December 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:4313-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 29 Dec '18

29 Dec '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4313-1 Rating: moderate References: #1119790 #1119822 Cross-References: CVE-2018-20184 CVE-2018-20189 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2018-20184: Fixed heap-based buffer overflow in the WriteTGAImage function of tga.c (bsc#1119822) - CVE-2018-20189: Fixed denial of service vulnerability in ReadDIBImage function of coders/dib.c (bsc#1119790) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1632=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-120.1 GraphicsMagick-debuginfo-1.3.25-120.1 GraphicsMagick-debugsource-1.3.25-120.1 GraphicsMagick-devel-1.3.25-120.1 libGraphicsMagick++-Q16-12-1.3.25-120.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-120.1 libGraphicsMagick++-devel-1.3.25-120.1 libGraphicsMagick-Q16-3-1.3.25-120.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-120.1 libGraphicsMagick3-config-1.3.25-120.1 libGraphicsMagickWand-Q16-2-1.3.25-120.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-120.1 perl-GraphicsMagick-1.3.25-120.1 perl-GraphicsMagick-debuginfo-1.3.25-120.1 References: https://www.suse.com/security/cve/CVE-2018-20184.html https://www.suse.com/security/cve/CVE-2018-20189.html https://bugzilla.suse.com/1119790 https://bugzilla.suse.com/1119822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4307-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 29 Dec '18

29 Dec '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4307-1 Rating: moderate References: #1117740 Cross-References: CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Update to Wireshark 2.4.11 (bsc#1117740). Security issues fixed: - CVE-2018-19625: The Wireshark dissection engine could crash (wnpa-sec-2018-51) - CVE-2018-19626: The DCOM dissector could crash (wnpa-sec-2018-52) - CVE-2018-19623: The LBMPDM dissector could crash (wnpa-sec-2018-53) - CVE-2018-19622: The MMSE dissector could go into an infinite loop (wnpa-sec-2018-54) - CVE-2018-19627: The IxVeriWave file parser could crash (wnpa-sec-2018-55) - CVE-2018-19624: The PVFS dissector could crash (wnpa-sec-2018-56) Further bug fixes and updated protocol support as listed in: - https://www.wireshark.org/docs/relnotes/wireshark-2.4.11.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1620=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.11-lp150.2.16.1 libwireshark9-debuginfo-2.4.11-lp150.2.16.1 libwiretap7-2.4.11-lp150.2.16.1 libwiretap7-debuginfo-2.4.11-lp150.2.16.1 libwscodecs1-2.4.11-lp150.2.16.1 libwscodecs1-debuginfo-2.4.11-lp150.2.16.1 libwsutil8-2.4.11-lp150.2.16.1 libwsutil8-debuginfo-2.4.11-lp150.2.16.1 wireshark-2.4.11-lp150.2.16.1 wireshark-debuginfo-2.4.11-lp150.2.16.1 wireshark-debugsource-2.4.11-lp150.2.16.1 wireshark-devel-2.4.11-lp150.2.16.1 wireshark-ui-qt-2.4.11-lp150.2.16.1 wireshark-ui-qt-debuginfo-2.4.11-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2018-19622.html https://www.suse.com/security/cve/CVE-2018-19623.html https://www.suse.com/security/cve/CVE-2018-19624.html https://www.suse.com/security/cve/CVE-2018-19625.html https://www.suse.com/security/cve/CVE-2018-19626.html https://www.suse.com/security/cve/CVE-2018-19627.html https://bugzilla.suse.com/1117740 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4306-1: important: Security update for containerd, docker and go
by opensuse-security＠opensuse.org 29 Dec '18

29 Dec '18

openSUSE Security Update: Security update for containerd, docker and go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4306-1 Rating: important References: #1047218 #1074971 #1080978 #1081495 #1084533 #1086185 #1094680 #1095817 #1098017 #1102522 #1104821 #1105000 #1108038 #1113313 #1113978 #1114209 #1118897 #1118898 #1118899 #1119634 #1119706 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2018-7187 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has 17 fixes is now available. Description: This update for containerd, docker and go fixes the following issues: containerd and docker: - Add backport for building containerd (bsc#1102522, bsc#1113313) - Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. (bsc#1102522) - Enable seccomp support (fate#325877) - Update to containerd v1.1.1, which is the required version for the Docker v18.06.0-ce upgrade. (bsc#1102522) - Put containerd under the podruntime slice (bsc#1086185) - 3rd party registries used the default Docker certificate (bsc#1084533) - Handle build breakage due to missing 'export GOPATH' (caused by resolution of boo#1119634). I believe Docker is one of the only packages with this problem. go: - golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187) - Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634) - Fix a regression that broke go get for import path patterns containing "..." (bsc#1119706) Additionally, the package go1.10 has been added. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1626=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): go-1.10.4-lp150.2.7.1 go-doc-1.10.4-lp150.2.7.1 - openSUSE Leap 15.0 (x86_64): containerd-1.1.2-lp150.4.3.1 containerd-ctr-1.1.2-lp150.4.3.1 containerd-kubic-1.1.2-lp150.4.3.1 containerd-kubic-ctr-1.1.2-lp150.4.3.1 docker-18.06.1_ce-lp150.5.6.1 docker-debuginfo-18.06.1_ce-lp150.5.6.1 docker-debugsource-18.06.1_ce-lp150.5.6.1 docker-kubic-18.06.1_ce-lp150.5.6.1 docker-kubic-debuginfo-18.06.1_ce-lp150.5.6.1 docker-kubic-debugsource-18.06.1_ce-lp150.5.6.1 docker-kubic-test-18.06.1_ce-lp150.5.6.1 docker-kubic-test-debuginfo-18.06.1_ce-lp150.5.6.1 docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1 docker-libnetwork-kubic-0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1 docker-libnetwork-kubic-debuginfo-0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1 docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1 docker-runc-kubic-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1 docker-runc-kubic-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1 docker-test-18.06.1_ce-lp150.5.6.1 docker-test-debuginfo-18.06.1_ce-lp150.5.6.1 go-race-1.10.4-lp150.2.7.1 go1.10-1.10.7-lp150.2.1 go1.10-doc-1.10.7-lp150.2.1 go1.10-race-1.10.7-lp150.2.1 golang-github-docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1 golang-github-docker-libnetwork-kubic-0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): containerd-kubic-test-1.1.2-lp150.4.3.1 containerd-test-1.1.2-lp150.4.3.1 docker-bash-completion-18.06.1_ce-lp150.5.6.1 docker-kubic-bash-completion-18.06.1_ce-lp150.5.6.1 docker-kubic-zsh-completion-18.06.1_ce-lp150.5.6.1 docker-runc-kubic-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1 docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1 docker-zsh-completion-18.06.1_ce-lp150.5.6.1 golang-packaging-15.0.11-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2018-7187.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1074971 https://bugzilla.suse.com/1080978 https://bugzilla.suse.com/1081495 https://bugzilla.suse.com/1084533 https://bugzilla.suse.com/1086185 https://bugzilla.suse.com/1094680 https://bugzilla.suse.com/1095817 https://bugzilla.suse.com/1098017 https://bugzilla.suse.com/1102522 https://bugzilla.suse.com/1104821 https://bugzilla.suse.com/1105000 https://bugzilla.suse.com/1108038 https://bugzilla.suse.com/1113313 https://bugzilla.suse.com/1113978 https://bugzilla.suse.com/1114209 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1119706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4304-1: important: Security update for xen
by opensuse-security＠opensuse.org 29 Dec '18

