openSUSE Security Update: Security update for rubygem-loofah
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3951-1
Rating: moderate
References: #1113969
Cross-References: CVE-2018-16468
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for rubygem-loofah fixes the following issues:
Security issue fixed:
- CVE-2018-16468: Fixed XXS by removing the svg animate attribute `from`
from the allowlist (bsc#1113969).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1478=1
Package List:
- openSUSE Leap 15.0 (x86_64):
ruby2.5-rubygem-loofah-2.2.2-lp150.3.3.1
ruby2.5-rubygem-loofah-doc-2.2.2-lp150.3.3.1
ruby2.5-rubygem-loofah-testsuite-2.2.2-lp150.3.3.1
References:
https://www.suse.com/security/cve/CVE-2018-16468.htmlhttps://bugzilla.suse.com/1113969
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for tiff
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3948-1
Rating: moderate
References: #1099257 #1113094 #1113672
Cross-References: CVE-2018-12900 CVE-2018-18557 CVE-2018-18661
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for tiff fixes the following issues:
Security issues fixed:
- CVE-2018-12900: Fixed heap-based buffer overflow in the
cpSeparateBufToContigBuf (bsc#1099257).
- CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode
in the file tif_lzw.c (bsc#1113672).
- CVE-2018-18557: Fixed JBIG decode can lead to out-of-bounds write
(bsc#1113094).
Non-security issues fixed:
- asan_build: build ASAN included
- debug_build: build more suitable for debugging
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1480=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
libtiff-devel-4.0.9-lp150.4.9.1
libtiff5-4.0.9-lp150.4.9.1
libtiff5-debuginfo-4.0.9-lp150.4.9.1
tiff-4.0.9-lp150.4.9.1
tiff-debuginfo-4.0.9-lp150.4.9.1
tiff-debugsource-4.0.9-lp150.4.9.1
- openSUSE Leap 15.0 (x86_64):
libtiff-devel-32bit-4.0.9-lp150.4.9.1
libtiff5-32bit-4.0.9-lp150.4.9.1
libtiff5-32bit-debuginfo-4.0.9-lp150.4.9.1
References:
https://www.suse.com/security/cve/CVE-2018-12900.htmlhttps://www.suse.com/security/cve/CVE-2018-18557.htmlhttps://www.suse.com/security/cve/CVE-2018-18661.htmlhttps://bugzilla.suse.com/1099257https://bugzilla.suse.com/1113094https://bugzilla.suse.com/1113672
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for tiff
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3947-1
Rating: moderate
References: #1099257 #1113094 #1113672
Cross-References: CVE-2018-12900 CVE-2018-18557 CVE-2018-18661
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for tiff fixes the following issues:
Security issues fixed:
- CVE-2018-12900: Fixed heap-based buffer overflow in the
cpSeparateBufToContigBuf (bsc#1099257).
- CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode
in the file tif_lzw.c (bsc#1113672).
- CVE-2018-18557: Fixed JBIG decode can lead to out-of-bounds write
(bsc#1113094).
Non-security issues fixed:
- asan_build: build ASAN included
- debug_build: build more suitable for debugging
This update was imported from the SUSE:SLE-12:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1479=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
libtiff-devel-4.0.9-40.1
libtiff5-4.0.9-40.1
libtiff5-debuginfo-4.0.9-40.1
tiff-4.0.9-40.1
tiff-debuginfo-4.0.9-40.1
tiff-debugsource-4.0.9-40.1
- openSUSE Leap 42.3 (x86_64):
libtiff-devel-32bit-4.0.9-40.1
libtiff5-32bit-4.0.9-40.1
libtiff5-debuginfo-32bit-4.0.9-40.1
References:
https://www.suse.com/security/cve/CVE-2018-12900.htmlhttps://www.suse.com/security/cve/CVE-2018-18557.htmlhttps://www.suse.com/security/cve/CVE-2018-18661.htmlhttps://bugzilla.suse.com/1099257https://bugzilla.suse.com/1113094https://bugzilla.suse.com/1113672
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for openssh
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3946-1
Rating: moderate
References: #1091396 #1105010 #964336
Cross-References: CVE-2018-15473
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves one vulnerability and has two fixes
is now available.
Description:
This update for openssh fixes the following issues:
Following security issues have been fixed:
- CVE-2018-15473: OpenSSH was prone to a user existance oracle
vulnerability due to not delaying bailout for an invalid authenticating
user until after the packet containing the request has been fully
parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
(bsc#1105010)
The following non-security issues were fixed:
- Stop leaking File descriptors (bsc#964336)
- sftp-client.c returns wrong error code upon failure [bsc#1091396]
This update was imported from the SUSE:SLE-12-SP2:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1477=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
openssh-7.2p2-25.1
openssh-askpass-gnome-7.2p2-25.1
openssh-askpass-gnome-debuginfo-7.2p2-25.1
openssh-cavs-7.2p2-25.1
openssh-cavs-debuginfo-7.2p2-25.1
openssh-debuginfo-7.2p2-25.1
openssh-debugsource-7.2p2-25.1
openssh-fips-7.2p2-25.1
openssh-helpers-7.2p2-25.1
openssh-helpers-debuginfo-7.2p2-25.1
References:
https://www.suse.com/security/cve/CVE-2018-15473.htmlhttps://bugzilla.suse.com/1091396https://bugzilla.suse.com/1105010https://bugzilla.suse.com/964336
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for SDL2_image
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3906-1
Rating: moderate
References: #1089087 #1114519
Cross-References: CVE-2018-3839 CVE-2018-3977
Affected Products:
openSUSE Backports SLE-15
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for SDL2_image fixes the following issues:
Security issues fixed:
- CVE-2018-3839: Fixed an exploitable code execution vulnerability that
existed in the XCF image rendering functionality of the Simple
DirectMedia Layer (bsc#1089087).
