November 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:3804-1: moderate: Security update for amanda
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for amanda ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3804-1 Rating: moderate References: #1112916 Cross-References: CVE-2016-10729 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for amanda fixes the following security issue: - CVE-2016-10729: Local privilege escalation from amanda user to root via unsafe tar command options (bsc#1112916) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1421=1 Package List: - openSUSE Leap 42.3 (x86_64): amanda-3.3.6-10.3.1 amanda-debuginfo-3.3.6-10.3.1 amanda-debugsource-3.3.6-10.3.1 References: https://www.suse.com/security/cve/CVE-2016-10729.html https://bugzilla.suse.com/1112916 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3803-1: important: Security update for systemd
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3803-1 Rating: important References: #1106923 #1108835 #1109252 #1110445 #1111278 #1112024 #1113083 #1113632 #1113665 Cross-References: CVE-2018-15686 CVE-2018-15688 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for systemd fixes the following issues: Security issues fixed: - CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. (bsc#1113632) - CVE-2018-15686: A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. (bsc#1113665) Non-security issues fixed: - dhcp6: split assert_return() to be more debuggable when hit - core: skip unit deserialization and move to the next one when unit_deserialize() fails - core: properly handle deserialization of unknown unit types (#6476) - core: don't create Requires for workdir if "missing ok" (bsc#1113083) - logind: use manager_get_user_by_pid() where appropriate - logind: rework manager_get_{user|session}_by_pid() a bit - login: fix user@.service case, so we don't allow nested sessions (#8051) (bsc#1112024) - core: be more defensive if we can't determine per-connection socket peer (#7329) - socket-util: introduce port argument in sockaddr_port() - service: fixup ExecStop for socket-activated shutdown (#4120) - service: Continue shutdown on socket activated unit on termination (#4108) (bsc#1106923) - cryptsetup: build fixes for "add support for sector-size= option" - udev-rules: IMPORT cmdline does not recognize keys with similar names (bsc#1111278) - core: keep the kernel coredump defaults when systemd-coredump is disabled - core: shorten main() a bit, split out coredump initialization - core: set RLIMIT_CORE to unlimited by default (bsc#1108835) - core/mount: fstype may be NULL - journald: don't ship systemd-journald-audit.socket (bsc#1109252) - core: make "tmpfs" dependencies on swapfs a "default" dep, not an "implicit" (bsc#1110445) - mount: make sure we unmount tmpfs mounts before we deactivate swaps (#7076) - tmp.mount.hm4: After swap.target (#3087) - Ship systemd-sysv-install helper via the main package This script was part of systemd-sysvinit sub-package but it was wrong since systemd-sysv-install is a script used to redirect enable/disable operations to chkconfig when the unit targets are sysv init scripts. Therefore it's never been a SySV init tool. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1423=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-62.1 libsystemd0-debuginfo-228-62.1 libsystemd0-mini-228-62.1 libsystemd0-mini-debuginfo-228-62.1 libudev-devel-228-62.1 libudev-mini-devel-228-62.1 libudev-mini1-228-62.1 libudev-mini1-debuginfo-228-62.1 libudev1-228-62.1 libudev1-debuginfo-228-62.1 nss-myhostname-228-62.1 nss-myhostname-debuginfo-228-62.1 nss-mymachines-228-62.1 nss-mymachines-debuginfo-228-62.1 systemd-228-62.1 systemd-debuginfo-228-62.1 systemd-debugsource-228-62.1 systemd-devel-228-62.1 systemd-logger-228-62.1 systemd-mini-228-62.1 systemd-mini-debuginfo-228-62.1 systemd-mini-debugsource-228-62.1 systemd-mini-devel-228-62.1 systemd-mini-sysvinit-228-62.1 systemd-sysvinit-228-62.1 udev-228-62.1 udev-debuginfo-228-62.1 udev-mini-228-62.1 udev-mini-debuginfo-228-62.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-62.1 libsystemd0-debuginfo-32bit-228-62.1 libudev1-32bit-228-62.1 libudev1-debuginfo-32bit-228-62.1 nss-myhostname-32bit-228-62.1 nss-myhostname-debuginfo-32bit-228-62.1 systemd-32bit-228-62.1 systemd-debuginfo-32bit-228-62.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-62.1 systemd-mini-bash-completion-228-62.1 References: https://www.suse.com/security/cve/CVE-2018-15686.html https://www.suse.com/security/cve/CVE-2018-15688.html https://bugzilla.suse.com/1106923 https://bugzilla.suse.com/1108835 https://bugzilla.suse.com/1109252 https://bugzilla.suse.com/1110445 https://bugzilla.suse.com/1111278 https://bugzilla.suse.com/1112024 https://bugzilla.suse.com/1113083 https://bugzilla.suse.com/1113632 https://bugzilla.suse.com/1113665 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3802-1: Security update for libxkbcommon
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for libxkbcommon ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3802-1 Rating: low References: #1105832 Cross-References: CVE-2018-15853 CVE-2018-15854 CVE-2018-15855 CVE-2018-15856 CVE-2018-15857 CVE-2018-15858 CVE-2018-15859 CVE-2018-15861 CVE-2018-15862 CVE-2018-15863 CVE-2018-15864 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for libxkbcommon to version 0.8.2 fixes the following issues: - Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. - CVE-2018-15853: Endless recursion could have been used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation (bsc#1105832). - CVE-2018-15854: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly (bsc#1105832). - CVE-2018-15855: Unchecked NULL pointer usage could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled (bsc#1105832). - CVE-2018-15856: An infinite loop when reaching EOL unexpectedly could be used by local attackers to cause a denial of service during parsing of crafted keymap files (bsc#1105832). - CVE-2018-15857: An invalid free in ExprAppendMultiKeysymList could have been used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file (bsc#1105832). - CVE-2018-15858: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file (bsc#1105832). - CVE-2018-15859: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled (bsc#1105832). - CVE-2018-15861: Unchecked NULL pointer usage in ExprResolveLhs could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure (bsc#1105832). - CVE-2018-15862: Unchecked NULL pointer usage in LookupModMask could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers (bsc#1105832). - CVE-2018-15863: Unchecked NULL pointer usage in ResolveStateAndPredicate could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression (bsc#1105832). - CVE-2018-15864: Unchecked NULL pointer usage in resolve_keysym could have been used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created (bsc#1105832). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1418=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libxkbcommon-debugsource-0.8.2-lp150.2.3.1 libxkbcommon-devel-0.8.2-lp150.2.3.1 libxkbcommon-x11-0-0.8.2-lp150.2.3.1 libxkbcommon-x11-0-debuginfo-0.8.2-lp150.2.3.1 libxkbcommon-x11-devel-0.8.2-lp150.2.3.1 libxkbcommon0-0.8.2-lp150.2.3.1 libxkbcommon0-debuginfo-0.8.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libxkbcommon-devel-32bit-0.8.2-lp150.2.3.1 libxkbcommon-x11-0-32bit-0.8.2-lp150.2.3.1 libxkbcommon-x11-0-32bit-debuginfo-0.8.2-lp150.2.3.1 libxkbcommon-x11-devel-32bit-0.8.2-lp150.2.3.1 libxkbcommon0-32bit-0.8.2-lp150.2.3.1 libxkbcommon0-32bit-debuginfo-0.8.