29 Dec '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4304-1 Rating: important References: #1027519 #1078292 #1091107 #1094508 #1103275 #1103276 #1103279 #1105528 #1108940 #1114405 #1115040 #1115045 #1115047 Cross-References: CVE-2018-15468 CVE-2018-15469 CVE-2018-15470 CVE-2018-18883 CVE-2018-19961 CVE-2018-19962 CVE-2018-19965 CVE-2018-19966 CVE-2018-3646 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has four fixes is now available. Description: This update for xen fixes the following issues: Update to Xen 4.10.2 bug fix release (bsc#1027519). Security vulnerabilities fixed: - CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service (DoS) affecting the entire host, or may be able to access data it is not supposed to access. (XSA-275) (bsc#1115040) - CVE-2018-19965: Fixed an issue related to the INVPCID instruction in case non-canonical addresses are accessed, which may allow a guest to cause Xen to crash, resulting in a Denial of Service (DoS) affecting the entire host. (XSA-279) (bsc#1115045) - CVE-2018-19966: Fixed an issue related to a previous fix for XSA-240, which conflicted with shadow paging and allowed a guest to cause Xen to crash, resulting in a Denial of Service (DoS). (XSA-280) (bsc#1115047) - CVE-2018-18883: Fixed an issue related to inproper restriction of nested VT-x, which allowed a guest to cause Xen to crash, resulting in a Denial of Service (DoS). (XSA-278) (bsc#1114405) - CVE-2018-15468: Fixed incorrect MSR_DEBUGCTL handling, which allowed guests to enable Branch Trace Store and may cause a Denial of Service (DoS) of the entire host. (XSA-269) (bsc#1103276) - CVE-2018-15469: Fixed use of v2 grant tables on ARM, which were not properly implemented and may cause a Denial of Service (DoS). (XSA-268) (bsc#1103275) - CVE-2018-15470: Fixed an issue in the logic in oxenstored for handling writes, which allowed a guest to write memory unbounded leading to system-wide Denial of Service (DoS). (XSA-272) (bsc#1103279) - CVE-2018-3646: Mitigations for VMM aspects of L1 Terminal Fault (XSA-273) (bsc#1091107) Other bugs fixed: - Fixed an issue related to a domU hang on SLE12-SP3 HV (bsc#1108940) - Fixed an issue with xpti=no-dom0 not working as expected (bsc#1105528) - Fixed a kernel oops related to fs/dcache.c called by d_materialise_unique() (bsc#1094508) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1624=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xen-debugsource-4.10.2_04-lp150.2.12.1 xen-devel-4.10.2_04-lp150.2.12.1 xen-libs-4.10.2_04-lp150.2.12.1 xen-libs-debuginfo-4.10.2_04-lp150.2.12.1 xen-tools-domU-4.10.2_04-lp150.2.12.1 xen-tools-domU-debuginfo-4.10.2_04-lp150.2.12.1 - openSUSE Leap 15.0 (x86_64): xen-4.10.2_04-lp150.2.12.1 xen-doc-html-4.10.2_04-lp150.2.12.1 xen-libs-32bit-4.10.2_04-lp150.2.12.1 xen-libs-32bit-debuginfo-4.10.2_04-lp150.2.12.1 xen-tools-4.10.2_04-lp150.2.12.1 xen-tools-debuginfo-4.10.2_04-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-15468.html https://www.suse.com/security/cve/CVE-2018-15469.html https://www.suse.com/security/cve/CVE-2018-15470.html https://www.suse.com/security/cve/CVE-2018-18883.html https://www.suse.com/security/cve/CVE-2018-19961.html https://www.suse.com/security/cve/CVE-2018-19962.html https://www.suse.com/security/cve/CVE-2018-19965.html https://www.suse.com/security/cve/CVE-2018-19966.html https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1078292 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1094508 https://bugzilla.suse.com/1103275 https://bugzilla.suse.com/1103276 https://bugzilla.suse.com/1103279 https://bugzilla.suse.com/1105528 https://bugzilla.suse.com/1108940 https://bugzilla.suse.com/1114405 https://bugzilla.suse.com/1115040 https://bugzilla.suse.com/1115045 https://bugzilla.suse.com/1115047 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4302-1: important: Security update for go
by opensuse-security＠opensuse.org 29 Dec '18

