November 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:3798-1: moderate: Security update for apache-pdfbox
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for apache-pdfbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3798-1 Rating: moderate References: #1111009 Cross-References: CVE-2018-11797 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-pdfbox fixes the following security issue: - CVE-2018-11797: A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. (bsc#1111009): This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1422=1 Package List: - openSUSE Leap 15.0 (noarch): apache-pdfbox-1.8.12-lp150.4.6.1 apache-pdfbox-javadoc-1.8.12-lp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2018-11797.html https://bugzilla.suse.com/1111009 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3797-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3797-1 Rating: moderate References: #1106254 #1110746 #1111069 #1111072 Cross-References: CVE-2018-17966 CVE-2018-18016 CVE-2018-18024 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. (bsc#1111069) - CVE-2018-18016: Fixed a memory leak in WritePCXImage (bsc#1111072). - CVE-2018-17966: Fixed a memory leak in WritePDBImage (bsc#1110746). Non security issues fixed: - Fixed -morphology EdgeIn output (bsc#1106254) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1424=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.21.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.21.1 ImageMagick-debugsource-7.0.7.34-lp150.2.21.1 ImageMagick-devel-7.0.7.34-lp150.2.21.1 ImageMagick-extra-7.0.7.34-lp150.2.21.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.21.1 libMagick++-devel-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.21.1 perl-PerlMagick-7.0.7.34-lp150.2.21.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.21.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.21.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.21.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.21.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.21.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.21.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.21.1 References: https://www.suse.com/security/cve/CVE-2018-17966.html https://www.suse.com/security/cve/CVE-2018-18016.html https://www.suse.com/security/cve/CVE-2018-18024.html https://bugzilla.suse.com/1106254 https://bugzilla.suse.com/1110746 https://bugzilla.suse.com/1111069 https://bugzilla.suse.com/1111072 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3796-1: moderate: Security update for LibreOffice and dependency libraries
by opensuse-security＠opensuse.org 16 Nov '18

16 Nov '18

openSUSE Security Update: Security update for LibreOffice and dependency libraries ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3796-1 Rating: moderate References: #1050305 #1088263 #1091606 #1094779 #1095601 #1095639 #1096360 #1098891 #1104876 Cross-References: CVE-2018-10583 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update for LibreOffice, libepubgen, liblangtag, libmwaw, libnumbertext, libstaroffice, libwps, myspell-dictionaries, xmlsec1 fixes the following issues: LibreOffice was updated to 6.1.3.2 (fate#326624) and contains new features and lots of bugfixes: The full changelog can be found on: https://wiki.documentfoundation.org/ReleaseNotes/6.1 Bugfixes: - bsc#1095639 Exporting to PPTX results in vertical labels being shown horizontally - bsc#1098891 Table in PPTX misplaced and partly blue - bsc#1088263 Labels in chart change (from white and other colors) to black when saving as PPTX - bsc#1095601 Exporting to PPTX shifts arrow shapes quite a bit - Add more translations: * Belarusian * Bodo * Dogri * Frisian * Gaelic * Paraguayan_Guaran * Upper_Sorbian * Konkani * Kashmiri * Luxembourgish * Monglolian * Manipuri * Burnese * Occitan * Kinyarwanda * Santali * Sanskrit * Sindhi * Sidamo * Tatar * Uzbek * Upper Sorbian * Venetian * Amharic * Asturian * Tibetian * Bosnian * English GB * English ZA * Indonesian * Icelandic * Georgian * Khmer * Lao * Macedonian * Nepali * Oromo * Albanian * Tajik * Uyghur * Vietnamese * Kurdish - Try to build all languages see bsc#1096360 - Make sure to install the KDE5/Qt5 UI/filepicker - Try to implement safeguarding to avoid bsc#1050305 - Disable base-drivers-mysql as it needs mysqlcppcon that is only for mysql and not mariadb, causes issues bsc#1094779 * Users can still connect using jdbc/odbc - Fix java detection on machines with too many cpus - CVE-2018-10583: An information disclosure vulnerability occured when LibreOffice automatically processed and initiated an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606) libepubgen was updated to 0.1.1: - Avoid <div> inside <p> or <span>. - Avoid writin vertical-align attribute without a value. - Fix generation of invalid XHTML when there is a link starting at the beginning of a footnote. - Handle relative width for images. - Fixed layout: write chapter names to improve navigation. - Support writing mode. - Start a new HTML file at every page span in addition to the splits induced by the chosen split method. This is to ensure that specified writing mode works correctly, as it is HTML <body> attribute. liblangtag was updated to 0.6.2: - use standard function - fix leak in test libmwaw was updated to 0.3.14: - Support MS Multiplan 1.1 files libnumbertext was update to 1.0.5: - Various fixes in numerical calculations and issues reported on libreoffice tracker libstaroffice was updated to 0.0.6: - retrieve some StarMath's formula, - retrieve some charts as graphic, - retrieve some fields in sda/sdc/sdp text-boxes, - .sdw: retrieve more attachments. libwps was updated to 0.4.9: - QuattroPro: add parser to .wb3 files - Multiplan: add parser to DOS v1-v3 files - charts: try to retrieve charts in .wk*, .wq* files - QuattroPro: add parser to .wb[12] files myspell-dictionaries was updated to 20181025: - Turkish dictionary added - Updated French dictionary xmlsec1 was updated to 1.2.26: - Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation - Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1417=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libxmlsec1-1-1.2.26-lp150.2.3.1 libxmlsec1-1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-gcrypt1-1.2.26-lp150.2.3.1 libxmlsec1-gcrypt1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-gnutls1-1.2.26-lp150.2.3.1 libxmlsec1-gnutls1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-nss1-1.2.26-lp150.2.3.1 libxmlsec1-nss1-debuginfo-1.2.26-lp150.2.3.1 libxmlsec1-openssl1-1.2.26-lp150.2.3.1 libxmlsec1-openssl1-debuginfo-1.2.26-lp150.2.3.1 myspell-dictionaries-20181025-lp150.2.6.1 myspell-lightproof-en-20181025-lp150.2.6.1 myspell-lightproof-hu_HU-20181025-lp150.2.6.1 myspell-lightproof-pt_BR-20181025-lp150.2.6.1 myspell-lightproof-ru_RU-20181025-lp150.2.6.1 xmlsec1-1.2.26-lp150.2.3.1 xmlsec1-debuginfo-1.2.26-lp150.2.3.1 xmlsec1-debugsource-1.2.26-lp150.2.3.1 xmlsec1-devel-1.2.26-lp150.2.3.1 xmlsec1-gcrypt-devel-1.2.26-lp150.2.3.1 xmlsec1-gnutls-devel-1.2.26-lp150.2.3.1 xmlsec1-nss-devel-1.2.26-lp150.2.3.1 xmlsec1-openssl-devel-1.2.26-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libepubgen-devel-doc-0.1.1-lp150.2.3.1 liblangtag-doc-0.6.2-lp150.2.3.1 libmwaw-devel-doc-0.3.14-lp150.2.3.1 libreoffice-branding-upstream-6.1.3.2-lp150.2.6.2 libreoffice-gdb-pretty-printers-6.1.3.2-lp150.2.6.2 libreoffice-glade-6.1.3.2-lp150.2.6.2 libreoffice-icon-themes-6.1.3.2-lp150.2.6.2 libreoffice-l10n-af-6.1.3.2-lp150.2.6.2 libreoffice-l10n-am-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ar-6.1.3.2-lp150.2.6.2 libreoffice-l10n-as-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ast-6.1.3.2-lp150.2.6.2 libreoffice-l10n-be-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bg-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bn_IN-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-br-6.1.3.2-lp150.2.6.2 libreoffice-l10n-brx-6.1.3.2-lp150.2.6.2 libreoffice-l10n-bs-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ca-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ca_valencia-6.1.3.2-lp150.2.6.2 libreoffice-l10n-cs-6.1.3.2-lp150.2.6.2 libreoffice-l10n-cy-6.1.3.2-lp150.2.6.2 libreoffice-l10n-da-6.1.3.2-lp150.2.6.2 libreoffice-l10n-de-6.1.3.2-lp150.2.6.2 libreoffice-l10n-dgo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-dz-6.1.3.2-lp150.2.6.2 libreoffice-l10n-el-6.1.3.2-lp150.2.6.2 libreoffice-l10n-en-6.1.3.2-lp150.2.6.2 