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-15853.html https://www.suse.com/security/cve/CVE-2018-15854.html https://www.suse.com/security/cve/CVE-2018-15855.html https://www.suse.com/security/cve/CVE-2018-15856.html https://www.suse.com/security/cve/CVE-2018-15857.html https://www.suse.com/security/cve/CVE-2018-15858.html https://www.suse.com/security/cve/CVE-2018-15859.html https://www.suse.com/security/cve/CVE-2018-15861.html https://www.suse.com/security/cve/CVE-2018-15862.html https://www.suse.com/security/cve/CVE-2018-15863.html https://www.suse.com/security/cve/CVE-2018-15864.html https://bugzilla.suse.com/1105832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3801-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3801-1 Rating: moderate References: #1081947 #1091396 #1105010 #1106163 #964336 Cross-References: CVE-2018-15473 CVE-2018-15919 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for openssh fixes the following issues: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability. (bsc#1106163) - CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010) The following non-security issues were fixed: - Stop leaking File descriptors (bsc#964336) - sftp-client.c returns wrong error code upon failure (bsc#1091396) - added pam_keyinit to pam configuration file (bsc#1081947) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1419=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): openssh-7.6p1-lp150.8.3.1 openssh-cavs-7.6p1-lp150.8.3.1 openssh-cavs-debuginfo-7.6p1-lp150.8.3.1 openssh-debuginfo-7.6p1-lp150.8.3.1 openssh-debugsource-7.6p1-lp150.8.3.1 openssh-fips-7.6p1-lp150.8.3.1 openssh-helpers-7.6p1-lp150.8.3.1 openssh-helpers-debuginfo-7.6p1-lp150.8.3.1 - openSUSE Leap 15.0 (x86_64): openssh-askpass-gnome-7.6p1-lp150.8.3.1 openssh-askpass-gnome-debuginfo-7.6p1-lp150.8.3.1 References: https://www.suse.com/security/cve/CVE-2018-15473.html https://www.suse.com/security/cve/CVE-2018-15919.html https://bugzilla.suse.com/1081947 https://bugzilla.suse.com/1091396 https://bugzilla.suse.com/1105010 https://bugzilla.suse.com/1106163 https://bugzilla.suse.com/964336 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3800-1: moderate: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3800-1 Rating: moderate References: #1112020 Cross-References: CVE-2018-14665 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges (bsc#1112020, Note that SUSE by default does not run with elevated privileges, so the default installation is not affected by this problem. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1420=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xorg-x11-server-1.19.6-lp150.7.3.1 xorg-x11-server-debuginfo-1.19.6-lp150.7.3.1 xorg-x11-server-debugsource-1.19.6-lp150.7.3.1 xorg-x11-server-extra-1.19.6-lp150.7.3.1 xorg-x11-server-extra-debuginfo-1.19.6-lp150.7.3.1 xorg-x11-server-sdk-1.19.6-lp150.7.3.1 xorg-x11-server-source-1.19.6-lp150.7.3.1 xorg-x11-server-wayland-1.19.6-lp150.7.3.1 xorg-x11-server-wayland-debuginfo-1.19.6-lp150.7.3.1 References: https://www.suse.com/security/cve/CVE-2018-14665.html https://bugzilla.suse.com/1112020 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3798-1: moderate: Security update for apache-pdfbox
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for apache-pdfbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3798-1 Rating: moderate References: #1111009 Cross-References: CVE-2018-11797 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-pdfbox fixes the following security issue: - CVE-2018-11797: A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. (bsc#1111009): This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1422=1 Package List: - openSUSE Leap 15.0 (noarch): apache-pdfbox-1.8.12-lp150.4.6.1 apache-pdfbox-javadoc-1.8.12-lp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2018-11797.html https://bugzilla.suse.com/1111009 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3797-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3797-1 Rating: moderate References: #1106254 #1110746 #1111069 #1111072 Cross-References: CVE-2018-17966 CVE-2018-18016 CVE-2018-18024 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. (bsc#1111069) - CVE-2018-18016: Fixed a memory leak in WritePCXImage (bsc#1111072). - CVE-2018-17966: Fixed a memory leak in WritePDBImage (bsc#1110746). Non security issues fixed: - Fixed -morphology EdgeIn output (bsc#1106254) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1424=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.21.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.21.1 ImageMagick-debugsource-7.0.7.34-lp150.2.21.1 ImageMagick-devel-7.0.7.34-lp150.2.21.1 ImageMagick-extra-7.0.7.34-lp150.2.21.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.21.1 libMagick++-devel-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.21.1 perl-PerlMagick-7.0.7.34-lp150.2.21.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.21.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.21.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.21.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.21.1 References: https://www.suse.com/security/cve/CVE-2018-17966.html https://www.suse.com/security/cve/CVE-2018-18016.html https://www.suse.com/security/cve/CVE-2018-18024.html https://bugzilla.suse.com/1106254 https://bugzilla.suse.com/1110746 https://bugzilla.suse.com/1111069 https://bugzilla.suse.com/1111072 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3796-1: moderate: Security update for LibreOffice and dependency libraries
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for LibreOffice and dependency libraries ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3796-1 Rating: moderate References: #1050305 #1088263 #1091606 #1094779 #1095601 #1095639 #1096360 #1098891 #1104876 Cross-References: CVE-2018-10583 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update for LibreOffice, libepubgen, liblangtag, libmwaw, libnumbertext, libstaroffice, libwps, myspell-dictionaries, xmlsec1 fixes the following issues: LibreOffice was updated to 6.1.3.2 (fate#326624) and contains new features and lots of bugfixes: The full changelog can be found on: https://wiki.documentfoundation.org/ReleaseNotes/6.1 Bugfixes: - bsc#1095639 Exporting to PPTX results in vertical labels being shown horizontally - bsc#1098891 Table in PPTX misplaced and partly blue - bsc#1088263 Labels in chart change (from white and other colors) to black when saving as PPTX - bsc#1095601 Exporting to PPTX shifts arrow shapes quite a bit - Add more translations: * Belarusian * Bodo * Dogri * Frisian * Gaelic * Paraguayan_Guaran * Upper_Sorbian * Konkani * Kashmiri * Luxembourgish * Monglolian * Manipuri * Burnese * Occitan * Kinyarwanda * Santali * Sanskrit * Sindhi * Sidamo * Tatar * Uzbek * Upper Sorbian * Venetian * Amharic * Asturian * Tibetian * Bosnian * English GB * English ZA * Indonesian * Icelandic * Georgian * Khmer * Lao * Macedonian * Nepali * Oromo * Albanian * Tajik * Uyghur * Vietnamese * Kurdish - Try to build all languages see bsc#1096360 - Make sure to install the KDE5/Qt5 UI/filepicker - Try to implement safeguarding to avoid bsc#1050305 - Disable base-drivers-mysql as it needs mysqlcppcon that is only for mysql and not mariadb, causes issues bsc#1094779 * Users can still connect using jdbc/odbc - Fix java detection on machines with too many cpus - CVE-2018-10583: An information disclosure vulnerability occured when LibreOffice automatically processed and initiated an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606) libepubgen was updated to 0.1.1: - Avoid <div> inside <p> or <span>. - Avoid writin vertical-align attribute without a value. - Fix generation of invalid XHTML when there is a link starting at the beginning of a footnote. - Handle relative width for images. - Fixed layout: write chapter names to improve navigation. - Support writing mode. - Start a new HTML file at every page span in addition to the splits induced by the chosen split method. This is to ensure that specified writing mode works correctly, as it is HTML <body> attribute. liblangtag was updated to 0.6.2: - use standard function - fix leak in test libmwaw was updated to 0.3.14: - Support MS Multiplan 1.1 files libnumbertext was update to 1.0.5: - Various fixes in numerical calculations and issues reported on libreoffice tracker libstaroffice was updated to 0.0.6: - retrieve some StarMath's formula, - retrieve some charts as graphic, - retrieve some fields in sda/sdc/sdp text-boxes, - .sdw: retrieve more attachments. libwps was updated to 0.4.9: - QuattroPro: add parser to .wb3 files - Multiplan: add parser to DOS v1-v3 files - charts: try to retrieve charts in .wk*, .wq* files - QuattroPro: add parser to .wb[12] files myspell-dictionaries was updated to 20181025: - Turkish dictionary added - Updated French dictionary xmlsec1 was updated to 1.2.26: - Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation - Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1417=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libxmlsec1-1-1.2.26-lp150.2.3.1 libxmlsec1-1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-gcrypt1-1.2.26-lp150.2.3.1 libxmlsec1-gcrypt1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-gnutls1-1.2.26-lp150.2.3.1 