May 2018 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2018:1345-1: moderate: Security update for libvorbis
by opensuse-security＠opensuse.org 18 May '18

18 May '18

openSUSE Security Update: Security update for libvorbis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1345-1 Rating: moderate References: #1059812 #1091072 Cross-References: CVE-2017-14160 CVE-2018-10393 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libvorbis fixes the following issues: Security issues fixed: - CVE-2018-10393: Fixed stack-based buffer over-read in bark_noise_hybridm (bsc#1091072). - CVE-2017-14160: Fixed out-of-bounds access inside bark_noise_hybridmp function (bsc#1059812). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-472=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvorbis-debugsource-1.3.3-14.1 libvorbis-devel-1.3.3-14.1 libvorbis0-1.3.3-14.1 libvorbis0-debuginfo-1.3.3-14.1 libvorbisenc2-1.3.3-14.1 libvorbisenc2-debuginfo-1.3.3-14.1 libvorbisfile3-1.3.3-14.1 libvorbisfile3-debuginfo-1.3.3-14.1 - openSUSE Leap 42.3 (noarch): libvorbis-doc-1.3.3-14.1 - openSUSE Leap 42.3 (x86_64): libvorbis0-32bit-1.3.3-14.1 libvorbis0-debuginfo-32bit-1.3.3-14.1 libvorbisenc2-32bit-1.3.3-14.1 libvorbisenc2-debuginfo-32bit-1.3.3-14.1 libvorbisfile3-32bit-1.3.3-14.1 libvorbisfile3-debuginfo-32bit-1.3.3-14.1 References: https://www.suse.com/security/cve/CVE-2017-14160.html https://www.suse.com/security/cve/CVE-2018-10393.html https://bugzilla.suse.com/1059812 https://bugzilla.suse.com/1091072 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1344-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 18 May '18

18 May '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1344-1 Rating: moderate References: #1086825 #1092098 Cross-References: CVE-2018-1000301 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for curl fixes several issues: Security issues fixed: - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client (bsc#1092098) Non security issues fixed: - If the DEFAULT_SUSE cipher list is not available use the HIGH cipher alias before failing. (bsc#1086825) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-471=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-36.1 curl-debuginfo-7.37.0-36.1 curl-debugsource-7.37.0-36.1 libcurl-devel-7.37.0-36.1 libcurl4-7.37.0-36.1 libcurl4-debuginfo-7.37.0-36.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-36.1 libcurl4-32bit-7.37.0-36.1 libcurl4-debuginfo-32bit-7.37.0-36.1 References: https://www.suse.com/security/cve/CVE-2018-1000301.html https://bugzilla.suse.com/1086825 https://bugzilla.suse.com/1092098 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1340-1: moderate: Security update for testing the software stack
by opensuse-security＠opensuse.org 18 May '18

18 May '18

openSUSE Security Update: Security update for testing the software stack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1340-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update contains a security update for testing the software stack. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-428=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): update-test-security-5.1-lp150.3.4.2 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1330-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 17 May '18

17 May '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1330-1 Rating: moderate References: #1093151 #1093152 Cross-References: CVE-2017-17688 CVE-2017-17689 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for enigmail to version 2.0.4 fixes multiple issues. Security issues fixed: - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate plaintext out of encrypted emails. enigmail now fails on GnuPG integrity check warnings for old Algorithms (bsc#1093151) - CVE-2017-17689: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails (bsc#1093152) This update also includes new and updated functionality: - The Encryption and Signing buttons now work for both OpenPGP and S/MIME. Enigmail will chose between S/MIME or OpenPGP depending on whether the keys for all recipients are available for the respective standard - Support for the Autocrypt standard, which is now enabled by default - Support for Pretty Easy Privacy (p≡p) - Support for Web Key Directory (WKD) - The message subject can now be encrypted and replaced with a dummy subject, following the Memory Hole standard forprotected Email Headers - keys on keyring are automatically refreshed from keyservers at irregular intervals - Subsequent updates of Enigmail no longer require a restart of Thunderbird - Keys are internally addressed using the fingerprint instead of the key ID Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-470=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): enigmail-2.0.4-12.1 References: https://www.suse.com/security/cve/CVE-2017-17688.html https://www.suse.com/security/cve/CVE-2017-17689.html https://bugzilla.suse.com/1093151 https://bugzilla.suse.com/1093152 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1329-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 17 May '18

