November 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:3951-1: moderate: Security update for rubygem-loofah
by opensuse-security＠opensuse.org 29 Nov '18

29 Nov '18

openSUSE Security Update: Security update for rubygem-loofah ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3951-1 Rating: moderate References: #1113969 Cross-References: CVE-2018-16468 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-loofah fixes the following issues: Security issue fixed: - CVE-2018-16468: Fixed XXS by removing the svg animate attribute `from` from the allowlist (bsc#1113969). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1478=1 Package List: - openSUSE Leap 15.0 (x86_64): ruby2.5-rubygem-loofah-2.2.2-lp150.3.3.1 ruby2.5-rubygem-loofah-doc-2.2.2-lp150.3.3.1 ruby2.5-rubygem-loofah-testsuite-2.2.2-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16468.html https://bugzilla.suse.com/1113969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3948-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 29 Nov '18

29 Nov '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3948-1 Rating: moderate References: #1099257 #1113094 #1113672 Cross-References: CVE-2018-12900 CVE-2018-18557 CVE-2018-18661 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257). - CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672). - CVE-2018-18557: Fixed JBIG decode can lead to out-of-bounds write (bsc#1113094). Non-security issues fixed: - asan_build: build ASAN included - debug_build: build more suitable for debugging This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1480=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libtiff-devel-4.0.9-lp150.4.9.1 libtiff5-4.0.9-lp150.4.9.1 libtiff5-debuginfo-4.0.9-lp150.4.9.1 tiff-4.0.9-lp150.4.9.1 tiff-debuginfo-4.0.9-lp150.4.9.1 tiff-debugsource-4.0.9-lp150.4.9.1 - openSUSE Leap 15.0 (x86_64): libtiff-devel-32bit-4.0.9-lp150.4.9.1 libtiff5-32bit-4.0.9-lp150.4.9.1 libtiff5-32bit-debuginfo-4.0.9-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2018-12900.html https://www.suse.com/security/cve/CVE-2018-18557.html https://www.suse.com/security/cve/CVE-2018-18661.html https://bugzilla.suse.com/1099257 https://bugzilla.suse.com/1113094 https://bugzilla.suse.com/1113672 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3947-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 29 Nov '18

29 Nov '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3947-1 Rating: moderate References: #1099257 #1113094 #1113672 Cross-References: CVE-2018-12900 CVE-2018-18557 CVE-2018-18661 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257). - CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672). - CVE-2018-18557: Fixed JBIG decode can lead to out-of-bounds write (bsc#1113094). Non-security issues fixed: - asan_build: build ASAN included - debug_build: build more suitable for debugging This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1479=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-40.1 libtiff5-4.0.9-40.1 libtiff5-debuginfo-4.0.9-40.1 tiff-4.0.9-40.1 tiff-debuginfo-4.0.9-40.1 tiff-debugsource-4.0.9-40.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-40.1 libtiff5-32bit-4.0.9-40.1 libtiff5-debuginfo-32bit-4.0.9-40.1 References: https://www.suse.com/security/cve/CVE-2018-12900.html https://www.suse.com/security/cve/CVE-2018-18557.html https://www.suse.com/security/cve/CVE-2018-18661.html https://bugzilla.suse.com/1099257 https://bugzilla.suse.com/1113094 https://bugzilla.suse.com/1113672 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3946-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 29 Nov '18

29 Nov '18

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3946-1 Rating: moderate References: #1091396 #1105010 #964336 Cross-References: CVE-2018-15473 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for openssh fixes the following issues: Following security issues have been fixed: - CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010) The following non-security issues were fixed: - Stop leaking File descriptors (bsc#964336) - sftp-client.c returns wrong error code upon failure [bsc#1091396] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1477=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): openssh-7.2p2-25.1 openssh-askpass-gnome-7.2p2-25.1 openssh-askpass-gnome-debuginfo-7.2p2-25.1 openssh-cavs-7.2p2-25.1 openssh-cavs-debuginfo-7.2p2-25.1 openssh-debuginfo-7.2p2-25.1 openssh-debugsource-7.2p2-25.1 openssh-fips-7.2p2-25.1 openssh-helpers-7.2p2-25.1 openssh-helpers-debuginfo-7.2p2-25.1 References: https://www.suse.com/security/cve/CVE-2018-15473.html https://bugzilla.suse.com/1091396 https://bugzilla.suse.com/1105010 https://bugzilla.suse.com/964336 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3906-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 24 Nov '18