libreoffice-l10n-en_GB-6.1.3.2-lp150.2.6.2 libreoffice-l10n-en_ZA-6.1.3.2-lp150.2.6.2 libreoffice-l10n-eo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-es-6.1.3.2-lp150.2.6.2 libreoffice-l10n-et-6.1.3.2-lp150.2.6.2 libreoffice-l10n-eu-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fa-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fi-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-fy-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ga-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gd-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gu-6.1.3.2-lp150.2.6.2 libreoffice-l10n-gug-6.1.3.2-lp150.2.6.2 libreoffice-l10n-he-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hi-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hsb-6.1.3.2-lp150.2.6.2 libreoffice-l10n-hu-6.1.3.2-lp150.2.6.2 libreoffice-l10n-id-6.1.3.2-lp150.2.6.2 libreoffice-l10n-is-6.1.3.2-lp150.2.6.2 libreoffice-l10n-it-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ja-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ka-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kab-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-km-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kmr_Latn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ko-6.1.3.2-lp150.2.6.2 libreoffice-l10n-kok-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ks-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lb-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lo-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lt-6.1.3.2-lp150.2.6.2 libreoffice-l10n-lv-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mai-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ml-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mni-6.1.3.2-lp150.2.6.2 libreoffice-l10n-mr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-my-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nb-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ne-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-nso-6.1.3.2-lp150.2.6.2 libreoffice-l10n-oc-6.1.3.2-lp150.2.6.2 libreoffice-l10n-om-6.1.3.2-lp150.2.6.2 libreoffice-l10n-or-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pa-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pt_BR-6.1.3.2-lp150.2.6.2 libreoffice-l10n-pt_PT-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ro-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ru-6.1.3.2-lp150.2.6.2 libreoffice-l10n-rw-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sa_IN-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sat-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sd-6.1.3.2-lp150.2.6.2 libreoffice-l10n-si-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sid-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sl-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sq-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ss-6.1.3.2-lp150.2.6.2 libreoffice-l10n-st-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sv-6.1.3.2-lp150.2.6.2 libreoffice-l10n-sw_TZ-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ta-6.1.3.2-lp150.2.6.2 libreoffice-l10n-te-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tg-6.1.3.2-lp150.2.6.2 libreoffice-l10n-th-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tn-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tr-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ts-6.1.3.2-lp150.2.6.2 libreoffice-l10n-tt-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ug-6.1.3.2-lp150.2.6.2 libreoffice-l10n-uk-6.1.3.2-lp150.2.6.2 libreoffice-l10n-uz-6.1.3.2-lp150.2.6.2 libreoffice-l10n-ve-6.1.3.2-lp150.2.6.2 libreoffice-l10n-vec-6.1.3.2-lp150.2.6.2 libreoffice-l10n-vi-6.1.3.2-lp150.2.6.2 libreoffice-l10n-xh-6.1.3.2-lp150.2.6.2 libreoffice-l10n-zh_CN-6.1.3.2-lp150.2.6.2 libreoffice-l10n-zh_TW-6.1.3.2-lp150.2.6.2 libreoffice-l10n-zu-6.1.3.2-lp150.2.6.2 libstaroffice-devel-doc-0.0.6-lp150.2.3.1 myspell-af_NA-20181025-lp150.2.6.1 myspell-af_ZA-20181025-lp150.2.6.1 myspell-an-20181025-lp150.2.6.1 myspell-an_ES-20181025-lp150.2.6.1 myspell-ar-20181025-lp150.2.6.1 myspell-ar_AE-20181025-lp150.2.6.1 myspell-ar_BH-20181025-lp150.2.6.1 myspell-ar_DZ-20181025-lp150.2.6.1 myspell-ar_EG-20181025-lp150.2.6.1 myspell-ar_IQ-20181025-lp150.2.6.1 