libxmlsec1-gnutls1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-nss1-1.2.26-lp150.2.3.1 libxmlsec1-nss1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-openssl1-1.2.26-lp150.2.3.1 libxmlsec1-openssl1-debuginfo-1.2.26-lp150.2.3.1 myspell-dictionaries-20181025-lp150.2.6.1 myspell-lightproof-en-20181025-lp150.2.6.1 myspell-lightproof-hu_HU-20181025-lp150.2.6.1 myspell-lightproof-pt_BR-20181025-lp150.2.6.1 myspell-lightproof-ru_RU-20181025-lp150.2.6.1 xmlsec1-1.2.26-lp150.2.3.1 xmlsec1-debuginfo-1.2.26-lp150.2.3.1 xmlsec1-debugsource-1.2.26-lp150.2.3.1 xmlsec1-devel-1.2.26-lp150.2.3.1 xmlsec1-gcrypt-devel-1.2.26-lp150.2.3.1 xmlsec1-gnutls-devel-1.2.26-lp150.2.3.1 xmlsec1-nss-devel-1.2.26-lp150.2.3.1 xmlsec1-openssl-devel-1.2.26-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libepubgen-devel-doc-0.1.1-lp150.2.3.1 liblangtag-doc-0.6.2-lp150.2.3.1 libmwaw-devel-doc-0.3.14-lp150.2.3.1 libreoffice-branding-upstream-6.1.3.2-lp150.2.6.2 libreoffice-gdb-pretty-printers-6.1.3.2-lp150.2.6.2 libreoffice-glade-6.1.3.2-lp150.2.6.2 libreoffice-icon-themes-6.1.3.2-lp150.2.6.2 libreoffice-l10n-af-6.1.3.2-lp150.2.6.2 libreoffice-l10n-am-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ar-6.1.3.2-lp150.2.6.2 libreoffice-l10n-as-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ast-6.1.3.2-lp150.2.6.2 libreoffice-l10n-be-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bg-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bn_IN-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-br-6.1.3.2-lp150.2.6.2 libreoffice-l10n-brx-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bs-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ca-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ca_valencia-6.1.3.2-lp150.2.6.2 libreoffice-l10n-cs-6.1.3.2-lp150.2.6.2 libreoffice-l10n-cy-6.1.3.2-lp150.2.6.2 libreoffice-l10n-da-6.1.3.2-lp150.2.6.2 libreoffice-l10n-de-6.1.3.2-lp150.2.6.2 libreoffice-l10n-dgo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-dz-6.1.3.2-lp150.2.6.2 libreoffice-l10n-el-6.1.3.2-lp150.2.6.2 libreoffice-l10n-en-6.1.3.2-lp150.2.6.2 libreoffice-l10n-en_GB-6.1.3.2-lp150.2.6.2 libreoffice-l10n-en_ZA-6.1.3.2-lp150.2.6.2 libreoffice-l10n-eo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-es-6.1.3.2-lp150.2.6.2 libreoffice-l10n-et-6.1.3.2-lp150.2.6.2 libreoffice-l10n-eu-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fa-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fi-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fy-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ga-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gd-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gu-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gug-6.1.3.2-lp150.2.6.2 libreoffice-l10n-he-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hi-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hsb-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hu-6.1.3.2-lp150.2.6.2 libreoffice-l10n-id-6.1.3.2-lp150.2.6.2 libreoffice-l10n-is-6.1.3.2-lp150.2.6.2 libreoffice-l10n-it-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ja-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ka-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kab-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-km-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kmr_Latn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ko-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kok-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ks-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lb-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lt-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lv-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mai-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ml-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mni-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-my-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nb-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ne-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nso-6.1.3.2-lp150.2.6.2 libreoffice-l10n-oc-6.1.3.2-lp150.2.6.2 libreoffice-l10n-om-6.1.3.2-lp150.2.6.2 libreoffice-l10n-or-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pa-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pt_BR-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pt_PT-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ro-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ru-6.1.3.2-lp150.2.6.2 libreoffice-l10n-rw-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sa_IN-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sat-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sd-6.1.3.2-lp150.2.6.2 libreoffice-l10n-si-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sid-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sq-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ss-6.1.3.2-lp150.2.6.2 libreoffice-l10n-st-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sv-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sw_TZ-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ta-6.1.3.2-lp150.2.6.2 libreoffice-l10n-te-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tg-6.1.3.2-lp150.2.6.2 libreoffice-l10n-th-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ts-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tt-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ug-6.1.3.2-lp150.2.6.2 libreoffice-l10n-uk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-uz-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ve-6.1.3.2-lp150.2.6.2 libreoffice-l10n-vec-6.1.3.2-lp150.2.6.2 libreoffice-l10n-vi-6.1.3.2-lp150.2.6.2 libreoffice-l10n-xh-6.1.3.2-lp150.2.6.2 libreoffice-l10n-zh_CN-6.1.3.2-lp150.2.6.2 libreoffice-l10n-zh_TW-6.1.3.2-lp150.2.6.2 libreoffice-l10n-zu-6.1.3.2-lp150.2.6.2 libstaroffice-devel-doc-0.0.6-lp150.2.3.1 myspell-af_NA-20181025-lp150.2.6.1 myspell-af_ZA-20181025-lp150.2.6.1 myspell-an-20181025-lp150.2.6.1 myspell-an_ES-20181025-lp150.2.6.1 myspell-ar-20181025-lp150.2.6.1 myspell-ar_AE-20181025-lp150.2.6.1 myspell-ar_BH-20181025-lp150.2.6.1 myspell-ar_DZ-20181025-lp150.2.6.1 myspell-ar_EG-20181025-lp150.2.6.1 myspell-ar_IQ-20181025-lp150.2.6.1 myspell-ar_JO-20181025-lp150.2.6.1 myspell-ar_KW-20181025-lp150.2.6.1 myspell-ar_LB-20181025-lp150.2.6.1 myspell-ar_LY-20181025-lp150.2.6.1 myspell-ar_MA-20181025-lp150.2.6.1 myspell-ar_OM-20181025-lp150.2.6.1 myspell-ar_QA-20181025-lp150.2.6.1 myspell-ar_SA-20181025-lp150.2.6.1 myspell-ar_SD-20181025-lp150.2.6.1 myspell-ar_SY-20181025-lp150.2.6.1 myspell-ar_TN-20181025-lp150.2.6.1 myspell-ar_YE-20181025-lp150.2.6.1 myspell-be_BY-20181025-lp150.2.6.1 myspell-bg_BG-20181025-lp150.2.6.1 myspell-bn_BD-20181025-lp150.2.6.1 myspell-bn_IN-20181025-lp150.2.6.1 myspell-bo-20181025-lp150.2.6.1 myspell-bo_CN-20181025-lp150.2.6.1 myspell-bo_IN-20181025-lp150.2.6.1 myspell-br_FR-20181025-lp150.2.6.1 myspell-bs-20181025-lp150.2.6.1 myspell-bs_BA-20181025-lp150.2.6.1 myspell-ca-20181025-lp150.2.6.1 myspell-ca_AD-20181025-lp150.2.6.1 myspell-ca_ES-20181025-lp150.2.6.1 myspell-ca_ES_valencia-20181025-lp150.2.6.1 myspell-ca_FR-20181025-lp150.2.6.1 myspell-ca_IT-20181025-lp150.2.6.1 myspell-cs_CZ-20181025-lp150.2.6.1 myspell-da_DK-20181025-lp150.2.6.1 myspell-de-20181025-lp150.2.6.1 myspell-de_AT-20181025-lp150.2.6.1 myspell-de_CH-20181025-lp150.2.6.1 myspell-de_DE-20181025-lp150.2.6.1 myspell-el_GR-20181025-lp150.2.6.1 myspell-en-20181025-lp150.2.6.1 myspell-en_AU-20181025-lp150.2.6.1 myspell-en_BS-20181025-lp150.2.6.1 myspell-en_BZ-20181025-lp150.2.6.1 myspell-en_CA-20181025-lp150.2.6.1 myspell-en_GB-20181025-lp150.2.6.1 myspell-en_GH-20181025-lp150.2.6.1 myspell-en_IE-20181025-lp150.2.6.1 myspell-en_IN-20181025-lp150.2.6.1 myspell-en_JM-20181025-lp150.2.6.1 myspell-en_MW-20181025-lp150.2.6.1 myspell-en_NA-20181025-lp150.2.6.1 myspell-en_NZ-20181025-lp150.2.6.1 myspell-en_PH-20181025-lp150.2.6.1 myspell-en_TT-20181025-lp150.2.6.1 myspell-en_US-20181025-lp150.2.6.1 myspell-en_ZA-20181025-lp150.2.6.1 myspell-en_ZW-20181025-lp150.2.6.1 myspell-es-20181025-lp150.2.6.1 myspell-es_AR-20181025-lp150.2.6.1 myspell-es_BO-20181025-lp150.2.6.1 myspell-es_CL-20181025-lp150.2.6.1 myspell-es_CO-20181025-lp150.2.6.1 myspell-es_CR-20181025-lp150.2.6.1 myspell-es_CU-20181025-lp150.2.6.1 myspell-es_DO-20181025-lp150.2.6.1 myspell-es_EC-20181025-lp150.2.6.1 myspell-es_ES-20181025-lp150.2.6.1 myspell-es_GT-20181025-lp150.2.6.1 