24 Nov '18

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3906-1 Rating: moderate References: #1089087 #1114519 Cross-References: CVE-2018-3839 CVE-2018-3977 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Security issues fixed: - CVE-2018-3839: Fixed an exploitable code execution vulnerability that existed in the XCF image rendering functionality of the Simple DirectMedia Layer (bsc#1089087). - CVE-2018-3977: Fixed a possible code execution via creafted XCF image that could have caused a heap overflow (bsc#1114519). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1467=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libSDL2_image-2_0-0-2.0.4-bp150.3.3.1 libSDL2_image-devel-2.0.4-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libSDL2_image-2_0-0-64bit-2.0.4-bp150.3.3.1 libSDL2_image-devel-64bit-2.0.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-3839.html https://www.suse.com/security/cve/CVE-2018-3977.html https://bugzilla.suse.com/1089087 https://bugzilla.suse.com/1114519 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3903-1: moderate: Security update for openssl
by opensuse-security＠opensuse.org 24 Nov '18

24 Nov '18

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3903-1 Rating: moderate References: #1112209 #1113534 #1113652 #1113742 Cross-References: CVE-2018-0734 CVE-2018-5407 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for openssl fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - Add missing timing side channel patch for DSA signature generation (bsc#1113742). Non-security issues fixed: - Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1464=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenssl-devel-1.0.2j-32.1 libopenssl1_0_0-1.0.2j-32.1 libopenssl1_0_0-debuginfo-1.0.2j-32.1 libopenssl1_0_0-hmac-1.0.2j-32.1 openssl-1.0.2j-32.1 openssl-cavs-1.0.2j-32.1 openssl-cavs-debuginfo-1.0.2j-32.1 openssl-debuginfo-1.0.2j-32.1 openssl-debugsource-1.0.2j-32.1 - openSUSE Leap 42.3 (noarch): openssl-doc-1.0.2j-32.1 - openSUSE Leap 42.3 (x86_64): libopenssl-devel-32bit-1.0.2j-32.1 libopenssl1_0_0-32bit-1.0.2j-32.1 libopenssl1_0_0-debuginfo-32bit-1.0.2j-32.1 libopenssl1_0_0-hmac-32bit-1.0.2j-32.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1112209 https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1113742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3896-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 24 Nov '18

24 Nov '18

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3896-1 Rating: moderate References: #1089087 #1114519 Cross-References: CVE-2018-3839 CVE-2018-3977 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Security issues fixed: - CVE-2018-3839: Fixed an exploitable code execution vulnerability that existed in the XCF image rendering functionality of the Simple DirectMedia Layer (bsc#1089087). - CVE-2018-3977: Fixed a possible code execution via creafted XCF image that could have caused a heap overflow (bsc#1114519). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1466=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): SDL2_image-debugsource-2.0.4-lp150.2.3.1 libSDL2_image-2_0-0-2.0.4-lp150.2.3.1 libSDL2_image-2_0-0-debuginfo-2.0.4-lp150.2.3.1 libSDL2_image-devel-2.0.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libSDL2_image-2_0-0-32bit-2.0.4-lp150.2.3.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.4-lp150.2.3.1 libSDL2_image-devel-32bit-2.0.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-3839.html https://www.suse.com/security/cve/CVE-2018-3977.html https://bugzilla.suse.com/1089087 https://bugzilla.suse.com/1114519 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3893-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 24 Nov '18