myspell-ar_JO-20181025-lp150.2.6.1 myspell-ar_KW-20181025-lp150.2.6.1 myspell-ar_LB-20181025-lp150.2.6.1 myspell-ar_LY-20181025-lp150.2.6.1 myspell-ar_MA-20181025-lp150.2.6.1 myspell-ar_OM-20181025-lp150.2.6.1 myspell-ar_QA-20181025-lp150.2.6.1 myspell-ar_SA-20181025-lp150.2.6.1 myspell-ar_SD-20181025-lp150.2.6.1 myspell-ar_SY-20181025-lp150.2.6.1 myspell-ar_TN-20181025-lp150.2.6.1 myspell-ar_YE-20181025-lp150.2.6.1 myspell-be_BY-20181025-lp150.2.6.1 myspell-bg_BG-20181025-lp150.2.6.1 myspell-bn_BD-20181025-lp150.2.6.1 myspell-bn_IN-20181025-lp150.2.6.1 myspell-bo-20181025-lp150.2.6.1 myspell-bo_CN-20181025-lp150.2.6.1 myspell-bo_IN-20181025-lp150.2.6.1 myspell-br_FR-20181025-lp150.2.6.1 myspell-bs-20181025-lp150.2.6.1 myspell-bs_BA-20181025-lp150.2.6.1 myspell-ca-20181025-lp150.2.6.1 myspell-ca_AD-20181025-lp150.2.6.1 myspell-ca_ES-20181025-lp150.2.6.1 myspell-ca_ES_valencia-20181025-lp150.2.6.1 myspell-ca_FR-20181025-lp150.2.6.1 myspell-ca_IT-20181025-lp150.2.6.1 myspell-cs_CZ-20181025-lp150.2.6.1 myspell-da_DK-20181025-lp150.2.6.1 myspell-de-20181025-lp150.2.6.1 myspell-de_AT-20181025-lp150.2.6.1 myspell-de_CH-20181025-lp150.2.6.1 myspell-de_DE-20181025-lp150.2.6.1 myspell-el_GR-20181025-lp150.2.6.1 myspell-en-20181025-lp150.2.6.1 myspell-en_AU-20181025-lp150.2.6.1 myspell-en_BS-20181025-lp150.2.6.1 myspell-en_BZ-20181025-lp150.2.6.1 myspell-en_CA-20181025-lp150.2.6.1 myspell-en_GB-20181025-lp150.2.6.1 myspell-en_GH-20181025-lp150.2.6.1 myspell-en_IE-20181025-lp150.2.6.1 myspell-en_IN-20181025-lp150.2.6.1 myspell-en_JM-20181025-lp150.2.6.1 myspell-en_MW-20181025-lp150.2.6.1 myspell-en_NA-20181025-lp150.2.6.1 myspell-en_NZ-20181025-lp150.2.6.1 myspell-en_PH-20181025-lp150.2.6.1 myspell-en_TT-20181025-lp150.2.6.1 myspell-en_US-20181025-lp150.2.6.1 myspell-en_ZA-20181025-lp150.2.6.1 myspell-en_ZW-20181025-lp150.2.6.1 myspell-es-20181025-lp150.2.6.1 myspell-es_AR-20181025-lp150.2.6.1 myspell-es_BO-20181025-lp150.2.6.1 myspell-es_CL-20181025-lp150.2.6.1 myspell-es_CO-20181025-lp150.2.6.1 myspell-es_CR-20181025-lp150.2.6.1 myspell-es_CU-20181025-lp150.2.6.1 myspell-es_DO-20181025-lp150.2.6.1 myspell-es_EC-20181025-lp150.2.6.1 myspell-es_ES-20181025-lp150.2.6.1 myspell-es_GT-20181025-lp150.2.6.1 myspell-es_HN-20181025-lp150.2.6.1 myspell-es_MX-20181025-lp150.2.6.1 myspell-es_NI-20181025-lp150.2.6.1 myspell-es_PA-20181025-lp150.2.6.1 myspell-es_PE-20181025-lp150.2.6.1 myspell-es_PR-20181025-lp150.2.6.1 myspell-es_PY-20181025-lp150.2.6.1 myspell-es_SV-20181025-lp150.2.6.1 myspell-es_UY-20181025-lp150.2.6.1 myspell-es_VE-20181025-lp150.2.6.1 myspell-et_EE-20181025-lp150.2.6.1 myspell-fr_BE-20181025-lp150.2.6.1 myspell-fr_CA-20181025-lp150.2.6.1 myspell-fr_CH-20181025-lp150.2.6.1 myspell-fr_FR-20181025-lp150.2.6.1 myspell-fr_LU-20181025-lp150.2.6.1 myspell-fr_MC-20181025-lp150.2.6.1 myspell-gd_GB-20181025-lp150.2.6.1 myspell-gl-20181025-lp150.2.6.1 myspell-gl_ES-20181025-lp150.2.6.1 myspell-gu_IN-20181025-lp150.2.6.1 myspell-gug-20181025-lp150.2.6.1 myspell-gug_PY-20181025-lp150.2.6.1 myspell-he_IL-20181025-lp150.2.6.1 myspell-hi_IN-20181025-lp150.2.6.1 myspell-hr_HR-20181025-lp150.2.6.1 myspell-hu_HU-20181025-lp150.2.6.1 myspell-id-20181025-lp150.2.6.1 myspell-id_ID-20181025-lp150.2.6.1 myspell-is-20181025-lp150.2.6.1 myspell-is_IS-20181025-lp150.2.6.1 myspell-it_IT-20181025-lp150.2.6.1 myspell-kmr_Latn-20181025-lp150.2.6.1 myspell-kmr_Latn_SY-20181025-lp150.2.6.1 myspell-kmr_Latn_TR-20181025-lp150.2.6.1 myspell-lo_LA-20181025-lp150.2.6.1 myspell-lt_LT-20181025-lp150.2.6.1 myspell-lv_LV-20181025-lp150.2.6.1 myspell-nb_NO-20181025-lp150.2.6.1 myspell-ne_NP-20181025-lp150.2.6.1 myspell-nl_BE-20181025-lp150.2.6.1 myspell-nl_NL-20181025-lp150.2.6.1 myspell-nn_NO-20181025-lp150.2.6.1 myspell-no-20181025-lp150.2.6.1 myspell-oc_FR-20181025-lp150.2.6.1 myspell-pl_PL-20181025-lp150.2.6.1 myspell-pt_AO-20181025-lp150.2.6.1 myspell-pt_BR-20181025-lp150.2.6.1 myspell-pt_PT-20181025-lp150.2.6.1 myspell-ro-20181025-lp150.2.6.1 myspell-ro_RO-20181025-lp150.2.6.1 myspell-ru_RU-20181025-lp150.2.6.1 myspell-si_LK-20181025-lp150.2.6.1 myspell-sk_SK-20181025-lp150.2.6.1 myspell-sl_SI-20181025-lp150.2.6.1 myspell-sq_AL-20181025-lp150.2.6.1 myspell-sr-20181025-lp150.2.6.1 