myspell-es_HN-20181025-lp150.2.6.1 myspell-es_MX-20181025-lp150.2.6.1 myspell-es_NI-20181025-lp150.2.6.1 myspell-es_PA-20181025-lp150.2.6.1 myspell-es_PE-20181025-lp150.2.6.1 myspell-es_PR-20181025-lp150.2.6.1 myspell-es_PY-20181025-lp150.2.6.1 myspell-es_SV-20181025-lp150.2.6.1 myspell-es_UY-20181025-lp150.2.6.1 myspell-es_VE-20181025-lp150.2.6.1 myspell-et_EE-20181025-lp150.2.6.1 myspell-fr_BE-20181025-lp150.2.6.1 myspell-fr_CA-20181025-lp150.2.6.1 myspell-fr_CH-20181025-lp150.2.6.1 myspell-fr_FR-20181025-lp150.2.6.1 myspell-fr_LU-20181025-lp150.2.6.1 myspell-fr_MC-20181025-lp150.2.6.1 myspell-gd_GB-20181025-lp150.2.6.1 myspell-gl-20181025-lp150.2.6.1 myspell-gl_ES-20181025-lp150.2.6.1 myspell-gu_IN-20181025-lp150.2.6.1 myspell-gug-20181025-lp150.2.6.1 myspell-gug_PY-20181025-lp150.2.6.1 myspell-he_IL-20181025-lp150.2.6.1 myspell-hi_IN-20181025-lp150.2.6.1 myspell-hr_HR-20181025-lp150.2.6.1 myspell-hu_HU-20181025-lp150.2.6.1 myspell-id-20181025-lp150.2.6.1 myspell-id_ID-20181025-lp150.2.6.1 myspell-is-20181025-lp150.2.6.1 myspell-is_IS-20181025-lp150.2.6.1 myspell-it_IT-20181025-lp150.2.6.1 myspell-kmr_Latn-20181025-lp150.2.6.1 myspell-kmr_Latn_SY-20181025-lp150.2.6.1 myspell-kmr_Latn_TR-20181025-lp150.2.6.1 myspell-lo_LA-20181025-lp150.2.6.1 myspell-lt_LT-20181025-lp150.2.6.1 myspell-lv_LV-20181025-lp150.2.6.1 myspell-nb_NO-20181025-lp150.2.6.1 myspell-ne_NP-20181025-lp150.2.6.1 myspell-nl_BE-20181025-lp150.2.6.1 myspell-nl_NL-20181025-lp150.2.6.1 myspell-nn_NO-20181025-lp150.2.6.1 myspell-no-20181025-lp150.2.6.1 myspell-oc_FR-20181025-lp150.2.6.1 myspell-pl_PL-20181025-lp150.2.6.1 myspell-pt_AO-20181025-lp150.2.6.1 myspell-pt_BR-20181025-lp150.2.6.1 myspell-pt_PT-20181025-lp150.2.6.1 myspell-ro-20181025-lp150.2.6.1 myspell-ro_RO-20181025-lp150.2.6.1 myspell-ru_RU-20181025-lp150.2.6.1 myspell-si_LK-20181025-lp150.2.6.1 myspell-sk_SK-20181025-lp150.2.6.1 myspell-sl_SI-20181025-lp150.2.6.1 myspell-sq_AL-20181025-lp150.2.6.1 myspell-sr-20181025-lp150.2.6.1 myspell-sr_CS-20181025-lp150.2.6.1 myspell-sr_Latn_CS-20181025-lp150.2.6.1 myspell-sr_Latn_RS-20181025-lp150.2.6.1 myspell-sr_RS-20181025-lp150.2.6.1 myspell-sv_FI-20181025-lp150.2.6.1 myspell-sv_SE-20181025-lp150.2.6.1 myspell-sw_TZ-20181025-lp150.2.6.1 myspell-te-20181025-lp150.2.6.1 myspell-te_IN-20181025-lp150.2.6.1 myspell-th_TH-20181025-lp150.2.6.1 myspell-tr-20181025-lp150.2.6.1 myspell-tr_TR-20181025-lp150.2.6.1 myspell-uk_UA-20181025-lp150.2.6.1 myspell-vi-20181025-lp150.2.6.1 myspell-vi_VN-20181025-lp150.2.6.1 myspell-zu_ZA-20181025-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libepubgen-0_1-1-0.1.1-lp150.2.3.1 libepubgen-0_1-1-debuginfo-0.1.1-lp150.2.3.1 libepubgen-debugsource-0.1.1-lp150.2.3.1 libepubgen-devel-0.1.1-lp150.2.3.1 liblangtag-debugsource-0.6.2-lp150.2.3.1 liblangtag-devel-0.6.2-lp150.2.3.1 liblangtag1-0.6.2-lp150.2.3.1 liblangtag1-debuginfo-0.6.2-lp150.2.3.1 libmwaw-0_3-3-0.3.14-lp150.2.3.1 libmwaw-0_3-3-debuginfo-0.3.14-lp150.2.3.1 libmwaw-debuginfo-0.3.14-lp150.2.3.1 libmwaw-debugsource-0.3.14-lp150.2.3.1 libmwaw-devel-0.3.14-lp150.2.3.1 libmwaw-tools-0.3.14-lp150.2.3.1 libmwaw-tools-debuginfo-0.3.14-lp150.2.3.1 libnumbertext-1_0-0-1.0.5-lp150.2.1 libnumbertext-1_0-0-debuginfo-1.0.5-lp150.2.1 libnumbertext-data-1.0.5-lp150.2.1 libnumbertext-debuginfo-1.0.5-lp150.2.1 libnumbertext-debugsource-1.0.5-lp150.2.1 libnumbertext-devel-1.0.5-lp150.2.1 libnumbertext-tools-1.0.5-lp150.2.1 libnumbertext-tools-debuginfo-1.0.5-lp150.2.1 libreoffice-6.1.3.2-lp150.2.6.2 libreoffice-base-6.1.3.2-lp150.2.6.2 libreoffice-base-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-firebird-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-firebird-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-postgresql-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-postgresql-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-calc-6.1.3.2-lp150.2.6.2 libreoffice-calc-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-calc-extensions-6.1.3.2-lp150.2.6.2 libreoffice-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-debugsource-6.1.3.2-lp150.2.6.2 libreoffice-draw-6.1.3.2-lp150.2.6.2 libreoffice-draw-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-filters-optional-6.1.3.2-lp150.2.6.2 libreoffice-gnome-6.1.3.2-lp150.2.6.2 libreoffice-gnome-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-gtk2-6.1.3.2-lp150.2.6.2 libreoffice-gtk2-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-gtk3-6.1.3.2-lp150.2.6.2 libreoffice-gtk3-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-impress-6.1.3.2-lp150.2.6.2 libreoffice-impress-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-mailmerge-6.1.3.2-lp150.2.6.2 libreoffice-math-6.1.3.2-lp150.2.6.2 libreoffice-math-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-officebean-6.1.3.2-lp150.2.6.2 libreoffice-officebean-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-pyuno-6.1.3.2-lp150.2.6.2 libreoffice-pyuno-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-qt5-6.1.3.2-lp150.2.6.2 libreoffice-qt5-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-sdk-6.1.3.2-lp150.2.6.2 libreoffice-sdk-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-sdk-doc-6.1.3.2-lp150.2.6.2 libreoffice-writer-6.1.3.2-lp150.2.6.2 libreoffice-writer-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-writer-extensions-6.1.3.2-lp150.2.6.2 libreofficekit-6.1.3.2-lp150.2.6.2 libreofficekit-devel-6.1.3.2-lp150.2.6.2 libstaroffice-0_0-0-0.0.6-lp150.2.3.1 libstaroffice-0_0-0-debuginfo-0.0.6-lp150.2.3.1 libstaroffice-debuginfo-0.0.6-lp150.2.3.1 libstaroffice-debugsource-0.0.6-lp150.2.3.1 libstaroffice-devel-0.0.6-lp150.2.3.1 libstaroffice-tools-0.0.6-lp150.2.3.1 libstaroffice-tools-debuginfo-0.0.6-lp150.2.3.1 libwps-0_4-4-0.4.9-lp150.2.3.1 libwps-0_4-4-debuginfo-0.4.9-lp150.2.3.1 libwps-debuginfo-0.4.9-lp150.2.3.1 libwps-debugsource-0.4.9-lp150.2.3.1 libwps-devel-0.4.9-lp150.2.3.1 libwps-tools-0.4.9-lp150.2.3.1 libwps-tools-debuginfo-0.4.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10583.html https://bugzilla.suse.com/1050305 https://bugzilla.suse.com/1088263 https://bugzilla.suse.com/1091606 https://bugzilla.suse.com/1094779 https://bugzilla.suse.com/1095601 https://bugzilla.suse.com/1095639 https://bugzilla.suse.com/1096360 https://bugzilla.suse.com/1098891 https://bugzilla.suse.com/1104876 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3754-1: important: Security update for icecast
by opensuse-security＠opensuse.org 13 Nov '18

13 Nov '18

openSUSE Security Update: Security update for icecast ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3754-1 Rating: important References: #1114434 Cross-References: CVE-2018-18820 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icecast fixes the following security issues: - CVE-2018-18820: A buffer overflow in url-auth could have potentially allowed remote code execution (boo#1114434) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1395=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1395=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1395=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): icecast-2.4.2-7.3.1 icecast-debuginfo-2.4.2-7.3.1 icecast-debugsource-2.4.2-7.3.1 - openSUSE Leap 42.3 (noarch): icecast-doc-2.4.2-7.3.1 - openSUSE Leap 15.0 (noarch): icecast-doc-2.4.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): icecast-2.4.3-lp150.2.3.1 icecast-debuginfo-2.4.3-lp150.2.3.1 icecast-debugsource-2.4.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): icecast-2.4.3-bp150.3.3.1 icecast-debuginfo-2.4.3-bp150.3.3.1 icecast-debugsource-2.4.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): icecast-doc-2.4.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-18820.html https://bugzilla.suse.com/1114434 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3717-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3717-1 Rating: moderate References: #1032089 #1037008 #1037009 #1057514 #1059100 #1059134 #1059139 Cross-References: CVE-2016-10209 CVE-2016-10349 CVE-2016-10350 CVE-2017-14166 CVE-2017-14501 CVE-2017-14502 CVE-2017-14503 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libarchive fixes the following issues: - CVE-2016-10209: The archive_wstring_append_from_mbs function in archive_string.c allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file. (bsc#1032089) - CVE-2016-10349: The archive_le32dec function in archive_endian.h allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. (bsc#1037008) - CVE-2016-10350: The archive_read_format_cab_read_header function in archive_read_support_format_cab.