December 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:4105-1: important: Security update for cups
by opensuse-security＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4105-1 Rating: important References: #1115750 Cross-References: CVE-2018-4700 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cups fixes the following issues: Security issue fixed: - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1539=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cups-2.2.7-lp150.2.6.1 cups-client-2.2.7-lp150.2.6.1 cups-client-debuginfo-2.2.7-lp150.2.6.1 cups-config-2.2.7-lp150.2.6.1 cups-ddk-2.2.7-lp150.2.6.1 cups-ddk-debuginfo-2.2.7-lp150.2.6.1 cups-debuginfo-2.2.7-lp150.2.6.1 cups-debugsource-2.2.7-lp150.2.6.1 cups-devel-2.2.7-lp150.2.6.1 libcups2-2.2.7-lp150.2.6.1 libcups2-debuginfo-2.2.7-lp150.2.6.1 libcupscgi1-2.2.7-lp150.2.6.1 libcupscgi1-debuginfo-2.2.7-lp150.2.6.1 libcupsimage2-2.2.7-lp150.2.6.1 libcupsimage2-debuginfo-2.2.7-lp150.2.6.1 libcupsmime1-2.2.7-lp150.2.6.1 libcupsmime1-debuginfo-2.2.7-lp150.2.6.1 libcupsppdc1-2.2.7-lp150.2.6.1 libcupsppdc1-debuginfo-2.2.7-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): cups-devel-32bit-2.2.7-lp150.2.6.1 libcups2-32bit-2.2.7-lp150.2.6.1 libcups2-32bit-debuginfo-2.2.7-lp150.2.6.1 libcupscgi1-32bit-2.2.7-lp150.2.6.1 libcupscgi1-32bit-debuginfo-2.2.7-lp150.2.6.1 libcupsimage2-32bit-2.2.7-lp150.2.6.1 libcupsimage2-32bit-debuginfo-2.2.7-lp150.2.6.1 libcupsmime1-32bit-2.2.7-lp150.2.6.1 libcupsmime1-32bit-debuginfo-2.2.7-lp150.2.6.1 libcupsppdc1-32bit-2.2.7-lp150.2.6.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-4700.html https://bugzilla.suse.com/1115750 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4104-1: moderate: Security update for compat-openssl098
by opensuse-security＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4104-1 Rating: moderate References: #1104789 #1110018 #1113534 #1113652 Cross-References: CVE-2016-8610 CVE-2018-0734 CVE-2018-5407 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for compat-openssl098 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). - Fixed the "One and Done" side-channel attack on RSA (bsc#1104789). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1529=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-27.1 libopenssl0_9_8-0.9.8j-27.1 libopenssl0_9_8-debuginfo-0.9.8j-27.1 - openSUSE Leap 42.3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-27.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-27.1 References: https://www.suse.com/security/cve/CVE-2016-8610.html https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1104789 https://bugzilla.suse.com/1110018 https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4073-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 12 Dec '18

12 Dec '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4073-1 Rating: moderate References: #1114157 #1114169 Cross-References: CVE-2018-10851 CVE-2018-14626 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1525=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.5-14.1 pdns-backend-godbc-4.1.5-14.1 pdns-backend-godbc-debuginfo-4.1.5-14.1 pdns-backend-ldap-4.1.5-14.1 pdns-backend-ldap-debuginfo-4.1.5-14.1 pdns-backend-lua-4.1.5-14.1 pdns-backend-lua-debuginfo-4.1.5-14.1 pdns-backend-mydns-4.1.5-14.1 pdns-backend-mydns-debuginfo-4.1.5-14.1 pdns-backend-mysql-4.1.5-14.1 pdns-backend-mysql-debuginfo-4.1.5-14.1 pdns-backend-postgresql-4.1.5-14.1 pdns-backend-postgresql-debuginfo-4.1.5-14.1 pdns-backend-remote-4.1.5-14.1 pdns-backend-remote-debuginfo-4.1.5-14.1 pdns-backend-sqlite3-4.1.5-14.1 pdns-backend-sqlite3-debuginfo-4.1.5-14.1 pdns-debuginfo-4.1.5-14.1 pdns-debugsource-4.1.5-14.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4062-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 10 Dec '18