myspell-sr_CS-20181025-lp150.2.6.1 myspell-sr_Latn_CS-20181025-lp150.2.6.1 myspell-sr_Latn_RS-20181025-lp150.2.6.1 myspell-sr_RS-20181025-lp150.2.6.1 myspell-sv_FI-20181025-lp150.2.6.1 myspell-sv_SE-20181025-lp150.2.6.1 myspell-sw_TZ-20181025-lp150.2.6.1 myspell-te-20181025-lp150.2.6.1 myspell-te_IN-20181025-lp150.2.6.1 myspell-th_TH-20181025-lp150.2.6.1 myspell-tr-20181025-lp150.2.6.1 myspell-tr_TR-20181025-lp150.2.6.1 myspell-uk_UA-20181025-lp150.2.6.1 myspell-vi-20181025-lp150.2.6.1 myspell-vi_VN-20181025-lp150.2.6.1 myspell-zu_ZA-20181025-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libepubgen-0_1-1-0.1.1-lp150.2.3.1 libepubgen-0_1-1-debuginfo-0.1.1-lp150.2.3.1 libepubgen-debugsource-0.1.1-lp150.2.3.1 libepubgen-devel-0.1.1-lp150.2.3.1 liblangtag-debugsource-0.6.2-lp150.2.3.1 liblangtag-devel-0.6.2-lp150.2.3.1 liblangtag1-0.6.2-lp150.2.3.1 liblangtag1-debuginfo-0.6.2-lp150.2.3.1 libmwaw-0_3-3-0.3.14-lp150.2.3.1 libmwaw-0_3-3-debuginfo-0.3.14-lp150.2.3.1 libmwaw-debuginfo-0.3.14-lp150.2.3.1 libmwaw-debugsource-0.3.14-lp150.2.3.1 libmwaw-devel-0.3.14-lp150.2.3.1 libmwaw-tools-0.3.14-lp150.2.3.1 libmwaw-tools-debuginfo-0.3.14-lp150.2.3.1 libnumbertext-1_0-0-1.0.5-lp150.2.1 libnumbertext-1_0-0-debuginfo-1.0.5-lp150.2.1 libnumbertext-data-1.0.5-lp150.2.1 libnumbertext-debuginfo-1.0.5-lp150.2.1 libnumbertext-debugsource-1.0.5-lp150.2.1 libnumbertext-devel-1.0.5-lp150.2.1 libnumbertext-tools-1.0.5-lp150.2.1 libnumbertext-tools-debuginfo-1.0.5-lp150.2.1 libreoffice-6.1.3.2-lp150.2.6.2 libreoffice-base-6.1.3.2-lp150.2.6.2 libreoffice-base-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-firebird-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-firebird-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-postgresql-6.1.3.2-lp150.2.6.2 libreoffice-base-drivers-postgresql-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-calc-6.1.3.2-lp150.2.6.2 libreoffice-calc-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-calc-extensions-6.1.3.2-lp150.2.6.2 libreoffice-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-debugsource-6.1.3.2-lp150.2.6.2 libreoffice-draw-6.1.3.2-lp150.2.6.2 libreoffice-draw-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-filters-optional-6.1.3.2-lp150.2.6.2 libreoffice-gnome-6.1.3.2-lp150.2.6.2 libreoffice-gnome-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-gtk2-6.1.3.2-lp150.2.6.2 libreoffice-gtk2-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-gtk3-6.1.3.2-lp150.2.6.2 libreoffice-gtk3-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-impress-6.1.3.2-lp150.2.6.2 libreoffice-impress-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-mailmerge-6.1.3.2-lp150.2.6.2 libreoffice-math-6.1.3.2-lp150.2.6.2 libreoffice-math-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-officebean-6.1.3.2-lp150.2.6.2 libreoffice-officebean-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-pyuno-6.1.3.2-lp150.2.6.2 libreoffice-pyuno-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-qt5-6.1.3.2-lp150.2.6.2 libreoffice-qt5-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-sdk-6.1.3.2-lp150.2.6.2 libreoffice-sdk-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-sdk-doc-6.1.3.2-lp150.2.6.2 libreoffice-writer-6.1.3.2-lp150.2.6.2 libreoffice-writer-debuginfo-6.1.3.2-lp150.2.6.2 libreoffice-writer-extensions-6.1.3.2-lp150.2.6.2 libreofficekit-6.1.3.2-lp150.2.6.2 libreofficekit-devel-6.1.3.2-lp150.2.6.2 libstaroffice-0_0-0-0.0.6-lp150.2.3.1 libstaroffice-0_0-0-debuginfo-0.0.6-lp150.2.3.1 libstaroffice-debuginfo-0.0.6-lp150.2.3.1 libstaroffice-debugsource-0.0.6-lp150.2.3.1 libstaroffice-devel-0.0.6-lp150.2.3.1 libstaroffice-tools-0.0.6-lp150.2.3.1 libstaroffice-tools-debuginfo-0.0.6-lp150.2.3.1 libwps-0_4-4-0.4.9-lp150.2.3.1 libwps-0_4-4-debuginfo-0.4.9-lp150.2.3.1 libwps-debuginfo-0.4.9-lp150.2.3.1 libwps-debugsource-0.4.9-lp150.2.3.1 libwps-devel-0.4.9-lp150.2.3.1 libwps-tools-0.4.9-lp150.2.3.1 libwps-tools-debuginfo-0.4.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10583.html https://bugzilla.suse.com/1050305 https://bugzilla.suse.com/1088263 https://bugzilla.suse.com/1091606 https://bugzilla.suse.com/1094779 https://bugzilla.suse.com/1095601 https://bugzilla.suse.com/1095639 https://bugzilla.suse.com/1096360 https://bugzilla.suse.com/1098891 https://bugzilla.suse.com/1104876 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3754-1: important: Security update for icecast