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. (bsc#1037009) - CVE-2017-14166: libarchive allowed remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c. (bsc#1057514) - CVE-2017-14501: An out-of-bounds read flaw existed in parse_file_info in archive_read_support_format_iso9660.c when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header. (bsc#1059139) - CVE-2017-14502: read_header in archive_read_support_format_rar.c suffered from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. (bsc#1059134) - CVE-2017-14503: libarchive suffered from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16. (bsc#1059100) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1366=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): bsdtar-3.1.2-20.3.1 bsdtar-debuginfo-3.1.2-20.3.1 libarchive-debugsource-3.1.2-20.3.1 libarchive-devel-3.1.2-20.3.1 libarchive13-3.1.2-20.3.1 libarchive13-debuginfo-3.1.2-20.3.1 - openSUSE Leap 42.3 (x86_64): libarchive13-32bit-3.1.2-20.3.1 libarchive13-debuginfo-32bit-3.1.2-20.3.1 References: https://www.suse.com/security/cve/CVE-2016-10209.html https://www.suse.com/security/cve/CVE-2016-10349.html https://www.suse.com/security/cve/CVE-2016-10350.html https://www.suse.com/security/cve/CVE-2017-14166.html https://www.suse.com/security/cve/CVE-2017-14501.html https://www.suse.com/security/cve/CVE-2017-14502.html https://www.suse.com/security/cve/CVE-2017-14503.html https://bugzilla.suse.com/1032089 https://bugzilla.suse.com/1037008 https://bugzilla.suse.com/1037009 https://bugzilla.suse.com/1057514 https://bugzilla.suse.com/1059100 https://bugzilla.suse.com/1059134 https://bugzilla.suse.com/1059139 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3716-1: moderate: Security update for opensc
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for opensc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3716-1 Rating: moderate References: #1104812 #1106998 #1106999 #1107033 #1107034 #1107035 #1107036 #1107037 #1107038 #1107039 #1107049 #1107097 #1107107 #1108318 Cross-References: CVE-2018-16391 CVE-2018-16392 CVE-2018-16393 CVE-2018-16418 CVE-2018-16419 CVE-2018-16420 CVE-2018-16421 CVE-2018-16422 CVE-2018-16423 CVE-2018-16424 CVE-2018-16425 CVE-2018-16426 CVE-2018-16427 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for opensc fixes the following security issues: - CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998) - CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999) - CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318) - CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039) - CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107) - CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097) - CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049) - CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038) - CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037) - CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036) - CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035) - CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034) - CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1385=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): opensc-0.18.0-lp150.2.9.1 opensc-debuginfo-0.18.0-lp150.2.9.1 opensc-debugsource-0.18.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): opensc-32bit-0.18.0-lp150.2.9.1 opensc-32bit-debuginfo-0.18.0-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-16391.html https://www.suse.com/security/cve/CVE-2018-16392.html https://www.suse.com/security/cve/CVE-2018-16393.html https://www.suse.com/security/cve/CVE-2018-16418.html https://www.suse.com/security/cve/CVE-2018-16419.html https://www.suse.com/security/cve/CVE-2018-16420.html https://www.suse.com/security/cve/CVE-2018-16421.html https://www.suse.com/security/cve/CVE-2018-16422.html https://www.suse.com/security/cve/CVE-2018-16423.html https://www.suse.com/security/cve/CVE-2018-16424.html https://www.suse.com/security/cve/CVE-2018-16425.html https://www.suse.com/security/cve/CVE-2018-16426.html https://www.suse.com/security/cve/CVE-2018-16427.html https://bugzilla.suse.com/1104812 https://bugzilla.suse.com/1106998 https://bugzilla.suse.com/1106999 https://bugzilla.suse.com/1107033 https://bugzilla.suse.com/1107034 https://bugzilla.suse.com/1107035 https://bugzilla.suse.com/1107036 https://bugzilla.suse.com/1107037 https://bugzilla.suse.com/1107038 https://bugzilla.suse.com/1107039 https://bugzilla.suse.com/1107049 https://bugzilla.suse.com/1107097 https://bugzilla.suse.com/1107107 https://bugzilla.suse.com/1108318 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3713-1: important: Security update for apache2
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3713-1 Rating: important References: #1109961 Cross-References: CVE-2018-11763 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-11763: In Apache HTTP Server by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. (bsc#1109961) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1378=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-31.1 apache2-debuginfo-2.4.23-31.1 apache2-debugsource-2.4.23-31.1 apache2-devel-2.4.23-31.1 apache2-event-2.4.23-31.1 apache2-event-debuginfo-2.4.23-31.1 apache2-example-pages-2.4.23-31.1 apache2-prefork-2.4.23-31.1 apache2-prefork-debuginfo-2.4.23-31.1 apache2-utils-2.4.23-31.1 apache2-utils-debuginfo-2.4.23-31.1 apache2-worker-2.4.23-31.1 apache2-worker-debuginfo-2.4.23-31.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-31.1 References: https://www.suse.com/security/cve/CVE-2018-11763.html https://bugzilla.suse.com/1109961 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3710-1: moderate: Security update for accountsservice
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for accountsservice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3710-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for accountsservice fixes the following issues: This security issue was fixed: - CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699) Thsese non-security issues were fixed: - Don't abort loading users when an /etc/shadow entry is missing. (bsc#1090003) - When user session type is wayland, act_user_is_logged_in can return TRUE if the user is logged in. (bsc#1095918) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1380=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): accountsservice-0.6.45-lp150.3.3.1 accountsservice-debuginfo-0.6.45-lp150.3.3.1 accountsservice-debugsource-0.6.45-lp150.3.3.1 accountsservice-devel-0.6.45-lp150.3.3.1 libaccountsservice0-0.6.45-lp150.3.3.1 libaccountsservice0-debuginfo-0.6.45-lp150.3.3.1 typelib-1_0-AccountsService-1_0-0.6.45-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): accountsservice-lang-0.6.45-lp150.3.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3709-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3709-1 Rating: moderate References: #1092885 #1094725 #1096223 #1098735 Cross-References: CVE-2018-11806 CVE-2018-12617 CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for qemu fixes the following issues: These security issues were fixed: - CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735). - CVE-2018-11806: Prevent heap-based buffer overflow via incoming fragmented datagrams (bsc#1096223). With this release the mitigations for Spectre v4 are moved the the patches from upstream (CVE-2018-3639, bsc#1092885). This feature was added: - Add support for block resize support for disks through the monitor (bsc#1094725). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1364=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-47.1 qemu-linux-user-debuginfo-2.9.1-47.1 qemu-linux-user-debugsource-2.9.1-47.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0-47.1 qemu-seabios-1.10.2-47.1 qemu-sgabios-8-47.1 qemu-vgabios-1.10.2-47.