] * Security fixes: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl -- Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl -- SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - IJ02284 JIT Compiler: Division by zero in JIT compiler * SUSE fixes: - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) - Fixed symlinks to policy files on update [bsc#1085018] - Fixed jpackage-java-1_7_1-ibm-webstart.desktop file to allow Java jnlp files run from Firefox. [bsc#1057460, bsc#1076390] - Fix javaws segfaults when java expiration timer has elapsed. [bsc#929900] - Provide IBM Java updates for IBMs PMR 55931,671,760 and for SUSEs SR 110991601735. [bsc#966304] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-475=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-475=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-475=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-475=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-38.12.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-38.12.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-38.12.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/1085018 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/955131 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0684-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0684-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-256=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.171-48.3 java-1_7_0-openjdk-accessibility-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-devel-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-headless-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-debugsource-1.7.0.171-48.3 java-1_7_0-openjdk-demo-1.7.0.171-48.3 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-devel-1.7.0.171-48.3 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-headless-1.7.0.171-48.3 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-src-1.7.0.171-48.3 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.171-48.3 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0681-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0681-1 Rating: important References: #1076907 #1085130 Cross-References: CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5130 CVE-2018-5131 CVE-2018-5144 CVE-2018-5145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for Mozilla Firefox to version 52.7.0esr fixes multiple issues. Security issues fixed (bsc#1085130, MFSA 2018-07): - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption - CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources - CVE-2018-5144: Integer overflow during Unicode conversion - CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 - CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7 The following bug fixes are included: - bsc#1076907: provide mimehandler(text/html) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-255=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.7-78.1 MozillaFirefox-branding-upstream-52.7-78.1 MozillaFirefox-buildsymbols-52.7-78.1 MozillaFirefox-debuginfo-52.7-78.1 MozillaFirefox-debugsource-52.7-78.1 MozillaFirefox-devel-52.7-78.1 MozillaFirefox-translations-common-52.7-78.1 MozillaFirefox-translations-other-52.7-78.1 References: https://www.suse.com/security/cve/CVE-2018-5125.html https://www.suse.com/security/cve/CVE-2018-5127.html https://www.suse.com/security/cve/CVE-2018-5129.html https://www.suse.com/security/cve/CVE-2018-5130.html https://www.suse.com/security/cve/CVE-2018-5131.html https://www.suse.com/security/cve/CVE-2018-5144.html https://www.suse.com/security/cve/CVE-2018-5145.html https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1085130 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0679-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0679-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Security issues fix in jdk8u161 (icedtea 3.7.0)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2582: Better interface invocations - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming deserialization cases This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-254=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.161-21.1 java-1_8_0-openjdk-accessibility-1.8.0.161-21.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-debugsource-1.8.0.161-21.1 java-1_8_0-openjdk-demo-1.8.0.161-21.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-devel-1.8.0.161-21.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-headless-1.8.0.161-21.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-src-1.8.0.161-21.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.161-21.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0678-1: important: Security update for xen
by opensuse-security＠opensuse.org 14 Mar '18

14 Mar '18

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0678-1 Rating: important References: #1024307 #1030144 #1061081 #1068032 #1070158 #1070159 #1070160 #1070163 #1074562 #1076116 #1076180 #1080635 #1080662 Cross-References: CVE-2017-11334 CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-5898 CVE-2018-5683 CVE-2018-7540 CVE-2018-7541 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307) - Unprivileged domains could have issued well-timed writes to xenstore which conflict with transactions to stall progress of the control domain or driver domain, possibly leading to DoS (bsc#1030144, XSA-206). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13511=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13511=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13511=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.14-45.19.1 xen-libs-4.2.5_21-45.19.1 xen-tools-domU-4.2.5_21-45.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-45.19.1 xen-doc-html-4.2.5_21-45.19.1 xen-doc-pdf-4.2.5_21-45.19.1 xen-libs-32bit-4.2.5_21-45.19.1 xen-tools-4.2.5_21-45.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.14-45.19.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.14-45.19.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.14-45.19.1 xen-libs-4.2.5_21-45.19.1 xen-tools-domU-4.2.5_21-45.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-45.19.1 xen-debugsource-4.2.5_21-45.19.1 References: https://www.suse.com/security/cve/CVE-2017-11334.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-17563.html https://www.suse.com/security/cve/CVE-2017-17564.html https://www.suse.com/security/cve/CVE-2017-17565.html https://www.suse.com/security/cve/CVE-2017-17566.html https://www.suse.com/security/cve/CVE-2017-18030.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-5898.html https://www.suse.com/security/cve/CVE-2018-5683.html https://www.suse.com/security/cve/CVE-2018-7540.html https://www.suse.com/security/cve/CVE-2018-7541.html https://bugzilla.suse.com/1024307 https://bugzilla.suse.com/1030144 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070158 https://bugzilla.suse.com/1070159 https://bugzilla.suse.com/1070160 https://bugzilla.suse.com/1070163 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1076116 https://bugzilla.suse.com/1076180 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0