January 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:0326-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0326-1 Rating: important References: #1020950 #1024749 #1050469 #1066892 #1069925 #1073654 #1075419 Cross-References: CVE-2016-4692 CVE-2016-4743 CVE-2016-7586 CVE-2016-7587 CVE-2016-7589 CVE-2016-7592 CVE-2016-7598 CVE-2016-7599 CVE-2016-7610 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 CVE-2017-13788 CVE-2017-13798 CVE-2017-13803 CVE-2017-13856 CVE-2017-13866 CVE-2017-13870 CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 CVE-2017-2496 CVE-2017-2510 CVE-2017-2539 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-7006 CVE-2017-7011 CVE-2017-7012 CVE-2017-7018 CVE-2017-7019 CVE-2017-7020 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7038 CVE-2017-7039 CVE-2017-7040 CVE-2017-7041 CVE-2017-7042 CVE-2017-7043 CVE-2017-7046 CVE-2017-7048 CVE-2017-7049 CVE-2017-7052 CVE-2017-7055 CVE-2017-7056 CVE-2017-7059 CVE-2017-7061 CVE-2017-7064 CVE-2017-7081 CVE-2017-7087 CVE-2017-7089 CVE-2017-7090 CVE-2017-7091 CVE-2017-7092 CVE-2017-7093 CVE-2017-7094 CVE-2017-7095 CVE-2017-7096 CVE-2017-7098 CVE-2017-7099 CVE-2017-7100 CVE-2017-7102 CVE-2017-7104 CVE-2017-7107 CVE-2017-7109 CVE-2017-7111 CVE-2017-7117 CVE-2017-7120 CVE-2017-7142 CVE-2017-7156 CVE-2017-7157 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 89 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5: + Disable SharedArrayBuffers from Web API. + Reduce the precision of "high" resolution time to 1ms. + bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4: + Make WebDriver implementation more spec compliant. + Fix a bug when trying to remove cookies before a web process is spawned. + WebKitWebDriver process no longer links to libjavascriptcoregtk. + Fix several memory leaks in GStreamer media backend. + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3: + Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. + Fix handling of null capabilities in WebDriver implementation. + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2: + Fix rendering of arabic text. + Fix a crash in the web process when decoding GIF images. + Fix rendering of wind in Windy.com. + Fix several crashes and rendering issues. Update to version 2.18.1: + Improve performance of GIF animations. + Fix garbled display in GMail. + Fix rendering of several material design icons when using the web font. + Fix flickering when resizing the window in Wayland. + Prevent default kerberos authentication credentials from being used in ephemeral sessions. + Fix a crash when webkit_web_resource_get_data() is cancelled. + Correctly handle touchmove and touchend events in WebKitWebView. + Fix the build with enchant 2.1.1. + Fix the build in HPPA and Alpha. + Fix several crashes and rendering issues. + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142. - Enable gold linker on s390/s390x on SLE15/Tumbleweed. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-8.1 libwebkit2gtk-4_0-37-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-2.18.5-8.1 typelib-1_0-JavaScriptCore-4_0-2.18.5-8.1 typelib-1_0-WebKit2-4_0-2.18.5-8.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.5-8.1 webkit-jsc-4-2.18.5-8.1 webkit-jsc-4-debuginfo-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-8.1 webkit2gtk3-debugsource-2.18.5-8.1 webkit2gtk3-devel-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.5-8.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.5-8.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.18.5-8.1 References: https://www.suse.com/security/cve/CVE-2016-4692.html https://www.suse.com/security/cve/CVE-2016-4743.html https://www.suse.com/security/cve/CVE-2016-7586.html https://www.suse.com/security/cve/CVE-2016-7587.html https://www.suse.com/security/cve/CVE-2016-7589.html https://www.suse.com/security/cve/CVE-2016-7592.html https://www.suse.com/security/cve/CVE-2016-7598.html https://www.suse.com/security/cve/CVE-2016-7599.html https://www.suse.com/security/cve/CVE-2016-7610.html https://www.suse.com/security/cve/CVE-2016-7623.html https://www.suse.com/security/cve/CVE-2016-7632.html https://www.suse.com/security/cve/CVE-2016-7635.html https://www.suse.com/security/cve/CVE-2016-7639.html https://www.suse.com/security/cve/CVE-2016-7641.html https://www.suse.com/security/cve/CVE-2016-7645.html