17 May '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1329-1 Rating: moderate References: #1093151 #1093152 Cross-References: CVE-2017-17688 CVE-2017-17689 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for enigmail to version 2.0.4 fixes multiple issues. Security issues fixed: - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate plaintext out of encrypted emails. enigmail now fails on GnuPG integrity check warnings for old Algorithms (bsc#1093151) - CVE-2017-17689: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails (bsc#1093152) This update also includes new and updated functionality: - The Encryption and Signing buttons now work for both OpenPGP and S/MIME. Enigmail will chose between S/MIME or OpenPGP depending on whether the keys for all recipients are available for the respective standard - Support for the Autocrypt standard, which is now enabled by default - Support for Pretty Easy Privacy (p≡p) - Support for Web Key Directory (WKD) - The message subject can now be encrypted and replaced with a dummy subject, following the Memory Hole standard forprotected Email Headers - keys on keyring are automatically refreshed from keyservers at irregular intervals - Subsequent updates of Enigmail no longer require a restart of Thunderbird - Keys are internally addressed using the fingerprint instead of the key ID Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-470=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.4-9.1 References: https://www.suse.com/security/cve/CVE-2017-17688.html https://www.suse.com/security/cve/CVE-2017-17689.html https://bugzilla.suse.com/1093151 https://bugzilla.suse.com/1093152 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1317-1: important: Security update for php5
by opensuse-security＠opensuse.org 16 May '18