29 Dec '18

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4302-1 Rating: important References: #1081495 #1119634 #1119706 Cross-References: CVE-2018-7187 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for go fixes the following issues: - golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187) - Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634) - Fix a regression that broke go get for import path patterns containing "..." (bsc#1119706) Additionally, the package go1.10 has been added. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1625=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): go-1.10.4-bp150.2.3.1 go-doc-1.10.4-bp150.2.3.1 go1.10-1.10.7-bp150.2.1 go1.10-doc-1.10.7-bp150.2.1 - openSUSE Backports SLE-15 (x86_64): go-race-1.10.4-bp150.2.3.1 go1.10-race-1.10.7-bp150.2.1 - openSUSE Backports SLE-15 (noarch): golang-packaging-15.0.11-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-7187.html https://bugzilla.suse.com/1081495 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1119706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4299-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 28 Dec '18

28 Dec '18

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4299-1 Rating: moderate References: #1097973 #1097974 #1097975 #1118894 Cross-References: CVE-2018-5804 CVE-2018-5805 CVE-2018-5806 CVE-2018-5808 CVE-2018-5816 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libraw fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-5804: Fixed a type confusion error within the identify function that could trigger a division by zero, leading to a denial of service (Dos). (boo#1097975) - CVE-2018-5805: Fixed a boundary error within the quicktake_100_load_raw function that could cause a stack-based buffer overflow and subsequently trigger a crash. (boo#1097973) - CVE-2018-5806: Fixed an error within the leaf_hdr_load_raw function that could trigger a NULL pointer deference, leading to a denial of service (DoS). (boo#1097974) - CVE-2018-5808: Fixed an error within the find_green function that could cause a stack-based buffer overflow and subsequently execute arbitrary code. (boo#1118894) - CVE-2018-5816: Fixed a type confusion error within the identify function that could trigger a division by zero, leading to a denial of service (DoS). (boo#1097975) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1619=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-26.1 libraw-devel-0.17.1-26.1 libraw-devel-static-0.17.1-26.1 libraw-tools-0.17.1-26.1 libraw-tools-debuginfo-0.17.1-26.1 libraw15-0.17.1-26.1 libraw15-debuginfo-0.17.1-26.1 References: https://www.suse.com/security/cve/CVE-2018-5804.html https://www.suse.com/security/cve/CVE-2018-5805.html https://www.suse.com/security/cve/CVE-2018-5806.html https://www.suse.com/security/cve/CVE-2018-5808.html https://www.suse.com/security/cve/CVE-2018-5816.html https://bugzilla.suse.com/1097973 https://bugzilla.suse.com/1097974 https://bugzilla.suse.com/1097975 https://bugzilla.suse.com/1118894 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4287-1: important: Security update for netatalk
by opensuse-security＠opensuse.org 28 Dec '18

28 Dec '18

openSUSE Security Update: Security update for netatalk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4287-1 Rating: important References: #1119540 Cross-References: CVE-2018-1160 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for netatalk fixes the following issues: Security issue fixed: - CVE-2018-1160 Fixed a missing bounds check in the handling of the DSI OPEN SESSION request, which allowed an unauthenticated to overwrite memory with data of their choice leading for arbitrary code execution with root privileges. (bsc#1119540) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1614=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libatalk16-3.1.7-8.3.1 libatalk16-debuginfo-3.1.7-8.3.1 netatalk-3.1.7-8.3.1 netatalk-debuginfo-3.1.7-8.3.1 netatalk-debugsource-3.1.7-8.3.1 netatalk-devel-3.1.7-8.3.1 References: https://www.suse.com/security/cve/CVE-2018-1160.html https://bugzilla.suse.com/1119540 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4283-1: moderate: Security update for mozilla-nspr and mozilla-nss
by opensuse-security＠opensuse.org 28 Dec '18

28 Dec '18

openSUSE Security Update: Security update for mozilla-nspr and mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4283-1 Rating: moderate References: #1097410 #1119105 Cross-References: CVE-2018-0495 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mozilla-nss and mozilla-nspr fixes the following issues: Issues fixed in mozilla-nss: - Update to NSS 3.40.1 (bsc#1119105) - CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069) - CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873) - CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410) - Fixed a decryption failure during FFDHE key exchange - Various security fixes in the ASN.1 code Issues fixed in mozilla-nspr: - Update mozilla-nspr to 4.20 (bsc#1119105) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1618=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.40.1-lp150.2.10.2 libfreebl3-debuginfo-3.40.1-lp150.2.10.2 libsoftokn3-3.40.1-lp150.2.10.2 libsoftokn3-debuginfo-3.40.1-lp150.2.10.2 mozilla-nspr-4.20-lp150.2.3.1 mozilla-nspr-debuginfo-4.20-lp150.2.3.1 mozilla-nspr-debugsource-4.20-lp150.2.3.1 mozilla-nspr-devel-4.20-lp150.2.3.1 mozilla-nss-3.40.1-lp150.2.10.2 mozilla-nss-certs-3.40.1-lp150.2.10.2 mozilla-nss-certs-debuginfo-3.40.1-lp150.2.10.2 mozilla-nss-debuginfo-3.40.1-lp150.2.10.2 mozilla-nss-debugsource-3.40.1-lp150.2.10.2 mozilla-nss-devel-3.40.1-lp150.2.10.2 mozilla-nss-sysinit-3.40.1-lp150.2.10.2 mozilla-nss-sysinit-debuginfo-3.40.1-lp150.2.10.2 mozilla-nss-tools-3.40.1-lp150.2.10.2 mozilla-nss-tools-debuginfo-3.40.1-lp150.2.10.2 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.40.1-lp150.2.10.2 libfreebl3-32bit-debuginfo-3.40.1-lp150.2.10.2 libsoftokn3-32bit-3.40.1-lp150.2.10.2 libsoftokn3-32bit-debuginfo-3.40.1-lp150.2.10.2 mozilla-nspr-32bit-4.20-lp150.2.3.1 mozilla-nspr-32bit-debuginfo-4.20-lp150.2.3.1 mozilla-nss-32bit-3.40.1-lp150.2.10.2 mozilla-nss-32bit-debuginfo-3.40.1-lp150.2.10.2 mozilla-nss-certs-32bit-3.40.1-lp150.2.10.2 mozilla-nss-certs-32bit-debuginfo-3.40.1-lp150.2.10.2 mozilla-nss-sysinit-32bit-3.40.1-lp150.2.10.2 mozilla-nss-sysinit-32bit-debuginfo-3.40.1-lp150.2.10.2 References: https://www.suse.com/security/cve/CVE-2018-0495.html https://bugzilla.suse.com/1097410 https://bugzilla.suse.com/1119105 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4282-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 28 Dec '18