10 Dec '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4062-1 Rating: moderate References: #1089814 #1114157 #1114169 #1114170 #1116592 Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 CVE-2018-16855 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for pdns-recursor to version 4.1.8 fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). - CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592) Non-security issues fixed: - Fixed build failure with Boost 1.67.0 (bsc#1089814). - Revert ‘Keep the EDNS status of a server on FormErr with EDNS’ - Refuse queries for all meta-types For more details about this update, refer to: https://blog.powerdns.com/2018/11/26/powerdns-recursor-4-1-8-released/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1524=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.8-13.1 pdns-recursor-debuginfo-4.1.8-13.1 pdns-recursor-debugsource-4.1.8-13.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://www.suse.com/security/cve/CVE-2018-14644.html https://www.suse.com/security/cve/CVE-2018-16855.html https://bugzilla.suse.com/1089814 https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 https://bugzilla.suse.com/1114170 https://bugzilla.suse.com/1116592 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4056-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4056-1 Rating: important References: #1118529 Cross-References: CVE-2018-17480 CVE-2018-17481 CVE-2018-18335 CVE-2018-18336 CVE-2018-18337 CVE-2018-18338 CVE-2018-18339 CVE-2018-18340 CVE-2018-18341 CVE-2018-18342 CVE-2018-18343 CVE-2018-18344 CVE-2018-18345 CVE-2018-18346 CVE-2018-18347 CVE-2018-18348 CVE-2018-18349 CVE-2018-18350 CVE-2018-18351 CVE-2018-18352 CVE-2018-18353 CVE-2018-18354 CVE-2018-18355 CVE-2018-18356 CVE-2018-18357 CVE-2018-18358 CVE-2018-18359 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update to Chromium version 71.0.3578.80 fixes security issues and bugs. Security issues fixed (boo#1118529): - CVE-2018-17480: Out of bounds write in V8 - CVE-2018-17481: Use after frees in PDFium - CVE-2018-18335: Heap buffer overflow in Skia - CVE-2018-18336: Use after free in PDFium - CVE-2018-18337: Use after free in Blink - CVE-2018-18338: Heap buffer overflow in Canvas - CVE-2018-18339: Use after free in WebAudio - CVE-2018-18340: Use after free in MediaRecorder - CVE-2018-18341: Heap buffer overflow in Blink - CVE-2018-18342: Out of bounds write in V8 - CVE-2018-18343: Use after free in Skia - CVE-2018-18344: Inappropriate implementation in Extensions - Multiple issues in SQLite via WebSQL - CVE-2018-18345: Inappropriate implementation in Site Isolation - CVE-2018-18346: Incorrect security UI in Blink - CVE-2018-18347: Inappropriate implementation in Navigation - CVE-2018-18348: Inappropriate implementation in Omnibox - CVE-2018-18349: Insufficient policy enforcement in Blink - CVE-2018-18350: Insufficient policy enforcement in Blink - CVE-2018-18351: Insufficient policy enforcement in Navigation - CVE-2018-18352: Inappropriate implementation in Media - CVE-2018-18353: Inappropriate implementation in Network Authentication - CVE-2018-18354: Insufficient data validation in Shell Integration - CVE-2018-18355: Insufficient policy enforcement in URL Formatter - CVE-2018-18356: Use after free in Skia - CVE-2018-18357: Insufficient policy enforcement in URL Formatter - CVE-2018-18358: Insufficient policy enforcement in Proxy - CVE-2018-18359: Out of bounds read in V8 - Inappropriate implementation in PDFium - Use after free in Extensions - Inappropriate implementation in Navigation - Insufficient policy enforcement in Navigation - Insufficient policy enforcement in URL Formatter - Various fixes from internal audits, fuzzing and other initiatives The following changes are included: - advertisements posing as error messages are now blocked - Automatic playing of content at page load mostly disabled - New JavaScript API for relative time display Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1521=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1521=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-71.0.3578.80-lp150.2.30.1 chromedriver-debuginfo-71.0.3578.80-lp150.2.30.1 chromium-71.0.3578.80-lp150.2.30.1 chromium-debuginfo-71.0.3578.80-lp150.2.30.1 chromium-debugsource-71.0.3578.80-lp150.2.30.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-71.0.3578.80-bp150.2.23.1 chromedriver-debuginfo-71.0.3578.80-bp150.2.23.1 chromium-71.0.3578.80-bp150.2.23.1 chromium-debuginfo-71.0.3578.80-bp150.2.23.1 chromium-debugsource-71.0.3578.80-bp150.2.23.1 References: https://www.suse.com/security/cve/CVE-2018-17480.html https://www.suse.com/security/cve/CVE-2018-17481.