16 May '18

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1317-1 Rating: important References: #1091355 #1091362 #1091363 #1091367 Cross-References: CVE-2018-10545 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php5 fixes the following issues: Security issues fixed: - CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367). - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362). - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363). - CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-465=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-100.1 apache2-mod_php5-debuginfo-5.5.14-100.1 php5-5.5.14-100.1 php5-bcmath-5.5.14-100.1 php5-bcmath-debuginfo-5.5.14-100.1 php5-bz2-5.5.14-100.1 php5-bz2-debuginfo-5.5.14-100.1 php5-calendar-5.5.14-100.1 php5-calendar-debuginfo-5.5.14-100.1 php5-ctype-5.5.14-100.1 php5-ctype-debuginfo-5.5.14-100.1 php5-curl-5.5.14-100.1 php5-curl-debuginfo-5.5.14-100.1 php5-dba-5.5.14-100.1 php5-dba-debuginfo-5.5.14-100.1 php5-debuginfo-5.5.14-100.1 php5-debugsource-5.5.14-100.1 php5-devel-5.5.14-100.1 php5-dom-5.5.14-100.1 php5-dom-debuginfo-5.5.14-100.1 php5-enchant-5.5.14-100.1 php5-enchant-debuginfo-5.5.14-100.1 php5-exif-5.5.14-100.1 php5-exif-debuginfo-5.5.14-100.1 php5-fastcgi-5.5.14-100.1 php5-fastcgi-debuginfo-5.5.14-100.1 php5-fileinfo-5.5.14-100.1 php5-fileinfo-debuginfo-5.5.14-100.1 php5-firebird-5.5.14-100.1 php5-firebird-debuginfo-5.5.14-100.1 php5-fpm-5.5.14-100.1 php5-fpm-debuginfo-5.5.14-100.1 php5-ftp-5.5.14-100.1 php5-ftp-debuginfo-5.5.14-100.1 php5-gd-5.5.14-100.1 php5-gd-debuginfo-5.5.14-100.1 php5-gettext-5.5.14-100.1 php5-gettext-debuginfo-5.5.14-100.1 php5-gmp-5.5.14-100.1 php5-gmp-debuginfo-5.5.14-100.1 php5-iconv-5.5.14-100.1 php5-iconv-debuginfo-5.5.14-100.1 php5-imap-5.5.14-100.1 php5-imap-debuginfo-5.5.14-100.1 php5-intl-5.5.14-100.1 php5-intl-debuginfo-5.5.14-100.1 php5-json-5.5.14-100.1 php5-json-debuginfo-5.5.14-100.1 php5-ldap-5.5.14-100.1 php5-ldap-debuginfo-5.5.14-100.1 php5-mbstring-5.5.14-100.1 php5-mbstring-debuginfo-5.5.14-100.1 php5-mcrypt-5.5.14-100.1 php5-mcrypt-debuginfo-5.5.14-100.1 php5-mssql-5.5.14-100.1 php5-mssql-debuginfo-5.5.14-100.1 php5-mysql-5.5.14-100.1 php5-mysql-debuginfo-5.5.14-100.1 php5-odbc-5.5.14-100.1 php5-odbc-debuginfo-5.5.14-100.1 php5-opcache-5.5.14-100.1 php5-opcache-debuginfo-5.5.14-100.1 php5-openssl-5.5.14-100.1 php5-openssl-debuginfo-5.5.14-100.1 php5-pcntl-5.5.14-100.1 php5-pcntl-debuginfo-5.5.14-100.1 php5-pdo-5.5.14-100.1 php5-pdo-debuginfo-5.5.14-100.1 php5-pgsql-5.5.14-100.1 php5-pgsql-debuginfo-5.5.14-100.1 php5-phar-5.5.14-100.1 php5-phar-debuginfo-5.5.14-100.1 php5-posix-5.5.14-100.1 php5-posix-debuginfo-5.5.14-100.1 php5-pspell-5.5.14-100.1 php5-pspell-debuginfo-5.5.14-100.1 php5-readline-5.5.14-100.1 php5-readline-debuginfo-5.5.14-100.1 php5-shmop-5.5.14-100.1 php5-shmop-debuginfo-5.5.14-100.1 php5-snmp-5.5.14-100.1 php5-snmp-debuginfo-5.5.14-100.1 php5-soap-5.5.14-100.1 php5-soap-debuginfo-5.5.14-100.1 php5-sockets-5.5.14-100.1 php5-sockets-debuginfo-5.5.14-100.1 php5-sqlite-5.5.14-100.1 php5-sqlite-debuginfo-5.5.14-100.1 php5-suhosin-5.5.14-100.1 php5-suhosin-debuginfo-5.5.14-100.1 php5-sysvmsg-5.5.14-100.1 php5-sysvmsg-debuginfo-5.5.14-100.1 php5-sysvsem-5.5.14-100.1 php5-sysvsem-debuginfo-5.5.14-100.1 php5-sysvshm-5.5.14-100.1 php5-sysvshm-debuginfo-5.5.14-100.1 php5-tidy-5.5.14-100.1 php5-tidy-debuginfo-5.5.14-100.1 php5-tokenizer-5.5.14-100.1 php5-tokenizer-debuginfo-5.5.14-100.1 php5-wddx-5.5.14-100.1 php5-wddx-debuginfo-5.5.14-100.1 php5-xmlreader-5.5.14-100.1 php5-xmlreader-debuginfo-5.5.14-100.1 php5-xmlrpc-5.5.14-100.1 php5-xmlrpc-debuginfo-5.5.14-100.1 php5-xmlwriter-5.5.14-100.1 php5-xmlwriter-debuginfo-5.5.14-100.1 php5-xsl-5.5.14-100.1 php5-xsl-debuginfo-5.5.14-100.1 php5-zip-5.5.14-100.1 php5-zip-debuginfo-5.5.14-100.1 php5-zlib-5.5.14-100.1 php5-zlib-debuginfo-5.5.14-100.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-100.1 References: https://www.suse.com/security/cve/CVE-2018-10545.html https://www.suse.com/security/cve/CVE-2018-10546.html https://www.suse.com/security/cve/CVE-2018-10547.html https://www.suse.com/security/cve/CVE-2018-10548.html https://bugzilla.suse.com/1091355 https://bugzilla.suse.com/1091362 https://bugzilla.suse.com/1091363 https://bugzilla.suse.com/1091367 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1311-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 16 May '18