28 Dec '18

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4282-1 Rating: moderate References: #1118277 Cross-References: CVE-2018-19788 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2018-19788: Fixed handling of UIDs over MAX_UINT (boo#1118277) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1617=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpolkit0-0.113-14.6.1 libpolkit0-debuginfo-0.113-14.6.1 polkit-0.113-14.6.1 polkit-debuginfo-0.113-14.6.1 polkit-debugsource-0.113-14.6.1 polkit-devel-0.113-14.6.1 polkit-devel-debuginfo-0.113-14.6.1 typelib-1_0-Polkit-1_0-0.113-14.6.1 - openSUSE Leap 42.3 (noarch): polkit-doc-0.113-14.6.1 - openSUSE Leap 42.3 (x86_64): libpolkit0-32bit-0.113-14.6.1 libpolkit0-debuginfo-32bit-0.113-14.6.1 References: https://www.suse.com/security/cve/CVE-2018-19788.html https://bugzilla.suse.com/1118277 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4272-1: important: Security update for yast2-rmt
by opensuse-security＠opensuse.org 23 Dec '18

23 Dec '18

openSUSE Security Update: Security update for yast2-rmt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4272-1 Rating: important References: #1117602 Cross-References: CVE-2018-17957 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for yast2-rmt to version 1.1.12 fixes the following issues: Security issue fixed: - CVE-2018-17957: Secure MySQL credentials by not exposing them on the command line (bsc#1117602) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1604=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-rmt-1.1.2-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-17957.html https://bugzilla.suse.com/1117602 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4262-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4262-1 Rating: moderate References: #1114157 Cross-References: CVE-2018-10851 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1594=1 Package List: - openSUSE Leap 42.3 (x86_64): pdns-4.0.3-15.2 pdns-backend-geoip-4.0.3-15.2 pdns-backend-geoip-debuginfo-4.0.3-15.2 pdns-backend-godbc-4.0.3-15.2 pdns-backend-godbc-debuginfo-4.0.3-15.2 pdns-backend-ldap-4.0.3-15.2 pdns-backend-ldap-debuginfo-4.0.3-15.2 pdns-backend-lua-4.0.3-15.2 pdns-backend-lua-debuginfo-4.0.3-15.2 pdns-backend-mydns-4.0.3-15.2 pdns-backend-mydns-debuginfo-4.0.3-15.2 pdns-backend-mysql-4.0.3-15.2 pdns-backend-mysql-debuginfo-4.0.3-15.2 pdns-backend-postgresql-4.0.3-15.2 pdns-backend-postgresql-debuginfo-4.0.3-15.2 pdns-backend-remote-4.0.3-15.2 pdns-backend-remote-debuginfo-4.0.3-15.2 pdns-backend-sqlite3-4.0.3-15.2 pdns-backend-sqlite3-debuginfo-4.0.3-15.2 pdns-debuginfo-4.0.3-15.2 pdns-debugsource-4.0.3-15.2 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://bugzilla.suse.com/1114157 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4261-1: moderate: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4261-1 Rating: moderate References: #1118595 #1118596 Cross-References: CVE-2018-15518 CVE-2018-19873 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libqt5-qtbase fixes the following issues: Security issues fixed: - CVE-2018-15518: Fixed double free in QXmlStreamReader (bsc#1118595) - CVE-2018-19873: Fixed Denial of Service on malformed BMP file in QBmpHandler (bsc#1118596) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1592=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libQt5Bootstrap-devel-static-5.6.2-7.6.1 libQt5Concurrent-devel-5.6.2-7.6.1 libQt5Concurrent5-5.6.2-7.6.1 libQt5Concurrent5-debuginfo-5.6.2-7.6.1 libQt5Core-devel-5.6.2-7.6.1 libQt5Core5-5.6.2-7.6.1 libQt5Core5-debuginfo-5.6.2-7.6.1 libQt5DBus-devel-5.6.2-7.6.1 libQt5DBus-devel-debuginfo-5.6.2-7.6.1 libQt5DBus5-5.6.2-7.6.1 libQt5DBus5-debuginfo-5.6.2-7.6.1 libQt5Gui-devel-5.6.2-7.6.1 libQt5Gui5-5.6.2-7.6.1 libQt5Gui5-debuginfo-5.6.2-7.6.1 libQt5Network-devel-5.6.2-7.6.1 libQt5Network5-5.6.2-7.6.1 libQt5Network5-debuginfo-5.6.2-7.6.1 libQt5OpenGL-devel-5.6.2-7.6.1 libQt5OpenGL5-5.6.2-7.6.1 libQt5OpenGL5-debuginfo-5.6.2-7.6.1 libQt5OpenGLExtensions-devel-static-5.6.2-7.6.1 libQt5PlatformHeaders-devel-5.6.2-7.6.1 libQt5PlatformSupport-devel-static-5.6.2-7.6.1 libQt5PrintSupport-devel-5.6.2-7.6.1 libQt5PrintSupport5-5.6.2-7.6.1 libQt5PrintSupport5-debuginfo-5.6.2-7.6.1 libQt5Sql-devel-5.6.2-7.6.1 libQt5Sql5-5.6.2-7.6.1 libQt5Sql5-debuginfo-5.6.2-7.6.1 libQt5Sql5-mysql-5.6.2-7.6.1 libQt5Sql5-mysql-debuginfo-5.6.2-7.6.1 libQt5Sql5-postgresql-5.6.2-7.6.1 libQt5Sql5-postgresql-debuginfo-5.6.2-7.6.1 libQt5Sql5-sqlite-5.6.2-7.6.1 libQt5Sql5-sqlite-debuginfo-5.6.2-7.6.1 libQt5Sql5-unixODBC-5.6.2-7.6.1 libQt5Sql5-unixODBC-debuginfo-5.6.2-7.6.1 libQt5Test-devel-5.6.2-7.6.1 libQt5Test5-5.6.2-7.6.1 libQt5Test5-debuginfo-5.6.2-7.6.1 libQt5Widgets-devel-5.6.2-7.6.1 libQt5Widgets5-5.6.2-7.6.1 libQt5Widgets5-debuginfo-5.6.2-7.6.1 libQt5Xml-devel-5.6.2-7.6.1 libQt5Xml5-5.6.2-7.6.1 libQt5Xml5-debuginfo-5.6.2-7.6.1 libqt5-qtbase-common-devel-5.6.2-7.6.1 libqt5-qtbase-common-devel-debuginfo-5.6.2-7.6.1 libqt5-qtbase-debugsource-5.6.2-7.6.1 libqt5-qtbase-devel-5.6.2-7.6.1 libqt5-qtbase-examples-5.6.2-7.6.1 libqt5-qtbase-examples-debuginfo-5.6.2-7.6.1 - openSUSE Leap 42.3 (noarch): libQt5Core-private-headers-devel-5.6.2-7.6.1 libQt5DBus-private-headers-devel-5.6.2-7.6.1 libQt5Gui-private-headers-devel-5.6.2-7.6.1 libQt5Network-private-headers-devel-5.6.2-7.6.1 libQt5OpenGL-private-headers-devel-5.6.2-7.6.1 libQt5PlatformSupport-private-headers-devel-5.6.2-7.6.1 libQt5PrintSupport-private-headers-devel-5.6.2-7.6.1 libQt5Sql-private-headers-devel-5.6.2-7.6.1 libQt5Test-private-headers-devel-5.6.2-7.6.1 