https://www.suse.com/security/cve/CVE-2016-7652.html https://www.suse.com/security/cve/CVE-2016-7654.html https://www.suse.com/security/cve/CVE-2016-7656.html https://www.suse.com/security/cve/CVE-2017-13788.html https://www.suse.com/security/cve/CVE-2017-13798.html https://www.suse.com/security/cve/CVE-2017-13803.html https://www.suse.com/security/cve/CVE-2017-13856.html https://www.suse.com/security/cve/CVE-2017-13866.html https://www.suse.com/security/cve/CVE-2017-13870.html https://www.suse.com/security/cve/CVE-2017-2350.html https://www.suse.com/security/cve/CVE-2017-2354.html https://www.suse.com/security/cve/CVE-2017-2355.html https://www.suse.com/security/cve/CVE-2017-2356.html https://www.suse.com/security/cve/CVE-2017-2362.html https://www.suse.com/security/cve/CVE-2017-2363.html https://www.suse.com/security/cve/CVE-2017-2364.html https://www.suse.com/security/cve/CVE-2017-2365.html https://www.suse.com/security/cve/CVE-2017-2366.html https://www.suse.com/security/cve/CVE-2017-2369.html https://www.suse.com/security/cve/CVE-2017-2371.html https://www.suse.com/security/cve/CVE-2017-2373.html https://www.suse.com/security/cve/CVE-2017-2496.html https://www.suse.com/security/cve/CVE-2017-2510.html https://www.suse.com/security/cve/CVE-2017-2539.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-7006.html https://www.suse.com/security/cve/CVE-2017-7011.html https://www.suse.com/security/cve/CVE-2017-7012.html https://www.suse.com/security/cve/CVE-2017-7018.html https://www.suse.com/security/cve/CVE-2017-7019.html https://www.suse.com/security/cve/CVE-2017-7020.html https://www.suse.com/security/cve/CVE-2017-7030.html https://www.suse.com/security/cve/CVE-2017-7034.html https://www.suse.com/security/cve/CVE-2017-7037.html https://www.suse.com/security/cve/CVE-2017-7038.html https://www.suse.com/security/cve/CVE-2017-7039.html https://www.suse.com/security/cve/CVE-2017-7040.html https://www.suse.com/security/cve/CVE-2017-7041.html https://www.suse.com/security/cve/CVE-2017-7042.html https://www.suse.com/security/cve/CVE-2017-7043.html https://www.suse.com/security/cve/CVE-2017-7046.html https://www.suse.com/security/cve/CVE-2017-7048.html https://www.suse.com/security/cve/CVE-2017-7049.html https://www.suse.com/security/cve/CVE-2017-7052.html https://www.suse.com/security/cve/CVE-2017-7055.html https://www.suse.com/security/cve/CVE-2017-7056.html https://www.suse.com/security/cve/CVE-2017-7059.html https://www.suse.com/security/cve/CVE-2017-7061.html https://www.suse.com/security/cve/CVE-2017-7064.html https://www.suse.com/security/cve/CVE-2017-7081.html https://www.suse.com/security/cve/CVE-2017-7087.html https://www.suse.com/security/cve/CVE-2017-7089.html https://www.suse.com/security/cve/CVE-2017-7090.html https://www.suse.com/security/cve/CVE-2017-7091.html https://www.suse.com/security/cve/CVE-2017-7092.html https://www.suse.com/security/cve/CVE-2017-7093.html https://www.suse.com/security/cve/CVE-2017-7094.html https://www.suse.com/security/cve/CVE-2017-7095.html https://www.suse.com/security/cve/CVE-2017-7096.html https://www.suse.com/security/cve/CVE-2017-7098.html https://www.suse.com/security/cve/CVE-2017-7099.html https://www.suse.com/security/cve/CVE-2017-7100.html https://www.suse.com/security/cve/CVE-2017-7102.html https://www.suse.com/security/cve/CVE-2017-7104.html https://www.suse.com/security/cve/CVE-2017-7107.html https://www.suse.com/security/cve/CVE-2017-7109.html https://www.suse.com/security/cve/CVE-2017-7111.html https://www.suse.com/security/cve/CVE-2017-7117.html https://www.suse.com/security/cve/CVE-2017-7120.html https://www.suse.com/security/cve/CVE-2017-7142.html https://www.suse.com/security/cve/CVE-2017-7156.html https://www.suse.com/security/cve/CVE-2017-7157.html https://bugzilla.suse.com/1020950 https://bugzilla.suse.com/1024749 https://bugzilla.suse.com/1050469 https://bugzilla.suse.com/1066892 https://bugzilla.suse.com/1069925 https://bugzilla.suse.com/1073654 https://bugzilla.suse.com/1075419 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0323-1: important: Security update for bind