16 May '18

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1311-1 Rating: moderate References: #1089705 #1089706 #1090737 #1091772 #915996 Cross-References: CVE-2018-10119 CVE-2018-10120 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues: Security issues fixed: - CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record. (bsc#1089706) - CVE-2018-10119: sot/source/sdstor/stgstrms.cxx used an incorrect integer data type in the StgSmallStrm class, which allowed remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format. (bsc#1089705) Other issues fixed: - DOCX import: missing table background color - Bring back offline help per popular demand as lto saves space we could use with it bsc#915996 This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-467=1 Package List: - openSUSE Leap 42.3 (x86_64): libreoffice-6.0.4.2-21.1 libreoffice-base-6.0.4.2-21.1 libreoffice-base-debuginfo-6.0.4.2-21.1 libreoffice-base-drivers-mysql-6.0.4.2-21.1 libreoffice-base-drivers-mysql-debuginfo-6.0.4.2-21.1 libreoffice-base-drivers-postgresql-6.0.4.2-21.1 libreoffice-base-drivers-postgresql-debuginfo-6.0.4.2-21.1 libreoffice-calc-6.0.4.2-21.1 libreoffice-calc-debuginfo-6.0.4.2-21.1 libreoffice-calc-extensions-6.0.4.2-21.1 libreoffice-debuginfo-6.0.4.2-21.1 libreoffice-debugsource-6.0.4.2-21.1 libreoffice-draw-6.0.4.2-21.1 libreoffice-draw-debuginfo-6.0.4.2-21.1 libreoffice-filters-optional-6.0.4.2-21.1 libreoffice-gnome-6.0.4.2-21.1 libreoffice-gnome-debuginfo-6.0.4.2-21.1 libreoffice-gtk2-6.0.4.2-21.1 libreoffice-gtk2-debuginfo-6.0.4.2-21.1 libreoffice-gtk3-6.0.4.2-21.1 libreoffice-gtk3-debuginfo-6.0.4.2-21.1 libreoffice-impress-6.0.4.2-21.1 libreoffice-impress-debuginfo-6.0.4.2-21.1 libreoffice-kde4-6.0.4.2-21.1 libreoffice-kde4-debuginfo-6.0.4.2-21.1 libreoffice-mailmerge-6.0.4.2-21.1 libreoffice-math-6.0.4.2-21.1 libreoffice-math-debuginfo-6.0.4.2-21.1 libreoffice-officebean-6.0.4.2-21.1 libreoffice-officebean-debuginfo-6.0.4.2-21.1 libreoffice-pyuno-6.0.4.2-21.1 libreoffice-pyuno-debuginfo-6.0.4.2-21.1 libreoffice-sdk-6.0.4.2-21.1 libreoffice-sdk-debuginfo-6.0.4.2-21.1 libreoffice-sdk-doc-6.0.4.2-21.1 libreoffice-writer-6.0.4.2-21.1 libreoffice-writer-debuginfo-6.0.4.2-21.1 libreoffice-writer-extensions-6.0.4.2-21.1 libreofficekit-6.0.4.2-21.1 libreofficekit-devel-6.0.4.2-21.1 - openSUSE Leap 42.3 (noarch): libreoffice-branding-upstream-6.0.4.2-21.1 libreoffice-gdb-pretty-printers-6.0.4.2-21.1 libreoffice-glade-6.0.4.2-21.1 libreoffice-icon-themes-6.0.4.2-21.1 libreoffice-l10n-af-6.0.4.2-21.1 libreoffice-l10n-ar-6.0.4.2-21.1 libreoffice-l10n-as-6.0.4.2-21.1 