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-47.1 qemu-arm-2.9.1-47.1 qemu-arm-debuginfo-2.9.1-47.1 qemu-block-curl-2.9.1-47.1 qemu-block-curl-debuginfo-2.9.1-47.1 qemu-block-dmg-2.9.1-47.1 qemu-block-dmg-debuginfo-2.9.1-47.1 qemu-block-iscsi-2.9.1-47.1 qemu-block-iscsi-debuginfo-2.9.1-47.1 qemu-block-rbd-2.9.1-47.1 qemu-block-rbd-debuginfo-2.9.1-47.1 qemu-block-ssh-2.9.1-47.1 qemu-block-ssh-debuginfo-2.9.1-47.1 qemu-debugsource-2.9.1-47.1 qemu-extra-2.9.1-47.1 qemu-extra-debuginfo-2.9.1-47.1 qemu-guest-agent-2.9.1-47.1 qemu-guest-agent-debuginfo-2.9.1-47.1 qemu-ksm-2.9.1-47.1 qemu-kvm-2.9.1-47.1 qemu-lang-2.9.1-47.1 qemu-ppc-2.9.1-47.1 qemu-ppc-debuginfo-2.9.1-47.1 qemu-s390-2.9.1-47.1 qemu-s390-debuginfo-2.9.1-47.1 qemu-testsuite-2.9.1-47.2 qemu-tools-2.9.1-47.1 qemu-tools-debuginfo-2.9.1-47.1 qemu-x86-2.9.1-47.1 qemu-x86-debuginfo-2.9.1-47.1 References: https://www.suse.com/security/cve/CVE-2018-11806.html https://www.suse.com/security/cve/CVE-2018-12617.html https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1092885 https://bugzilla.suse.com/1094725 https://bugzilla.suse.com/1096223 https://bugzilla.suse.com/1098735 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3706-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3706-1 Rating: moderate References: #1112758 #1113660 Cross-References: CVE-2018-16839 CVE-2018-16840 CVE-2018-16842 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes (bsc#1112758) - CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes (bsc#1112758) - CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1379=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.15.1 curl-debuginfo-7.60.0-lp150.2.15.1 curl-debugsource-7.60.0-lp150.2.15.1 curl-mini-7.60.0-lp150.2.15.1 curl-mini-debuginfo-7.60.0-lp150.2.15.1 curl-mini-debugsource-7.60.0-lp150.2.15.1 libcurl-devel-7.60.0-lp150.2.15.1 libcurl-mini-devel-7.60.0-lp150.2.15.1 libcurl4-7.60.0-lp150.2.15.1 libcurl4-debuginfo-7.60.0-lp150.2.15.1 libcurl4-mini-7.60.0-lp150.2.15.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.15.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.15.1 libcurl4-32bit-7.60.0-lp150.2.15.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2018-16839.html https://www.suse.com/security/cve/CVE-2018-16840.html https://www.suse.com/security/cve/CVE-2018-16842.html https://bugzilla.suse.com/1112758 https://bugzilla.suse.com/1113660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3703-1: moderate: Security update for python, python-base
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for python, python-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3703-1 Rating: moderate References: #1086001 #1088004 #1088009 #1109663 Cross-References: CVE-2018-1000802 CVE-2018-1060 CVE-2018-1061 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for python, python-base fixes the following issues: Security issues fixed: - CVE-2018-1000802: Prevent command injection in shutil module (make_archive function) via passage of unfiltered user input (bsc#1109663). - CVE-2018-1061: Fixed DoS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib (bsc#1088004). - CVE-2018-1060: Fixed DoS via regular expression catastrophic backtracking in apop() method in pop3lib (bsc#1088009). Bug fixes: - bsc#1086001: python tarfile uses random order. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1363=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpython2_7-1_0-2.7.13-27.9.1 libpython2_7-1_0-debuginfo-2.7.13-27.9.1 python-2.7.13-27.9.1 python-base-2.7.13-27.9.1 python-base-debuginfo-2.7.13-27.9.1 python-base-debugsource-2.7.13-27.9.1 python-curses-2.7.13-27.9.1 python-curses-debuginfo-2.7.13-27.9.1 python-debuginfo-2.7.13-27.9.1 python-debugsource-2.7.13-27.9.1 python-demo-2.7.13-27.9.1 python-devel-2.7.13-27.9.1 python-gdbm-2.7.13-27.9.1 python-gdbm-debuginfo-2.7.13-27.9.1 python-idle-2.7.13-27.9.1 python-tk-2.7.13-27.9.1 python-tk-debuginfo-2.7.13-27.9.1 python-xml-2.7.13-27.9.1 python-xml-debuginfo-2.7.13-27.9.1 - openSUSE Leap 42.3 (noarch): python-doc-2.7.13-27.9.1 python-doc-pdf-2.7.13-27.9.1 - openSUSE Leap 42.3 (x86_64): libpython2_7-1_0-32bit-2.7.13-27.9.1 libpython2_7-1_0-debuginfo-32bit-2.7.13-27.9.1 python-32bit-2.7.13-27.9.1 python-base-32bit-2.7.13-27.9.1 python-base-debuginfo-32bit-2.7.13-27.9.1 python-debuginfo-32bit-2.7.13-27.9.1 References: https://www.suse.com/security/cve/CVE-2018-1000802.html https://www.suse.com/security/cve/CVE-2018-1060.html https://www.suse.com/security/cve/CVE-2018-1061.html https://bugzilla.suse.com/1086001 https://bugzilla.suse.com/1088004 https://bugzilla.suse.com/1088009 https://bugzilla.suse.com/1109663 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3701-1: moderate: Security update for opensc
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for opensc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3701-1 Rating: moderate References: #1104812 #1106998 #1106999 #1107033 #1107034 #1107037 #1107038 #1107039 #1107097 #1107107 #1108318 Cross-References: CVE-2018-16391 CVE-2018-16392 CVE-2018-16393 CVE-2018-16418 CVE-2018-16419 CVE-2018-16420 CVE-2018-16422 CVE-2018-16423 CVE-2018-16426 CVE-2018-16427 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has one errata is now available. Description: This update for opensc fixes the following issues: - CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998) - CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999) - CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318) - CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039) - CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107) - CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097) - CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038) - CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037) - CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034) - CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1384=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): opensc-0.13.0-9.3.1 opensc-debuginfo-0.13.0-9.3.1 opensc-debugsource-0.13.0-9.3.1 References: https://www.suse.com/security/cve/CVE-2018-16391.html https://www.suse.com/security/cve/CVE-2018-16392.html https://www.suse.com/security/cve/CVE-2018-16393.html https://www.suse.com/security/cve/CVE-2018-16418.html https://www.suse.com/security/cve/CVE-2018-16419.html https://www.suse.com/security/cve/CVE-2018-16420.html https://www.suse.com/security/cve/CVE-2018-16422.html https://www.suse.com/security/cve/CVE-2018-16423.html https://www.suse.com/security/cve/CVE-2018-16426.html https://www.suse.com/security/cve/CVE-2018-16427.html https://bugzilla.suse.com/1104812 https://bugzilla.suse.com/1106998 https://bugzilla.suse.com/1106999 https://bugzilla.suse.com/1107033 https://bugzilla.suse.com/1107034 https://bugzilla.suse.com/1107037 https://bugzilla.suse.com/1107038 https://bugzilla.suse.com/1107039 https://bugzilla.suse.com/1107097 https://bugzilla.suse.com/1107107 https://bugzilla.suse.com/1108318 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3699-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3699-1 Rating: moderate References: #1112758 #1113660 Cross-References: CVE-2018-16840 CVE-2018-16842 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2018-16840: A use after free in closing SASL handles was fixed (bsc#1112758) - CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1383=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-42.1 curl-debuginfo-7.37.0-42.1 curl-debugsource-7.37.0-42.1 libcurl-devel-7.37.0-42.1 libcurl4-7.37.0-42.1 libcurl4-debuginfo-7.37.0-42.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-42.1 libcurl4-32bit-7.37.0-42.1 libcurl4-debuginfo-32bit-7.37.0-42.1 References: https://www.suse.com/security/cve/CVE-2018-16840.html https://www.suse.com/security/cve/CVE-2018-16842.html https://bugzilla.suse.com/1112758 https://bugzilla.suse.com/1113660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3696-1: Security update for ntfs-3g_ntfsprogs
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for ntfs-3g_ntfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3696-1 Rating: low References: #1022500 Cross-References: CVE-2017-0358 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ntfs-3g_ntfsprogs fixes the following issues: - CVE-2017-0358: Missing sanitization of the environment during a call to modprobe allowed local users to escalate fo root privilege (bsc#1022500) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1376=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libntfs-3g-devel-2013.1.13-7.3.1 libntfs-3g84-2013.1.13-7.3.1 libntfs-3g84-debuginfo-2013.1.13-7.3.1 ntfs-3g-2013.1.13-7.3.1 ntfs-3g-debuginfo-2013.1.13-7.3.1 ntfs-3g_ntfsprogs-debugsource-2013.1.13-7.3.1 ntfsprogs-2013.1.13-7.3.1 ntfsprogs-debuginfo-2013.1.13-7.3.1 References: https://www.suse.com/security/cve/CVE-2017-0358.html https://bugzilla.suse.com/1022500 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3695-1: important: Security update for systemd