libQt5Widgets-private-headers-devel-5.6.2-7.6.1 libqt5-qtbase-private-headers-devel-5.6.2-7.6.1 - openSUSE Leap 42.3 (x86_64): libQt5Bootstrap-devel-static-32bit-5.6.2-7.6.1 libQt5Concurrent-devel-32bit-5.6.2-7.6.1 libQt5Concurrent5-32bit-5.6.2-7.6.1 libQt5Concurrent5-debuginfo-32bit-5.6.2-7.6.1 libQt5Core-devel-32bit-5.6.2-7.6.1 libQt5Core5-32bit-5.6.2-7.6.1 libQt5Core5-debuginfo-32bit-5.6.2-7.6.1 libQt5DBus-devel-32bit-5.6.2-7.6.1 libQt5DBus-devel-debuginfo-32bit-5.6.2-7.6.1 libQt5DBus5-32bit-5.6.2-7.6.1 libQt5DBus5-debuginfo-32bit-5.6.2-7.6.1 libQt5Gui-devel-32bit-5.6.2-7.6.1 libQt5Gui5-32bit-5.6.2-7.6.1 libQt5Gui5-debuginfo-32bit-5.6.2-7.6.1 libQt5Network-devel-32bit-5.6.2-7.6.1 libQt5Network5-32bit-5.6.2-7.6.1 libQt5Network5-debuginfo-32bit-5.6.2-7.6.1 libQt5OpenGL-devel-32bit-5.6.2-7.6.1 libQt5OpenGL5-32bit-5.6.2-7.6.1 libQt5OpenGL5-debuginfo-32bit-5.6.2-7.6.1 libQt5OpenGLExtensions-devel-static-32bit-5.6.2-7.6.1 libQt5PlatformSupport-devel-static-32bit-5.6.2-7.6.1 libQt5PrintSupport-devel-32bit-5.6.2-7.6.1 libQt5PrintSupport5-32bit-5.6.2-7.6.1 libQt5PrintSupport5-debuginfo-32bit-5.6.2-7.6.1 libQt5Sql-devel-32bit-5.6.2-7.6.1 libQt5Sql5-32bit-5.6.2-7.6.1 libQt5Sql5-debuginfo-32bit-5.6.2-7.6.1 libQt5Sql5-mysql-32bit-5.6.2-7.6.1 libQt5Sql5-mysql-debuginfo-32bit-5.6.2-7.6.1 libQt5Sql5-postgresql-32bit-5.6.2-7.6.1 libQt5Sql5-postgresql-debuginfo-32bit-5.6.2-7.6.1 libQt5Sql5-sqlite-32bit-5.6.2-7.6.1 libQt5Sql5-sqlite-debuginfo-32bit-5.6.2-7.6.1 libQt5Sql5-unixODBC-32bit-5.6.2-7.6.1 libQt5Sql5-unixODBC-debuginfo-32bit-5.6.2-7.6.1 libQt5Test-devel-32bit-5.6.2-7.6.1 libQt5Test5-32bit-5.6.2-7.6.1 libQt5Test5-debuginfo-32bit-5.6.2-7.6.1 libQt5Widgets-devel-32bit-5.6.2-7.6.1 libQt5Widgets5-32bit-5.6.2-7.6.1 libQt5Widgets5-debuginfo-32bit-5.6.2-7.6.1 libQt5Xml-devel-32bit-5.6.2-7.6.1 libQt5Xml5-32bit-5.6.2-7.6.1 libQt5Xml5-debuginfo-32bit-5.6.2-7.6.1 libqt5-qtbase-examples-32bit-5.6.2-7.6.1 libqt5-qtbase-examples-debuginfo-32bit-5.6.2-7.6.1 References: https://www.suse.com/security/cve/CVE-2018-15518.html https://www.suse.com/security/cve/CVE-2018-19873.html https://bugzilla.suse.com/1118595 https://bugzilla.suse.com/1118596 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4260-1: moderate: Security update for libnettle
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4260-1 Rating: moderate References: #1118086 Cross-References: CVE-2018-16869 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libnettle fixes the following issues: Security issues fixed: - CVE-2018-16869: Fixed a leaky data conversion exposing a manager oracle (bsc#1118086) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1597=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libhogweed4-3.4-lp150.3.3.1 libhogweed4-debuginfo-3.4-lp150.3.3.1 libnettle-debugsource-3.4-lp150.3.3.1 libnettle-devel-3.4-lp150.3.3.1 libnettle6-3.4-lp150.3.3.1 libnettle6-debuginfo-3.4-lp150.3.3.1 nettle-3.4-lp150.3.3.1 nettle-debuginfo-3.4-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libhogweed4-32bit-3.4-lp150.3.3.1 libhogweed4-32bit-debuginfo-3.4-lp150.3.3.1 libnettle-devel-32bit-3.4-lp150.3.3.1 libnettle6-32bit-3.4-lp150.3.3.1 libnettle6-32bit-debuginfo-3.4-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16869.html https://bugzilla.suse.com/1118086 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4259-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4259-1 Rating: moderate References: #1013721 #1013732 Cross-References: CVE-2016-9800 CVE-2016-9801 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bluez fixes the following issues: Security issues fixed: - CVE-2016-9800: Fixed a buffer overflow in pin_code_reply_dump function (bsc#1013721) - CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1596=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bluez-5.48-lp150.4.6.1 bluez-cups-5.48-lp150.4.6.1 bluez-cups-debuginfo-5.48-lp150.4.6.1 bluez-debuginfo-5.48-lp150.4.6.1 bluez-debugsource-5.48-lp150.4.6.1 bluez-devel-5.48-lp150.4.6.1 bluez-test-5.48-lp150.4.6.1 bluez-test-debuginfo-5.48-lp150.4.6.1 libbluetooth3-5.48-lp150.4.6.1 libbluetooth3-debuginfo-5.48-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): bluez-devel-32bit-5.48-lp150.4.6.1 libbluetooth3-32bit-5.48-lp150.4.6.1 libbluetooth3-32bit-debuginfo-5.48-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): bluez-auto-enable-devices-5.48-lp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2016-9800.html https://www.suse.com/security/cve/CVE-2016-9801.html https://bugzilla.suse.com/1013721 https://bugzilla.suse.com/1013732 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4258-1: moderate: Security update for perl
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4258-1 Rating: moderate References: #1114674 #1114675 #1114681 #1114686 Cross-References: CVE-2018-18311 CVE-2018-18312 CVE-2018-18313 CVE-2018-18314 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for perl fixes the following issues: Secuirty issues fixed: - CVE-2018-18311: Fixed integer overflow with oversize environment (bsc#1114674). - CVE-2018-18312: Fixed heap-buffer-overflow write / reg_node overrun (bsc#1114675). - CVE-2018-18313: Fixed heap-buffer-overflow read if regex contains \0 chars (bsc#1114681). - CVE-2018-18314: Fixed heap-buffer-overflow in regex (bsc#1114686). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1595=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): perl-5.26.1-lp150.6.6.1 perl-base-5.26.1-lp150.6.6.1 perl-base-debuginfo-5.26.1-lp150.6.6.1 perl-debuginfo-5.26.1-lp150.6.6.1 perl-debugsource-5.26.1-lp150.6.6.1 - openSUSE Leap 15.0 (noarch): perl-doc-5.26.1-lp150.6.6.1 - openSUSE Leap 15.0 (x86_64): perl-32bit-5.26.1-lp150.6.6.1 perl-32bit-debuginfo-5.26.1-lp150.6.6.1 perl-base-32bit-5.26.1-lp150.6.6.1 perl-base-32bit-debuginfo-5.26.1-lp150.6.6.1 References: https://www.suse.com/security/cve/CVE-2018-18311.html https://www.suse.com/security/cve/CVE-2018-18312.html https://www.suse.com/security/cve/CVE-2018-18313.html https://www.suse.com/security/cve/CVE-2018-18314.html https://bugzilla.suse.com/1114674 https://bugzilla.suse.com/1114675 https://bugzilla.suse.com/1114681 https://bugzilla.suse.com/1114686 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4257-1: moderate: Security update for git