libreoffice-l10n-bg-6.0.4.2-21.1 libreoffice-l10n-bn-6.0.4.2-21.1 libreoffice-l10n-br-6.0.4.2-21.1 libreoffice-l10n-ca-6.0.4.2-21.1 libreoffice-l10n-cs-6.0.4.2-21.1 libreoffice-l10n-cy-6.0.4.2-21.1 libreoffice-l10n-da-6.0.4.2-21.1 libreoffice-l10n-de-6.0.4.2-21.1 libreoffice-l10n-dz-6.0.4.2-21.1 libreoffice-l10n-el-6.0.4.2-21.1 libreoffice-l10n-en-6.0.4.2-21.1 libreoffice-l10n-eo-6.0.4.2-21.1 libreoffice-l10n-es-6.0.4.2-21.1 libreoffice-l10n-et-6.0.4.2-21.1 libreoffice-l10n-eu-6.0.4.2-21.1 libreoffice-l10n-fa-6.0.4.2-21.1 libreoffice-l10n-fi-6.0.4.2-21.1 libreoffice-l10n-fr-6.0.4.2-21.1 libreoffice-l10n-ga-6.0.4.2-21.1 libreoffice-l10n-gl-6.0.4.2-21.1 libreoffice-l10n-gu-6.0.4.2-21.1 libreoffice-l10n-he-6.0.4.2-21.1 libreoffice-l10n-hi-6.0.4.2-21.1 libreoffice-l10n-hr-6.0.4.2-21.1 libreoffice-l10n-hu-6.0.4.2-21.1 libreoffice-l10n-it-6.0.4.2-21.1 libreoffice-l10n-ja-6.0.4.2-21.1 libreoffice-l10n-kk-6.0.4.2-21.1 libreoffice-l10n-kn-6.0.4.2-21.1 libreoffice-l10n-ko-6.0.4.2-21.1 libreoffice-l10n-lt-6.0.4.2-21.1 libreoffice-l10n-lv-6.0.4.2-21.1 libreoffice-l10n-mai-6.0.4.2-21.1 libreoffice-l10n-ml-6.0.4.2-21.1 libreoffice-l10n-mr-6.0.4.2-21.1 libreoffice-l10n-nb-6.0.4.2-21.1 libreoffice-l10n-nl-6.0.4.2-21.1 libreoffice-l10n-nn-6.0.4.2-21.1 libreoffice-l10n-nr-6.0.4.2-21.1 libreoffice-l10n-nso-6.0.4.2-21.1 libreoffice-l10n-or-6.0.4.2-21.1 libreoffice-l10n-pa-6.0.4.2-21.1 libreoffice-l10n-pl-6.0.4.2-21.1 libreoffice-l10n-pt_BR-6.0.4.2-21.1 libreoffice-l10n-pt_PT-6.0.4.2-21.1 libreoffice-l10n-ro-6.0.4.2-21.1 libreoffice-l10n-ru-6.0.4.2-21.1 libreoffice-l10n-si-6.0.4.2-21.1 libreoffice-l10n-sk-6.0.4.2-21.1 libreoffice-l10n-sl-6.0.4.2-21.1 libreoffice-l10n-sr-6.0.4.2-21.1 libreoffice-l10n-ss-6.0.4.2-21.1 libreoffice-l10n-st-6.0.4.2-21.1 libreoffice-l10n-sv-6.0.4.2-21.1 libreoffice-l10n-ta-6.0.4.2-21.1 libreoffice-l10n-te-6.0.4.2-21.1 libreoffice-l10n-th-6.0.4.2-21.1 libreoffice-l10n-tn-6.0.4.2-21.1 libreoffice-l10n-tr-6.0.4.2-21.1 libreoffice-l10n-ts-6.0.4.2-21.1 libreoffice-l10n-uk-6.0.4.2-21.1 libreoffice-l10n-ve-6.0.4.2-21.1 libreoffice-l10n-xh-6.0.4.2-21.1 libreoffice-l10n-zh_CN-6.0.4.2-21.1 libreoffice-l10n-zh_TW-6.0.4.2-21.1 libreoffice-l10n-zu-6.0.4.2-21.1 References: https://www.suse.com/security/cve/CVE-2018-10119.html https://www.suse.com/security/cve/CVE-2018-10120.html https://bugzilla.suse.com/1089705 https://bugzilla.suse.com/1089706 https://bugzilla.suse.com/1090737 https://bugzilla.suse.com/1091772 https://bugzilla.suse.com/915996 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1310-1: moderate: Security update for librsvg
by opensuse-security＠opensuse.org 16 May '18