by opensuse-security＠opensuse.org 13 Nov '18

13 Nov '18

openSUSE Security Update: Security update for icecast ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3754-1 Rating: important References: #1114434 Cross-References: CVE-2018-18820 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icecast fixes the following security issues: - CVE-2018-18820: A buffer overflow in url-auth could have potentially allowed remote code execution (boo#1114434) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1395=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1395=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1395=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): icecast-2.4.2-7.3.1 icecast-debuginfo-2.4.2-7.3.1 icecast-debugsource-2.4.2-7.3.1 - openSUSE Leap 42.3 (noarch): icecast-doc-2.4.2-7.3.1 - openSUSE Leap 15.0 (noarch): icecast-doc-2.4.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): icecast-2.4.3-lp150.2.3.1 icecast-debuginfo-2.4.3-lp150.2.3.1 icecast-debugsource-2.4.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): icecast-2.4.3-bp150.3.3.1 icecast-debuginfo-2.4.3-bp150.3.3.1 icecast-debugsource-2.4.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): icecast-doc-2.4.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-18820.html https://bugzilla.suse.com/1114434 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3717-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3717-1 Rating: moderate References: #1032089 #1037008 #1037009 #1057514 #1059100 #1059134 #1059139 Cross-References: CVE-2016-10209 CVE-2016-10349 CVE-2016-10350 CVE-2017-14166 CVE-2017-14501 CVE-2017-14502 CVE-2017-14503 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libarchive fixes the following issues: - CVE-2016-10209: The archive_wstring_append_from_mbs function in archive_string.c allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file. (bsc#1032089) - CVE-2016-10349: The archive_le32dec function in archive_endian.h allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. (bsc#1037008) - CVE-2016-10350: The archive_read_format_cab_read_header function in archive_read_support_format_cab.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. (bsc#1037009) - CVE-2017-14166: libarchive allowed remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c. (bsc#1057514) - CVE-2017-14501: An out-of-bounds read flaw existed in parse_file_info in archive_read_support_format_iso9660.c when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header. (bsc#1059139) - CVE-2017-14502: read_header in archive_read_support_format_rar.c suffered from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. (bsc#1059134) - CVE-2017-14503: libarchive suffered from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16. (bsc#1059100) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1366=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): bsdtar-3.1.2-20.3.1 bsdtar-debuginfo-3.1.2-20.3.1 libarchive-debugsource-3.1.2-20.3.1 libarchive-devel-3.1.2-20.3.1 libarchive13-3.1.2-20.3.1 libarchive13-debuginfo-3.1.2-20.3.1 - openSUSE Leap 42.3 (x86_64): libarchive13-32bit-3.1.2-20.3.1 libarchive13-debuginfo-32bit-3.1.2-20.3.1 References: https://www.suse.com/security/cve/CVE-2016-10209.html https://www.suse.com/security/cve/CVE-2016-10349.html https://www.suse.com/security/cve/CVE-2016-10350.html https://www.suse.com/security/cve/CVE-2017-14166.html https://www.suse.com/security/cve/CVE-2017-14501.html https://www.suse.com/security/cve/CVE-2017-14502.html https://www.suse.com/security/cve/CVE-2017-14503.html https://bugzilla.suse.com/1032089 https://bugzilla.suse.com/1037008 https://bugzilla.suse.com/1037009 https://bugzilla.suse.com/1057514 https://bugzilla.suse.com/1059100 https://bugzilla.suse.com/1059134 https://bugzilla.suse.com/1059139 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3716-1: moderate: Security update for opensc