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4257-1 Rating: moderate References: #1117257 Cross-References: CVE-2018-19486 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: Security issue fixed: - CVE-2018-19486: Fixed git that executed commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was (bsc#1117257). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1599=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): git-2.16.4-lp150.2.9.1 git-arch-2.16.4-lp150.2.9.1 git-core-2.16.4-lp150.2.9.1 git-core-debuginfo-2.16.4-lp150.2.9.1 git-credential-gnome-keyring-2.16.4-lp150.2.9.1 git-credential-gnome-keyring-debuginfo-2.16.4-lp150.2.9.1 git-credential-libsecret-2.16.4-lp150.2.9.1 git-credential-libsecret-debuginfo-2.16.4-lp150.2.9.1 git-cvs-2.16.4-lp150.2.9.1 git-daemon-2.16.4-lp150.2.9.1 git-daemon-debuginfo-2.16.4-lp150.2.9.1 git-debuginfo-2.16.4-lp150.2.9.1 git-debugsource-2.16.4-lp150.2.9.1 git-email-2.16.4-lp150.2.9.1 git-gui-2.16.4-lp150.2.9.1 git-p4-2.16.4-lp150.2.9.1 git-svn-2.16.4-lp150.2.9.1 git-svn-debuginfo-2.16.4-lp150.2.9.1 git-web-2.16.4-lp150.2.9.1 gitk-2.16.4-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): git-doc-2.16.4-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-19486.html https://bugzilla.suse.com/1117257 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4256-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4256-1 Rating: moderate References: #1017693 #1054594 #1115717 #990460 Cross-References: CVE-2016-10092 CVE-2016-10093 CVE-2016-10094 CVE-2016-6223 CVE-2017-12944 CVE-2018-19210 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-19210: Fixed NULL pointer dereference in the TIFFWriteDirectorySec function (bsc#1115717). - CVE-2017-12944: Fixed denial of service issue in the TIFFReadDirEntryArray function (bsc#1054594). - CVE-2016-10094: Fixed heap-based buffer overflow in the _tiffWriteProc function (bsc#1017693). - CVE-2016-10093: Fixed heap-based buffer overflow in the _TIFFmemcpy function (bsc#1017693). - CVE-2016-10092: Fixed heap-based buffer overflow in the TIFFReverseBits function (bsc#1017693). - CVE-2016-6223: Fixed out-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1() (bsc#990460). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1598=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-43.1 libtiff5-4.0.9-43.1 libtiff5-debuginfo-4.0.9-43.1 tiff-4.0.9-43.1 tiff-debuginfo-4.0.9-43.1 tiff-debugsource-4.0.9-43.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-43.1 libtiff5-32bit-4.0.9-43.1 libtiff5-debuginfo-32bit-4.0.9-43.1 References: https://www.suse.com/security/cve/CVE-2016-10092.html https://www.suse.com/security/cve/CVE-2016-10093.html https://www.suse.com/security/cve/CVE-2016-10094.html https://www.suse.com/security/cve/CVE-2016-6223.html https://www.suse.com/security/cve/CVE-2017-12944.html https://www.suse.com/security/cve/CVE-2018-19210.html https://bugzilla.suse.com/1017693 https://bugzilla.suse.com/1054594 https://bugzilla.suse.com/1115717 https://bugzilla.suse.com/990460 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4255-1: important: Security update for go1.10
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for go1.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4255-1 Rating: important References: #1082409 #1098017 #1113978 #1118897 #1118898 #1118899 #1119634 #1119706 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: This update for go1.10 fixes the following issues: Security vulnerabilities fixed: - CVE-2018-16873 (bsc#1118897): cmd/go: remote command execution during "go get -u". - CVE-2018-16874 (bsc#1118898): cmd/go: directory traversal in "go get" via curly braces in import paths - CVE-2018-16875 (bsc#1118899): crypto/x509: CPU denial of service Other issues fixed: - Fix build error with PIE linker flags on ppc64le. (bsc#1113978, bsc#1098017) - Review dependencies (requires, recommends and supports) (bsc#1082409) - Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634) - Fix a regression that broke go get for import path patterns containing "..." (bsc#1119706) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1593=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): go1.10-1.10.7-5.1 go1.10-doc-1.10.7-5.1 - openSUSE Leap 42.3 (x86_64): go1.10-race-1.10.7-5.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1082409 https://bugzilla.suse.com/1098017 https://bugzilla.suse.com/1113978 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1119706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4254-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4254-1 Rating: moderate References: #1115916 #1115917 Cross-References: CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916). - CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917). - CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917). - CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1591=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-13.1 ovmf-tools-2017+git1492060560.b6d11d7c46-13.