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3695-1 Rating: important References: #1089761 #1090944 #1091677 #1093753 #1101040 #1102908 #1105031 #1107640 #1107941 #1109197 #1109252 #1110445 #1112024 #1113083 #1113632 #1113665 #1114135 #991901 Cross-References: CVE-2018-15686 CVE-2018-15688 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has 16 fixes is now available. Description: This update for systemd fixes the following issues: Security issues fixed: - CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. (bsc#1113632) - CVE-2018-15686: A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. (bsc#1113665) Non security issues fixed: - dhcp6: split assert_return() to be more debuggable when hit - core: skip unit deserialization and move to the next one when unit_deserialize() fails - core: properly handle deserialization of unknown unit types (#6476) - core: don't create Requires for workdir if "missing ok" (bsc#1113083) - logind: use manager_get_user_by_pid() where appropriate - logind: rework manager_get_{user|session}_by_pid() a bit - login: fix user@.service case, so we don't allow nested sessions (#8051) (bsc#1112024) - core: be more defensive if we can't determine per-connection socket peer (#7329) - core: introduce systemd.early_core_pattern= kernel cmdline option - core: add missing 'continue' statement - core/mount: fstype may be NULL - journald: don't ship systemd-journald-audit.socket (bsc#1109252) - core: make "tmpfs" dependencies on swapfs a "default" dep, not an "implicit" (bsc#1110445) - mount: make sure we unmount tmpfs mounts before we deactivate swaps (#7076) - detect-virt: do not try to read all of /proc/cpuinfo (bsc#1109197) - emergency: make sure console password agents don't interfere with the emergency shell - man: document that 'nofail' also has an effect on ordering - journald: take leading spaces into account in syslog_parse_identifier - journal: do not remove multiple spaces after identifier in syslog message - syslog: fix segfault in syslog_parse_priority() - journal: fix syslog_parse_identifier() - install: drop left-over debug message (#6913) - Ship systemd-sysv-install helper via the main package This script was part of systemd-sysvinit sub-package but it was wrong since systemd-sysv-install is a script used to redirect enable/disable operations to chkconfig when the unit targets are sysv init scripts. Therefore it's never been a SySV init tool. - Add udev.no-partlabel-links kernel command-line option. This option can be used to disable the generation of the by-partlabel symlinks regardless of the name used. (bsc#1089761) - man: SystemMaxUse= clarification in journald.conf(5). (bsc#1101040) - systemctl: load unit if needed in "systemctl is-active" (bsc#1102908) - core: don't freeze OnCalendar= timer units when the clock goes back a lot (bsc#1090944) - Enable or disable machines.target according to the presets (bsc#1107941) - cryptsetup: add support for sector-size= option (fate#325697) - nspawn: always use permission mode 555 for /sys (bsc#1107640) - Bugfix for a race condition between daemon-reload and other commands (bsc#1105031) - Fixes an issue where login with root credentials was not possible in init level 5 (bsc#1091677) - Fix an issue where services of type "notify" harmless DENIED log entries. (bsc#991901) - Does no longer adjust qgroups on existing subvolumes (bsc#1093753) - cryptsetup: add support for sector-size= option (#9936) (fate#325697 bsc#1114135) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1382=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsystemd0-234-lp150.20.9.1 libsystemd0-debuginfo-234-lp150.20.9.1 libsystemd0-mini-234-lp150.20.9.1 libsystemd0-mini-debuginfo-234-lp150.20.9.1 libudev-devel-234-lp150.20.9.1 libudev-mini-devel-234-lp150.20.9.1 libudev-mini1-234-lp150.20.9.1 libudev-mini1-debuginfo-234-lp150.20.9.1 libudev1-234-lp150.20.9.1 libudev1-debuginfo-234-lp150.20.9.1 nss-myhostname-234-lp150.20.9.1 nss-myhostname-debuginfo-234-lp150.20.9.1 nss-mymachines-234-lp150.20.9.1 nss-mymachines-debuginfo-234-lp150.20.9.1 nss-systemd-234-lp150.20.9.1 nss-systemd-debuginfo-234-lp150.20.9.1 systemd-234-lp150.20.9.1 systemd-container-234-lp150.20.9.1 systemd-container-debuginfo-234-lp150.20.9.1 systemd-coredump-234-lp150.20.9.1 systemd-coredump-debuginfo-234-lp150.20.9.1 systemd-debuginfo-234-lp150.20.9.1 systemd-debugsource-234-lp150.20.9.1 systemd-devel-234-lp150.20.9.1 systemd-logger-234-lp150.20.9.1 systemd-mini-234-lp150.20.9.1 systemd-mini-container-mini-234-lp150.20.9.1 systemd-mini-container-mini-debuginfo-234-lp150.20.9.1 systemd-mini-coredump-mini-234-lp150.20.9.1 systemd-mini-coredump-mini-debuginfo-234-lp150.20.9.1 systemd-mini-debuginfo-234-lp150.20.9.1 systemd-mini-debugsource-234-lp150.20.9.1 systemd-mini-devel-234-lp150.20.9.1 systemd-mini-sysvinit-234-lp150.20.9.1 systemd-sysvinit-234-lp150.20.9.1 udev-234-lp150.20.9.1 udev-debuginfo-234-lp150.20.9.1 udev-mini-234-lp150.20.9.1 udev-mini-debuginfo-234-lp150.20.9.1 - openSUSE Leap 15.0 (noarch): systemd-bash-completion-234-lp150.20.9.1 systemd-mini-bash-completion-234-lp150.20.9.1 - openSUSE Leap 15.0 (x86_64): libsystemd0-32bit-234-lp150.20.9.1 libsystemd0-32bit-debuginfo-234-lp150.20.9.1 libudev-devel-32bit-234-lp150.20.9.1 libudev1-32bit-234-lp150.20.9.1 libudev1-32bit-debuginfo-234-lp150.20.9.1 nss-myhostname-32bit-234-lp150.20.9.1 nss-myhostname-32bit-debuginfo-234-lp150.20.9.1 nss-mymachines-32bit-234-lp150.20.9.1 nss-mymachines-32bit-debuginfo-234-lp150.20.9.1 systemd-32bit-234-lp150.20.9.1 systemd-32bit-debuginfo-234-lp150.20.9.1 References: https://www.suse.com/security/cve/CVE-2018-15686.html https://www.suse.com/security/cve/CVE-2018-15688.html https://bugzilla.suse.com/1089761 https://bugzilla.suse.com/1090944 https://bugzilla.suse.com/1091677 https://bugzilla.suse.com/1093753 https://bugzilla.suse.com/1101040 https://bugzilla.suse.com/1102908 https://bugzilla.suse.com/1105031 https://bugzilla.suse.com/1107640 https://bugzilla.suse.com/1107941 https://bugzilla.suse.com/1109197 https://bugzilla.suse.com/1109252 https://bugzilla.suse.com/1110445 https://bugzilla.suse.com/1112024 https://bugzilla.suse.com/1113083 https://bugzilla.suse.com/1113632 https://bugzilla.suse.com/1113665 https://bugzilla.suse.com/1114135 https://bugzilla.suse.com/991901 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3694-1: moderate: Security update for audiofile
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for audiofile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3694-1 Rating: moderate References: #1111586 Cross-References: CVE-2018-17095 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for audiofile fixes the following issues: - CVE-2018-17095: A heap-based buffer overflow in Expand3To4Module::run could occurred when running sfconvert leading to crashes or code execution when handling untrusted soundfiles (bsc#1111586). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1375=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): audiofile-0.3.6-13.3.1 audiofile-debuginfo-0.3.6-13.3.1 audiofile-debugsource-0.3.6-13.3.1 audiofile-devel-0.3.6-13.3.1 audiofile-doc-0.3.6-13.3.1 libaudiofile1-0.3.6-13.3.1 libaudiofile1-debuginfo-0.3.6-13.3.1 - openSUSE Leap 42.3 (x86_64): audiofile-devel-32bit-0.3.6-13.3.1 libaudiofile1-32bit-0.3.6-13.3.1 libaudiofile1-debuginfo-32bit-0.3.6-13.3.1 References: https://www.suse.com/security/cve/CVE-2018-17095.html https://bugzilla.suse.com/1111586 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3692-1: important: Security update for soundtouch