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for opensc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3716-1 Rating: moderate References: #1104812 #1106998 #1106999 #1107033 #1107034 #1107035 #1107036 #1107037 #1107038 #1107039 #1107049 #1107097 #1107107 #1108318 Cross-References: CVE-2018-16391 CVE-2018-16392 CVE-2018-16393 CVE-2018-16418 CVE-2018-16419 CVE-2018-16420 CVE-2018-16421 CVE-2018-16422 CVE-2018-16423 CVE-2018-16424 CVE-2018-16425 CVE-2018-16426 CVE-2018-16427 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for opensc fixes the following security issues: - CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998) - CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999) - CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318) - CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039) - CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107) - CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097) - CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049) - CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038) - CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037) - CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036) - CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035) - CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034) - CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1385=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): opensc-0.18.0-lp150.2.9.1 opensc-debuginfo-0.18.0-lp150.2.9.1 opensc-debugsource-0.18.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): opensc-32bit-0.18.0-lp150.2.9.1 opensc-32bit-debuginfo-0.18.0-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-16391.html https://www.suse.com/security/cve/CVE-2018-16392.html https://www.suse.com/security/cve/CVE-2018-16393.html https://www.suse.com/security/cve/CVE-2018-16418.html https://www.suse.com/security/cve/CVE-2018-16419.html https://www.suse.com/security/cve/CVE-2018-16420.html https://www.suse.com/security/cve/CVE-2018-16421.html https://www.suse.com/security/cve/CVE-2018-16422.html https://www.suse.com/security/cve/CVE-2018-16423.html https://www.suse.com/security/cve/CVE-2018-16424.html https://www.suse.com/security/cve/CVE-2018-16425.html https://www.suse.com/security/cve/CVE-2018-16426.html https://www.suse.com/security/cve/CVE-2018-16427.html https://bugzilla.suse.com/1104812 https://bugzilla.suse.com/1106998 https://bugzilla.suse.com/1106999 https://bugzilla.suse.com/1107033 https://bugzilla.suse.com/1107034 https://bugzilla.suse.com/1107035 https://bugzilla.suse.com/1107036 https://bugzilla.suse.com/1107037 https://bugzilla.suse.com/1107038 https://bugzilla.suse.com/1107039 https://bugzilla.suse.com/1107049 https://bugzilla.suse.com/1107097 https://bugzilla.suse.com/1107107 https://bugzilla.suse.com/1108318 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3713-1: important: Security update for apache2
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3713-1 Rating: important References: #1109961 Cross-References: CVE-2018-11763 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-11763: In Apache HTTP Server by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. (bsc#1109961) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1378=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-31.1 apache2-debuginfo-2.4.23-31.1 apache2-debugsource-2.4.23-31.1 apache2-devel-2.4.23-31.1 apache2-event-2.4.23-31.1 apache2-event-debuginfo-2.4.23-31.1 apache2-example-pages-2.4.23-31.1 apache2-prefork-2.4.23-31.1 apache2-prefork-debuginfo-2.4.23-31.1 apache2-utils-2.4.23-31.1 apache2-utils-debuginfo-2.4.23-31.1 apache2-worker-2.4.23-31.1 apache2-worker-debuginfo-2.4.23-31.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-31.1 References: https://www.suse.com/security/cve/CVE-2018-11763.html https://bugzilla.suse.com/1109961 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3710-1: moderate: Security update for accountsservice