- CVE-2018-3977: Fixed a possible code execution via creafted XCF image
that could have caused a heap overflow (bsc#1114519).
This update was imported from the openSUSE:Leap:15.0:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15:
zypper in -t patch openSUSE-2018-1467=1
Package List:
- openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64):
libSDL2_image-2_0-0-2.0.4-bp150.3.3.1
libSDL2_image-devel-2.0.4-bp150.3.3.1
- openSUSE Backports SLE-15 (aarch64_ilp32):
libSDL2_image-2_0-0-64bit-2.0.4-bp150.3.3.1
libSDL2_image-devel-64bit-2.0.4-bp150.3.3.1
References:
https://www.suse.com/security/cve/CVE-2018-3839.htmlhttps://www.suse.com/security/cve/CVE-2018-3977.htmlhttps://bugzilla.suse.com/1089087https://bugzilla.suse.com/1114519
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for SDL2_image
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3896-1
Rating: moderate
References: #1089087 #1114519
Cross-References: CVE-2018-3839 CVE-2018-3977
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for SDL2_image fixes the following issues:
Security issues fixed:
- CVE-2018-3839: Fixed an exploitable code execution vulnerability that
existed in the XCF image rendering functionality of the Simple
DirectMedia Layer (bsc#1089087).
- CVE-2018-3977: Fixed a possible code execution via creafted XCF image
that could have caused a heap overflow (bsc#1114519).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1466=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
SDL2_image-debugsource-2.0.4-lp150.2.3.1
libSDL2_image-2_0-0-2.0.4-lp150.2.3.1
libSDL2_image-2_0-0-debuginfo-2.0.4-lp150.2.3.1
libSDL2_image-devel-2.0.4-lp150.2.3.1
- openSUSE Leap 15.0 (x86_64):
libSDL2_image-2_0-0-32bit-2.0.4-lp150.2.3.1
libSDL2_image-2_0-0-32bit-debuginfo-2.0.4-lp150.2.3.1
libSDL2_image-devel-32bit-2.0.4-lp150.2.3.1
References:
https://www.suse.com/security/cve/CVE-2018-3839.htmlhttps://www.suse.com/security/cve/CVE-2018-3977.htmlhttps://bugzilla.suse.com/1089087https://bugzilla.suse.com/1114519
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for openssl-1_1
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3890-1
Rating: moderate
References: #1113651 #1113652
Cross-References: CVE-2018-0734 CVE-2018-0735
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for openssl-1_1 fixes the following issues:
Security issues fixed:
- CVE-2018-0734: timing vulnerability in DSA signature generation
(bsc#1113652).
- CVE-2018-0735: timing vulnerability in ECDSA signature generation
(bsc#1113651).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1465=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
libopenssl-1_1-devel-1.1.0i-lp150.3.15.1
libopenssl1_1-1.1.0i-lp150.3.15.1
libopenssl1_1-debuginfo-1.1.0i-lp150.3.15.1
libopenssl1_1-hmac-1.1.0i-lp150.3.15.1
openssl-1_1-1.1.0i-lp150.3.15.1
openssl-1_1-debuginfo-1.1.0i-lp150.3.15.1
openssl-1_1-debugsource-1.1.0i-lp150.3.15.1
- openSUSE Leap 15.0 (noarch):
openssl-1_1-doc-1.1.0i-lp150.3.15.1
- openSUSE Leap 15.0 (x86_64):
libopenssl-1_1-devel-32bit-1.1.0i-lp150.3.15.1
libopenssl1_1-32bit-1.1.0i-lp150.3.15.1
libopenssl1_1-32bit-debuginfo-1.1.0i-lp150.3.15.1
libopenssl1_1-hmac-32bit-1.1.0i-lp150.3.15.1
References:
https://www.suse.com/security/cve/CVE-2018-0734.htmlhttps://www.suse.com/security/cve/CVE-2018-0735.htmlhttps://bugzilla.suse.com/1113651https://bugzilla.suse.com/1113652
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for libwpd
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:3886-1
Rating: important
References: #1115713
Cross-References: CVE-2018-19208
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for libwpd fixes the following issues:
Security issue fixed:
- CVE-2018-19208: illegal address access inside libwpd at function
WP6ContentListener:defineTable (bsc#1115713).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1463=1
Package List:
- openSUSE Leap 15.0 (noarch):
libwpd-devel-doc-0.10.2-lp150.2.3.1
- openSUSE Leap 15.0 (x86_64):
libwpd-0_10-10-0.10.2-lp150.2.3.1
libwpd-0_10-10-debuginfo-0.10.2-lp150.2.3.1
libwpd-debuginfo-0.10.2-lp150.2.3.1
libwpd-debugsource-0.10.2-lp150.2.3.1
libwpd-devel-0.10.2-lp150.2.3.1
libwpd-tools-0.10.2-lp150.2.3.1
libwpd-tools-debuginfo-0.10.2-lp150.2.3.1
References:
https://www.suse.com/security/cve/CVE-2018-19208.htmlhttps://bugzilla.suse.com/1115713
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org