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0323-1 Rating: important References: #1040039 #1047184 #1076118 Cross-References: CVE-2017-3145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes several issues. This security issue was fixed: - CVE-2017-3145: Improper sequencing during cleanup could have lead to a use-after-free error that triggered an assertion failure and crash in named (bsc#1076118). These non-security issues were fixed: - Updated named.root file (bsc#1040039) - Update bind.keys for DNSSEC root KSK rollover (bsc#1047184) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-114=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-devel-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-lwresd-9.9.9P1-53.1 bind-lwresd-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - openSUSE Leap 42.3 (x86_64): bind-libs-32bit-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 - openSUSE Leap 42.3 (noarch): bind-doc-9.9.9P1-53.1 References: https://www.suse.com/security/cve/CVE-2017-3145.html https://bugzilla.suse.com/1040039 https://bugzilla.suse.com/1047184 https://bugzilla.suse.com/1076118 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0313-1: important: Security update for chromium
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0313-1 Rating: important References: #1073323 #1077571 #1077722 Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032 CVE-2018-6033 CVE-2018-6034 CVE-2018-6035 CVE-2018-6036 CVE-2018-6037 CVE-2018-6038 CVE-2018-6039 CVE-2018-6040 CVE-2018-6041 CVE-2018-6042 CVE-2018-6043 CVE-2018-6045 CVE-2018-6046 CVE-2018-6047 CVE-2018-6048 CVE-2018-6049 CVE-2018-6050 CVE-2018-6051 CVE-2018-6052 CVE-2018-6053 CVE-2018-6054 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium to 64.0.3282.119 fixes several issues. These security issues were fixed: - CVE-2018-6031: Use after free in PDFium (boo#1077571) - CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571) - CVE-2018-6033: Race when opening downloaded files (boo#1077571) - CVE-2018-6034: Integer overflow in Blink (boo#1077571) - CVE-2018-6035: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571) - CVE-2018-6037: Insufficient user gesture requirements in autofill (boo#1077571) - CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571) - CVE-2018-6039: XSS in DevTools (boo#1077571) - CVE-2018-6040: Content security policy bypass (boo#1077571) - CVE-2018-6041: URL spoof in Navigation (boo#1077571) - CVE-2018-6042: URL spoof in OmniBox (boo#1077571) - CVE-2018-6043: Insufficient escaping with external URL handlers (boo#1077571) - CVE-2018-6045: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6046: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571) - CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571) - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571) - CVE-2018-6049: UI spoof in Permissions (boo#1077571) - CVE-2018-6050: URL spoof in OmniBox (boo#1077571) - CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571) - CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571) - CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571) - CVE-2018-6054: Use after free in WebUI (boo#1077571) Re was updated to version 2018-01-01 (boo#1073323) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-106=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libre2-0-20180101-5.1 libre2-0-debuginfo-20180101-5.1 re2-debugsource-20180101-5.1 re2-devel-20180101-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-64.0.3282.119-46.2 chromium-64.0.3282.119-46.2 References: https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2018-6031.html https://www.suse.com/security/cve/CVE-2018-6032.html https://www.suse.com/security/cve/CVE-2018-6033.html https://www.suse.com/security/cve/CVE-2018-6034.html https://www.suse.com/security/cve/CVE-2018-6035.html https://www.suse.com/security/cve/CVE-2018-6036.html https://www.suse.com/security/cve/CVE-2018-6037.html https://www.suse.com/security/cve/CVE-2018-6038.html https://www.suse.com/security/cve/CVE-2018-6039.html https://www.suse.com/security/cve/CVE-2018-6040.html https://www.suse.com/security/cve/CVE-2018-6041.html https://www.suse.com/security/cve/CVE-2018-6042.html https://www.suse.com/security/cve/CVE-2018-6043.html https://www.suse.com/security/cve/CVE-2018-6045.html https://www.suse.com/security/cve/CVE-2018-6046.html https://www.suse.com/security/cve/CVE-2018-6047.html https://www.suse.com/security/cve/CVE-2018-6048.html https://www.suse.com/security/cve/CVE-2018-6049.html https://www.suse.com/security/cve/CVE-2018-6050.html https://www.suse.com/security/cve/CVE-2018-6051.html https://www.suse.com/security/cve/CVE-2018-6052.html https://www.suse.com/security/cve/CVE-2018-6053.html https://www.suse.com/security/cve/CVE-2018-6054.html https://bugzilla.suse.com/1073323 https://bugzilla.suse.com/1077571 https://bugzilla.suse.com/1077722 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE Leap 42.2 has reached end of SUSE support