24 Nov '18

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3893-1 Rating: moderate References: #1114837 Cross-References: CVE-2018-16850 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2018-16850: Fixed improper quoting of transition table names when pg_dump emits CREATE TRIGGER could have caused privilege escalation (bsc#1114837). Non-security issues fixed: - Update to release 10.6: * https://www.postgresql.org/docs/current/static/release-10-6.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1460=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libecpg6-10.6-5.1 libecpg6-debuginfo-10.6-5.1 libpq5-10.6-5.1 libpq5-debuginfo-10.6-5.1 postgresql10-10.6-5.1 postgresql10-contrib-10.6-5.1 postgresql10-contrib-debuginfo-10.6-5.1 postgresql10-debuginfo-10.6-5.1 postgresql10-debugsource-10.6-5.1 postgresql10-devel-10.6-5.1 postgresql10-devel-debuginfo-10.6-5.1 postgresql10-libs-debugsource-10.6-5.1 postgresql10-plperl-10.6-5.1 postgresql10-plperl-debuginfo-10.6-5.1 postgresql10-plpython-10.6-5.1 postgresql10-plpython-debuginfo-10.6-5.1 postgresql10-pltcl-10.6-5.1 postgresql10-pltcl-debuginfo-10.6-5.1 postgresql10-server-10.6-5.1 postgresql10-server-debuginfo-10.6-5.1 postgresql10-test-10.6-5.1 - openSUSE Leap 42.3 (x86_64): libecpg6-32bit-10.6-5.1 libecpg6-debuginfo-32bit-10.6-5.1 libpq5-32bit-10.6-5.1 libpq5-debuginfo-32bit-10.6-5.1 - openSUSE Leap 42.3 (noarch): postgresql10-docs-10.6-5.1 References: https://www.suse.com/security/cve/CVE-2018-16850.html https://bugzilla.suse.com/1114837 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3890-1: moderate: Security update for openssl-1_1
by opensuse-security＠opensuse.org 24 Nov '18

24 Nov '18

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3890-1 Rating: moderate References: #1113651 #1113652 Cross-References: CVE-2018-0734 CVE-2018-0735 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssl-1_1 fixes the following issues: Security issues fixed: - CVE-2018-0734: timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-0735: timing vulnerability in ECDSA signature generation (bsc#1113651). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1465=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_1-devel-1.1.0i-lp150.3.15.1 libopenssl1_1-1.1.0i-lp150.3.15.1 libopenssl1_1-debuginfo-1.1.0i-lp150.3.15.1 libopenssl1_1-hmac-1.1.0i-lp150.3.15.1 openssl-1_1-1.1.0i-lp150.3.15.1 openssl-1_1-debuginfo-1.1.0i-lp150.3.15.1 openssl-1_1-debugsource-1.1.0i-lp150.3.15.1 - openSUSE Leap 15.0 (noarch): openssl-1_1-doc-1.1.0i-lp150.3.15.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_1-devel-32bit-1.1.0i-lp150.3.15.1 libopenssl1_1-32bit-1.1.0i-lp150.3.15.1 libopenssl1_1-32bit-debuginfo-1.1.0i-lp150.3.15.1 libopenssl1_1-hmac-32bit-1.1.0i-lp150.3.15.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-0735.html https://bugzilla.suse.com/1113651 https://bugzilla.suse.com/1113652 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3886-1: important: Security update for libwpd
by opensuse-security＠opensuse.org 24 Nov '18

24 Nov '18

openSUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3886-1 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1463=1 Package List: - openSUSE Leap 15.0 (noarch): libwpd-devel-doc-0.10.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libwpd-0_10-10-0.10.2-lp150.2.3.1 libwpd-0_10-10-debuginfo-0.10.2-lp150.2.3.1 libwpd-debuginfo-0.10.2-lp150.2.3.1 libwpd-debugsource-0.10.2-lp150.2.3.1 libwpd-devel-0.10.2-lp150.2.3.1 libwpd-tools-0.10.2-lp150.2.3.1 libwpd-tools-debuginfo-0.10.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0