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for soundtouch ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3692-1 Rating: important References: #1103676 #1108630 #1108631 #1108632 Cross-References: CVE-2018-1000223 CVE-2018-17096 CVE-2018-17097 CVE-2018-17098 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for soundtouch fixes the following issues: - CVE-2018-17098: The WavFileBase class allowed remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch. (bsc#1108632) - CVE-2018-17097: The WavFileBase class allowed remote attackers to cause a denial of service (double free) or possibly have unspecified other impact, as demonstrated by SoundStretch. (double free) (bsc#1108631) - CVE-2018-17096: The BPMDetect class allowed remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch. (bsc#1108630) - CVE-2018-1000223: soundtouch contained a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock() that can result in arbitrary code execution. This attack appear to be exploitable via victim must open maliocius file in soundstretch utility. (boo#1103676) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1361=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libSoundTouch0-1.8.0-6.3.1 libSoundTouch0-debuginfo-1.8.0-6.3.1 soundtouch-1.8.0-6.3.1 soundtouch-debuginfo-1.8.0-6.3.1 soundtouch-debugsource-1.8.0-6.3.1 soundtouch-devel-1.8.0-6.3.1 - openSUSE Leap 42.3 (x86_64): libSoundTouch0-32bit-1.8.0-6.3.1 libSoundTouch0-debuginfo-32bit-1.8.0-6.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000223.html https://www.suse.com/security/cve/CVE-2018-17096.html https://www.suse.com/security/cve/CVE-2018-17097.html https://www.suse.com/security/cve/CVE-2018-17098.html https://bugzilla.suse.com/1103676 https://bugzilla.suse.com/1108630 https://bugzilla.suse.com/1108631 https://bugzilla.suse.com/1108632 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3691-1: moderate: Security update for soundtouch
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for soundtouch ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3691-1 Rating: moderate References: #1108630 #1108631 #1108632 Cross-References: CVE-2018-17096 CVE-2018-17097 CVE-2018-17098 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for soundtouch fixes the following issues: - CVE-2018-17098: The WavFileBase class allowed remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch. (bsc#1108632) - CVE-2018-17097: The WavFileBase class allowed remote attackers to cause a denial of service (double free) or possibly have unspecified other impact, as demonstrated by SoundStretch. (double free) (bsc#1108631) - CVE-2018-17096: The BPMDetect class allowed remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch. (bsc#1108630) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1362=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libSoundTouch0-1.8.0-lp150.2.6.1 libSoundTouch0-debuginfo-1.8.0-lp150.2.6.1 soundtouch-1.8.0-lp150.2.6.1 soundtouch-debuginfo-1.8.0-lp150.2.6.1 soundtouch-debugsource-1.8.0-lp150.2.6.1 soundtouch-devel-1.8.0-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libSoundTouch0-32bit-1.8.0-lp150.2.6.1 libSoundTouch0-32bit-debuginfo-1.8.0-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-17096.html https://www.suse.com/security/cve/CVE-2018-17097.html https://www.suse.com/security/cve/CVE-2018-17098.html https://bugzilla.suse.com/1108630 https://bugzilla.suse.com/1108631 https://bugzilla.suse.com/1108632 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3690-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3690-1 Rating: moderate References: #1059100 #1059134 #1059139 Cross-References: CVE-2017-14501 CVE-2017-14502 CVE-2017-14503 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libarchive fixes the following issues: - CVE-2017-14501: An out-of-bounds read flaw existed in parse_file_info in archive_read_support_format_iso9660.c when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header. (bsc#1059139) - CVE-2017-14502: read_header in archive_read_support_format_rar.c suffered from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. (bsc#1059134) - CVE-2017-14503: libarchive suffered from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16. (bsc#1059100) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1365=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bsdtar-3.3.2-lp150.2.3.1 bsdtar-debuginfo-3.3.2-lp150.2.3.1 libarchive-debugsource-3.3.2-lp150.2.3.1 libarchive-devel-3.3.2-lp150.2.3.1 libarchive13-3.3.2-lp150.2.3.1 libarchive13-debuginfo-3.3.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libarchive13-32bit-3.3.2-lp150.2.3.1 libarchive13-32bit-debuginfo-3.3.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2017-14501.html https://www.suse.com/security/cve/CVE-2017-14502.html https://www.suse.com/security/cve/CVE-2017-14503.html https://bugzilla.suse.com/1059100 https://bugzilla.suse.com/1059134 https://bugzilla.suse.com/1059139 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3687-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3687-1 Rating: important References: #1066489 #1084603 #1098998 #1107343 #1107772 #1109363 #1109379 #1112852 Cross-References: CVE-2017-16541 CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12367 CVE-2018-12371 CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12383 CVE-2018-12385 CVE-2018-12389 CVE-2018-12390 CVE-2018-12391 CVE-2018-12392 CVE-2018-12393 CVE-2018-16541 CVE-2018-5156 CVE-2018-5187 CVE-2018-5188 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element (bsc#1098998) - CVE-2018-12360: Prevent use-after-free when using focus() (bsc#1098998) - CVE-2018-12361: Prevent integer overflow in SwizzleData (bsc#1098998) - CVE-2018-12362: Prevent integer overflow in SSSE3 scaler (bsc#1098998) - CVE-2018-5156: Prevent media recorder segmentation fault when track type is changed during capture (bsc#1098998) - CVE-2018-12363: Prevent use-after-free when appending DOM nodes (bsc#1098998) - CVE-2018-12364: Prevent CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998) - CVE-2018-12365: Prevent compromised IPC child process listing local filenames (bsc#1098998) - CVE-2018-12371: Prevent integer overflow in Skia library during edge builder allocation (bsc#1098998) - CVE-2018-12366: Prevent invalid data handling during QCMS transformations (bsc#1098998) - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998) - CVE-2018-5187: Various memory safety bugs (bsc#1098998) - CVE-2018-5188: Various memory safety bugs (bsc#1098998) - CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343) - CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343) - CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1066489) - CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (bsc#1107343) - CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (bsc#1109363) - CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343) - CVE-2018-12389: Fixed memory safety bugs (bsc#1112852) - CVE-2018-12390: Fixed memory safety bugs (bsc#1112852) - CVE-2018-12391: Fixed HTTP Live Stream audio data is accessible cross-origin (bsc#1112852) - CVE-2018-12392: Fixed crash with nested event loops (bsc#1112852) - CVE-2018-12393: Fixed integer overflow during Unicode conversion while loading JavaScript (bsc#1112852) These non-security issues were fixed: - Fix date display issues (bsc#1109379) - Fix start-up crash due to folder name with special characters (bsc#1107772) - Storing of remote content settings fixed (bsc#1084603) - Improved message handling and composing - Improved handling of message templates - Support for OAuth2 and FIDO U2F - Various Calendar improvements - Various fixes and changes to e-mail workflow - Various IMAP fixes - Native desktop notifications - various theme fixes - Shift+PageUp/PageDown in Write window - Gloda attachment filtering - Mailing list address auto-complete enter/return handling - Thunderbird hung if HTML signature references non-existent image - Filters not working for headers that appear more than once Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1360=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.3.0-74.2 MozillaThunderbird-buildsymbols-60.3.0-74.2 MozillaThunderbird-translations-common-60.3.0-74.2 MozillaThunderbird-translations-other-60.3.0-74.2 References: https://www.suse.com/security/cve/CVE-2017-16541.html https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-12376.html https://www.suse.com/security/cve/CVE-2018-12377.html https://www.suse.com/security/cve/CVE-2018-12378.html https://www.suse.com/security/cve/CVE-2018-12383.html https://www.suse.com/security/cve/CVE-2018-12385.html https://www.suse.com/security/cve/CVE-2018-12389.html https://www.suse.com/security/cve/CVE-2018-12390.html https://www.suse.com/security/cve/CVE-2018-12391.html https://www.suse.com/security/cve/CVE-2018-12392.html https://www.suse.com/security/cve/CVE-2018-12393.html https://www.suse.com/security/cve/CVE-2018-16541.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1066489 https://bugzilla.suse.com/1084603 https://bugzilla.suse.com/1098998 https://bugzilla.suse.com/1107343 https://bugzilla.suse.com/1107772 https://bugzilla.suse.com/1109363 https://bugzilla.suse.com/1109379 https://bugzilla.suse.com/1112852 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0