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-13.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-13.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-13.1 References: https://www.suse.com/security/cve/CVE-2017-5731.html https://www.suse.com/security/cve/CVE-2017-5732.html https://www.suse.com/security/cve/CVE-2017-5733.html https://www.suse.com/security/cve/CVE-2017-5734.html https://www.suse.com/security/cve/CVE-2017-5735.html https://www.suse.com/security/cve/CVE-2018-3613.html https://bugzilla.suse.com/1115916 https://bugzilla.suse.com/1115917 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4252-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4252-1 Rating: moderate References: #1117267 Cross-References: CVE-2018-19519 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tcpdump fixes the following security issue: - CVE-2018-19519: Fixed a stack-based buffer over-read in the print_prefix function (bsc#1117267) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1589=1 Package List: - openSUSE Leap 42.3 (x86_64): tcpdump-4.9.2-12.1 tcpdump-debuginfo-4.9.2-12.1 tcpdump-debugsource-4.9.2-12.1 References: https://www.suse.com/security/cve/CVE-2018-19519.html https://bugzilla.suse.com/1117267 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4248-1: moderate: Security update for tryton
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4248-1 Rating: moderate References: #1107771 #1117105 Cross-References: CVE-2018-19443 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for tryton to version 4.2.19 fixes the following issues (boo#1107771): Security issue fixed: - CVE-2018-19443: Fixed an information leakage by attemping to initiate an unencrypted connection, which would fail eventually, but might leak session information of the user (boo#1117105) This update also contains newer versions of tryton related packages with general bug fixes and updates: - trytond 4.2.17 - trytond_account 4.2.10 - trytond_account_invoice 4.2.7 - trytond_currency 4.2.2 - trytond_purchase 4.2.6 - trytond_purchase_request 4.2.4 - trytond_stock 4.2.8 - trytond_stock_supply 4.2.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1587=1 Package List: - openSUSE Leap 42.3 (noarch): tryton-4.2.19-28.1 trytond-4.2.17-33.1 trytond_account-4.2.10-12.1 trytond_account_invoice-4.2.7-2.3.1 trytond_currency-4.2.2-6.1 trytond_purchase-4.2.6-9.1 trytond_purchase_request-4.2.4-9.1 trytond_stock-4.2.8-12.1 trytond_stock_supply-4.2.3-2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19443.html https://bugzilla.suse.com/1107771 https://bugzilla.suse.com/1117105 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4242-1: moderate: Security update for tryton
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4242-1 Rating: moderate References: #1117105 Cross-References: CVE-2018-19443 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tryton to version 4.2.19 fixes the following issues: Security issue fixed: - CVE-2018-19443: Fixed an information leakage by attemping to initiate an unencrypted connection, which would fail eventually, but might leak session information of the user (boo#1117105) This update also contains newer versions of tryton related packages with general bug fixes and updates: - trytond 4.2.17 - trytond_account 4.2.10 - trytond_account_invoice 4.2.7 - trytond_purchase_request 4.2.4 - trytond_stock 4.2.8 - trytond_stock_supply 4.2.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1588=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1588=1 Package List: - openSUSE Leap 15.0 (noarch): tryton-4.2.19-lp150.2.10.1 trytond-4.2.17-lp150.2.15.1 trytond_account-4.2.10-lp150.2.3.1 trytond_account_invoice-4.2.7-lp150.2.3.1 trytond_purchase_request-4.2.4-lp150.2.3.1 trytond_stock-4.2.8-lp150.2.3.1 trytond_stock_supply-4.2.3-lp150.2.7.1 - openSUSE Backports SLE-15 (noarch): tryton-4.2.19-bp150.2.6.1 trytond-4.2.17-bp150.2.6.1 trytond_account-4.2.10-bp150.3.3.1 trytond_account_invoice-4.2.7-bp150.3.3.1 trytond_purchase_request-4.2.4-bp150.3.3.1 trytond_stock-4.2.8-bp150.3.3.1 trytond_stock_supply-4.2.3-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19443.html https://bugzilla.suse.com/1117105 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4240-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4240-1 Rating: moderate References: #1115916 #1115917 #1117998 Cross-References: CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916). - CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917). - CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917). - CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917). Non security issues fixed: - Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1590=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.9.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.9.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.9.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2017-5731.html https://www.suse.com/security/cve/CVE-2017-5732.html https://www.suse.com/security/cve/CVE-2017-5733.html https://www.suse.com/security/cve/CVE-2017-5734.html https://www.suse.com/security/cve/CVE-2017-5735.html https://www.suse.com/security/cve/CVE-2018-3613.html https://bugzilla.suse.com/1115916 https://bugzilla.suse.com/1115917 https://bugzilla.suse.com/1117998 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4213-1: moderate: Security update for keepalived
by opensuse-security＠opensuse.org 21 Dec '18