by Benjamin Brunner 31 Jan '18

31 Jan '18

Hi all, With the release of release-notes-openSUSE on Jan 26th, 2018 the SUSE sponsored maintenance of openSUSE Leap 42.2 has ended. openSUSE Leap 42.2 is now officially discontinued and out of support by SUSE. The currently maintained stable release is openSUSE Leap 42.3, which will be maintained until Jan 31st 2019. See https://en.opensuse.org/Lifetime Upgrading is easy. See the links below for instructions: https://doc.opensuse.org/documentation/leap/startup/html/book.opensuse.star… https://en.opensuse.org/SDB:System_upgrade https://en.opensuse.org/SDB:Offline_upgrade openSUSE Leap 42.2 was released on November 16, 2016, making it ca. 14 months of security and bugfix support. It was the second hybrid distribution which used sources from SUSE Linux Enterprise and from our community developers to bridge a gap between matured packages and newer packages found in openSUSE Tumbleweed. Some statistics on the released patches (compared to Leap 42.1): Total updates: 1286 (-156) Updates imported from SUSE Linux Enterprise: 648 (+141) Updates provided by community developers: 638 (-297) Security: 569 (-29) Recommended: 677 (-130) Optional: 39 (+3) Feature: 1 (+-0) Fixed CVE-entries: 2239 (-195) Fixed Bugs (overall): 3887 (+152) A huge thanks to our awesome packagers, community, and all involved people, who made the next great release possible! Your maintenance- and security-team -- Benjamin Brunner <bbrunner(a)suse.com>, SUSE Maintenance SUSE LINUX GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0303-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0303-1 Rating: important References: #1040039 #1047184 #1076118 Cross-References: CVE-2017-3145 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes several issues. This security issue was fixed: - CVE-2017-3145: Improper sequencing during cleanup could have lead to a use-after-free error that triggered an assertion failure and crash in named (bsc#1076118). These non-security issues were fixed: - Updated named.root file (bsc#1040039) - Update bind.keys for DNSSEC root KSK rollover (bsc#1047184) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-220=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-220=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-220=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-220=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-220=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-220=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-220=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-220=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-220=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-220=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): bind-doc-9.9.9P1-63.7.1 - SUSE OpenStack Cloud 6 (x86_64): bind-9.9.9P1-63.7.1 bind-chrootenv-9.9.9P1-63.7.1 bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-devel-9.9.9P1-63.7.1 bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-devel-9.9.9P1-63.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-devel-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): bind-9.9.9P1-63.7.1 bind-chrootenv-9.9.9P1-63.7.1 bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-devel-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): bind-doc-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): bind-9.9.9P1-63.7.1 bind-chrootenv-9.9.9P1-63.7.1 bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): bind-doc-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): bind-9.9.9P1-63.7.1 bind-chrootenv-9.9.9P1-63.7.1 bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): bind-doc-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): bind-9.9.9P1-63.7.1 bind-chrootenv-9.9.9P1-63.7.1 bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): bind-doc-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-63.7.1 bind-chrootenv-9.9.9P1-63.7.1 bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-devel-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): bind-doc-9.9.9P1-63.7.