16 May '18

openSUSE Security Update: Security update for librsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1310-1 Rating: moderate References: #1083232 Cross-References: CVE-2018-1000041 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librsvg fixes the following issues: - CVE-2018-1000041: Input validation issue could lead to credentials leak. (bsc#1083232) Update to version 2.40.20: + Except for emergencies, this will be the LAST RELEASE of the librsvg-2.40.x series. We are moving to 2.41, which is vastly improved over the 2.40 series. The API/ABI there remain unchaged, so we strongly encourage you to upgrade your sources and binaries to librsvg-2.41.x. + bgo#761175 - Allow masks and clips to reuse a node being drawn. + Don't access the file system when deciding whether to load a remote file with a UNC path for a paint server (i.e. don't try to load it at all). + Vistual Studio: fixed and integrated introspection builds, so introspection data is built directly from the Visual Studio project (Chun-wei Fan). + Visual Studio: We now use HIGHENTROPYVA linker option on x64 builds, to enhance the security of built binaries (Chun-wei Fan). + Fix generation of Vala bindings when compiling in read-only source directories (Emmanuele Bassi). Update to version 2.40.19: + bgo#621088: Using text objects as clipping paths is now supported. + bgo#587721: Fix rendering of text elements with transformations (Massimo). + bgo#777833 - Fix memory leaks when an RsvgHandle is disposed before being closed (Philip Withnall). + bgo#782098 - Don't pass deprecated options to gtk-doc (Ting-Wei Lan). + bgo#786372 - Fix the default for the "type" attribute of the <style> element. + bgo#785276 - Don't crash on single-byte files. + bgo#634514: Don't render unknown elements and their sub-elements. + bgo#777155 - Ignore patterns that have close-to-zero dimensions. + bgo#634324 - Fix Gaussian blurs with negative scaling. + Fix the <switch> element; it wasn't working at all. + Fix loading when rsvg_handle_write() is called one byte at a time. + bgo#787895 - Fix incorrect usage of libxml2. Thanks to Nick Wellnhofer for advice on this. + Backported the test suite machinery from the master branch (Chun-wei Fan, Federico Mena). + We now require Pango 1.38.0 or later (released in 2015). + We now require libxml2 2.9.0 or later (released in 2012). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-466=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.40.20-15.1 gdk-pixbuf-loader-rsvg-debuginfo-2.40.20-15.1 librsvg-2-2-2.40.20-15.1 librsvg-2-2-debuginfo-2.40.20-15.1 librsvg-debugsource-2.40.20-15.1 librsvg-devel-2.40.20-15.1 rsvg-view-2.40.20-15.1 rsvg-view-debuginfo-2.40.20-15.1 typelib-1_0-Rsvg-2_0-2.40.20-15.1 - openSUSE Leap 42.3 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.40.20-15.1 gdk-pixbuf-loader-rsvg-debuginfo-32bit-2.40.20-15.1 librsvg-2-2-32bit-2.40.20-15.1 librsvg-2-2-debuginfo-32bit-2.40.20-15.1 - openSUSE Leap 42.3 (noarch): rsvg-thumbnailer-2.40.20-15.1 References: https://www.suse.com/security/cve/CVE-2018-1000041.html https://bugzilla.suse.com/1083232 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Change in announcements posted on opensuse-security-announce
by Marcus Meissner 14 May '18

14 May '18

Hi folks, Up to now this list has also received SUSE Linux Enterprise announcements, largely due to historic reasons. As openSUSE and SUSE Linux Enterprise are different and the number of SUSE Linux Enterprise announcements is quite high at times, we will no longer be posting Enterprise announcements here. The SUSE Linux Enterprise security update notifications emails can be received via another mailinglist, sle-security-updates, which mailman interface can be found on: http://lists.suse.com/mailman/listinfo/sle-security-updates I also enabled posting of all openSUSE security announcements to this list, not just important and critical issues to make it more consistent. Also check out our other security resources, human or machine readable, both for openSUSE and SUSE Linux Enterprise at https://www.suse.com/security/ Ciao, Marcus (for SUSE Security) -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1275-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 12 May '18

12 May '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1275-1 Rating: important References: #1092272 #1092923 Cross-References: CVE-2018-6120 CVE-2018-6121 CVE-2018-6122 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for Chromium to version 66.0.3359.170 fixes the following issues: Security issues fixed (boo#1092923): - CVE-2018-6121: Privilege Escalation in extensions - CVE-2018-6122: Type confusion in V8 - CVE-2018-6120: Heap buffer overflow in PDFium - Various fixes from internal audits, fuzzing and other initiatives The following bugs are fixed: - boo#1092272: Improved support for subpixel rending Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-456=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-66.0.3359.170-158.1 chromedriver-debuginfo-66.0.3359.170-158.1 chromium-66.0.3359.170-158.1 chromium-debuginfo-66.0.3359.170-158.1 chromium-debugsource-66.0.3359.170-158.1 References: https://www.suse.com/security/cve/CVE-2018-6120.html https://www.suse.com/security/cve/CVE-2018-6121.html https://www.suse.com/security/cve/CVE-2018-6122.html https://bugzilla.suse.com/1092272 https://bugzilla.suse.com/1092923 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0