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for accountsservice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3710-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for accountsservice fixes the following issues: This security issue was fixed: - CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699) Thsese non-security issues were fixed: - Don't abort loading users when an /etc/shadow entry is missing. (bsc#1090003) - When user session type is wayland, act_user_is_logged_in can return TRUE if the user is logged in. (bsc#1095918) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1380=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): accountsservice-0.6.45-lp150.3.3.1 accountsservice-debuginfo-0.6.45-lp150.3.3.1 accountsservice-debugsource-0.6.45-lp150.3.3.1 accountsservice-devel-0.6.45-lp150.3.3.1 libaccountsservice0-0.6.45-lp150.3.3.1 libaccountsservice0-debuginfo-0.6.45-lp150.3.3.1 typelib-1_0-AccountsService-1_0-0.6.45-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): accountsservice-lang-0.6.45-lp150.3.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3709-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3709-1 Rating: moderate References: #1092885 #1094725 #1096223 #1098735 Cross-References: CVE-2018-11806 CVE-2018-12617 CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for qemu fixes the following issues: These security issues were fixed: - CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735). - CVE-2018-11806: Prevent heap-based buffer overflow via incoming fragmented datagrams (bsc#1096223). With this release the mitigations for Spectre v4 are moved the the patches from upstream (CVE-2018-3639, bsc#1092885). This feature was added: - Add support for block resize support for disks through the monitor (bsc#1094725). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1364=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-47.1 qemu-linux-user-debuginfo-2.9.1-47.1 qemu-linux-user-debugsource-2.9.1-47.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0-47.1 qemu-seabios-1.10.2-47.1 qemu-sgabios-8-47.1 qemu-vgabios-1.10.2-47.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-47.1 qemu-arm-2.9.1-47.1 qemu-arm-debuginfo-2.9.1-47.1 qemu-block-curl-2.9.1-47.1 qemu-block-curl-debuginfo-2.9.1-47.1 qemu-block-dmg-2.9.1-47.1 qemu-block-dmg-debuginfo-2.9.1-47.1 qemu-block-iscsi-2.9.1-47.1 qemu-block-iscsi-debuginfo-2.9.1-47.1 qemu-block-rbd-2.9.1-47.1 qemu-block-rbd-debuginfo-2.9.1-47.1 qemu-block-ssh-2.9.1-47.1 qemu-block-ssh-debuginfo-2.9.1-47.1 qemu-debugsource-2.9.1-47.1 qemu-extra-2.9.1-47.1 qemu-extra-debuginfo-2.9.1-47.1 qemu-guest-agent-2.9.1-47.1 qemu-guest-agent-debuginfo-2.9.1-47.1 qemu-ksm-2.9.1-47.1 qemu-kvm-2.9.1-47.1 qemu-lang-2.9.1-47.1 qemu-ppc-2.9.1-47.1 qemu-ppc-debuginfo-2.9.1-47.1 qemu-s390-2.9.1-47.1 qemu-s390-debuginfo-2.9.1-47.1 qemu-testsuite-2.9.1-47.2 qemu-tools-2.9.1-47.1 qemu-tools-debuginfo-2.9.1-47.1 qemu-x86-2.9.1-47.1 qemu-x86-debuginfo-2.9.1-47.1 References: https://www.suse.com/security/cve/CVE-2018-11806.html https://www.suse.com/security/cve/CVE-2018-12617.html https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1092885 https://bugzilla.suse.com/1094725 https://bugzilla.suse.com/1096223 https://bugzilla.suse.com/1098735 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3706-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 09 Nov '18

09 Nov '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3706-1 Rating: moderate References: #1112758 #1113660 Cross-References: CVE-2018-16839 CVE-2018-16840 CVE-2018-16842 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes (bsc#1112758) - CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes (bsc#1112758) - CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1379=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.15.1 curl-debuginfo-7.60.0-lp150.2.15.1 curl-debugsource-7.60.0-lp150.2.15.1 curl-mini-7.60.0-lp150.2.15.1 curl-mini-debuginfo-7.60.0-lp150.2.15.1 curl-mini-debugsource-7.60.0-lp150.2.15.1 libcurl-devel-7.60.0-lp150.2.15.1 libcurl-mini-devel-7.60.0-lp150.2.15.1 libcurl4-7.60.0-lp150.2.15.1 libcurl4-debuginfo-7.60.0-lp150.2.15.1 libcurl4-mini-7.60.0-lp150.2.15.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.15.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.15.1 libcurl4-32bit-7.60.0-lp150.2.15.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2018-16839.html https://www.suse.com/security/cve/CVE-2018-16840.html https://www.suse.com/security/cve/CVE-2018-16842.html https://bugzilla.suse.com/1112758 https://bugzilla.suse.com/1113660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0