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): bind-debuginfo-9.9.9P1-63.7.1 bind-debugsource-9.9.9P1-63.7.1 bind-libs-32bit-9.9.9P1-63.7.1 bind-libs-9.9.9P1-63.7.1 bind-libs-debuginfo-32bit-9.9.9P1-63.7.1 bind-libs-debuginfo-9.9.9P1-63.7.1 bind-utils-9.9.9P1-63.7.1 bind-utils-debuginfo-9.9.9P1-63.7.1 References: https://www.suse.com/security/cve/CVE-2017-3145.html https://bugzilla.suse.com/1040039 https://bugzilla.suse.com/1047184 https://bugzilla.suse.com/1076118 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0301-1: important: Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP2)
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0301-1 Rating: important References: #1073230 Cross-References: CVE-2017-17712 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 4.4.103-92_56 fixes one issue. The following security issue was fixed: - CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2018-216=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_103-92_56-default-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-17712.html https://bugzilla.suse.com/1073230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0298-1: important: Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP2)
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0298-1 Rating: important References: #1073230 Cross-References: CVE-2017-17712 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 4.4.103-92_53 fixes one issue. The following security issue was fixed: - CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2018-217=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_103-92_53-default-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-17712.html https://bugzilla.suse.com/1073230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0297-1: important: Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP2)
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0297-1 Rating: important References: #1069708 #1073230 Cross-References: CVE-2017-16939 CVE-2017-17712 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 4.4.49-92_11 fixes several issues. The following security issues were fixed: - CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230). - CVE-2017-16939: The XFRM dump policy implementation allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2018-219=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_49-92_11-default-10-2.1 References: https://www.suse.com/security/cve/CVE-2017-16939.html https://www.suse.com/security/cve/CVE-2017-17712.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1073230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0296-1: important: Security update for the Linux Kernel (Live Patch 6 for SLE 12 SP2)
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 6 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0296-1 Rating: important References: #1069708 #1073230 Cross-References: CVE-2017-16939 CVE-2017-17712 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 4.4.49-92_14 fixes several issues. The following security issues were fixed: - CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230). - CVE-2017-16939: The XFRM dump policy implementation allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2018-218=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_49-92_14-default-9-2.1 References: https://www.suse.com/security/cve/CVE-2017-16939.html https://www.suse.com/security/cve/CVE-2017-17712.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1073230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0294-1: important: Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP2)
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0294-1 Rating: important References: #1073230 Cross-References: CVE-2017-17712 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 4.4.90-92_50 fixes one issue. The following security issue was fixed: - CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2018-215=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_90-92_50-default-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-17712.html https://bugzilla.suse.com/1073230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0