21 Dec '18

openSUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4213-1 Rating: moderate References: #1015141 #1069468 #949238 Cross-References: CVE-2018-19044 CVE-2018-19045 CVE-2018-19046 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for keepalived to version 2.0.10 fixes the following issues: Security issues fixed (bsc#1015141): - CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats - CVE-2018-19045: Fixed mode when creating new temporary files upon a call to PrintData or PrintStats - CVE-2018-19046: Fixed a check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats Non-security issues fixed: - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (bsc#949238) For the full list of changes refer to: http://www.keepalived.org/changelog.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1575=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): keepalived-2.0.10-6.1 References: https://www.suse.com/security/cve/CVE-2018-19044.html https://www.suse.com/security/cve/CVE-2018-19045.html https://www.suse.com/security/cve/CVE-2018-19046.html https://bugzilla.suse.com/1015141 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/949238 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4212-1: moderate: Security update for keepalived
by opensuse-security＠opensuse.org 21 Dec '18

21 Dec '18

openSUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4212-1 Rating: moderate References: #1015141 #1069468 #949238 Cross-References: CVE-2018-19044 CVE-2018-19045 CVE-2018-19046 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for keepalived to version 2.0.10 fixes the following issues: Security issues fixed (bsc#1015141): - CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats - CVE-2018-19045: Fixed mode when creating new temporary files upon a call to PrintData or PrintStats - CVE-2018-19046: Fixed a check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats Non-security issues fixed: - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (bsc#949238) For the full list of changes refer to: http://www.keepalived.org/changelog.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1575=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1575=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1575=1 Package List: - openSUSE Leap 42.3 (x86_64): keepalived-2.0.10-7.3.1 keepalived-debuginfo-2.0.10-7.3.1 keepalived-debugsource-2.0.10-7.3.1 - openSUSE Leap 15.0 (x86_64): keepalived-2.0.10-lp150.3.4.1 keepalived-debuginfo-2.0.10-lp150.3.4.1 keepalived-debugsource-2.0.10-lp150.3.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): keepalived-2.0.10-bp150.3.4.1 References: https://www.suse.com/security/cve/CVE-2018-19044.html https://www.suse.com/security/cve/CVE-2018-19045.html https://www.suse.com/security/cve/CVE-2018-19046.html https://bugzilla.suse.com/1015141 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/949238 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0