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18336.html https://www.suse.com/security/cve/CVE-2018-18337.html https://www.suse.com/security/cve/CVE-2018-18338.html https://www.suse.com/security/cve/CVE-2018-18339.html https://www.suse.com/security/cve/CVE-2018-18340.html https://www.suse.com/security/cve/CVE-2018-18341.html https://www.suse.com/security/cve/CVE-2018-18342.html https://www.suse.com/security/cve/CVE-2018-18343.html https://www.suse.com/security/cve/CVE-2018-18344.html https://www.suse.com/security/cve/CVE-2018-18345.html https://www.suse.com/security/cve/CVE-2018-18346.html https://www.suse.com/security/cve/CVE-2018-18347.html https://www.suse.com/security/cve/CVE-2018-18348.html https://www.suse.com/security/cve/CVE-2018-18349.html https://www.suse.com/security/cve/CVE-2018-18350.html https://www.suse.com/security/cve/CVE-2018-18351.html https://www.suse.com/security/cve/CVE-2018-18352.html https://www.suse.com/security/cve/CVE-2018-18353.html https://www.suse.com/security/cve/CVE-2018-18354.html https://www.suse.com/security/cve/CVE-2018-18355.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18357.html https://www.suse.com/security/cve/CVE-2018-18358.html https://www.suse.com/security/cve/CVE-2018-18359.html https://bugzilla.suse.com/1118529 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4055-1: important: Security update for ncurses
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4055-1 Rating: important References: #1103320 #1115929 Cross-References: CVE-2018-19211 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for ncurses fixes the following issues: Security issue fixed: - CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function _nc_parse_entry (bsc#1115929). Non-security issue fixed: - Remove scree.xterm from terminfo data base as with this screen uses fallback TERM=screen (bsc#1103320). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1516=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libncurses5-6.1-lp150.4.3.1 libncurses5-debuginfo-6.1-lp150.4.3.1 libncurses6-6.1-lp150.4.3.1 libncurses6-debuginfo-6.1-lp150.4.3.1 ncurses-debugsource-6.1-lp150.4.3.1 ncurses-devel-6.1-lp150.4.3.1 ncurses-devel-debuginfo-6.1-lp150.4.3.1 ncurses-utils-6.1-lp150.4.3.1 ncurses-utils-debuginfo-6.1-lp150.4.3.1 ncurses5-devel-6.1-lp150.4.3.1 tack-6.1-lp150.4.3.1 tack-debuginfo-6.1-lp150.4.3.1 terminfo-6.1-lp150.4.3.1 terminfo-base-6.1-lp150.4.3.1 terminfo-iterm-6.1-lp150.4.3.1 terminfo-screen-6.1-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): libncurses5-32bit-6.1-lp150.4.3.1 libncurses5-32bit-debuginfo-6.1-lp150.4.3.1 libncurses6-32bit-6.1-lp150.4.3.1 libncurses6-32bit-debuginfo-6.1-lp150.4.3.1 ncurses-devel-32bit-6.1-lp150.4.3.1 ncurses-devel-32bit-debuginfo-6.1-lp150.4.3.1 ncurses5-devel-32bit-6.1-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-19211.html https://bugzilla.suse.com/1103320 https://bugzilla.suse.com/1115929 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4054-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4054-1 Rating: moderate References: #1057246 #1113064 #1117463 Cross-References: CVE-2018-18544 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage (bsc#1113064). Non-security issues fixed: - Improve import documentation (bsc#1057246). - Allow override system security policy (bsc#1117463). - asan_build: build ASAN included - debug_build: build more suitable for debugging This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1520=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-79.1 ImageMagick-debuginfo-6.8.8.1-79.1 ImageMagick-debugsource-6.8.8.1-79.1 ImageMagick-devel-6.8.8.1-79.1 ImageMagick-extra-6.8.8.1-79.1 ImageMagick-extra-debuginfo-6.8.8.1-79.1 libMagick++-6_Q16-3-6.8.8.1-79.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-79.1 libMagick++-devel-6.8.8.1-79.1 libMagickCore-6_Q16-1-6.8.8.1-79.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-79.1 libMagickWand-6_Q16-1-6.8.8.1-79.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-79.1 perl-PerlMagick-6.8.8.1-79.1 perl-PerlMagick-debuginfo-6.8.8.1-79.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-79.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-79.1 libMagick++-6_Q16-3-32bit-6.8.8.1-79.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-79.1 libMagick++-devel-32bit-6.8.8.1-79.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-79.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-79.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-79.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-79.1 References: https://www.suse.com/security/cve/CVE-2018-18544.html https://bugzilla.suse.com/1057246 https://bugzilla.suse.com/1113064 https://bugzilla.suse.com/1117463 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4053-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4053-1 Rating: moderate References: #1017693 #1054594 #1115717 #990460 Cross-References: CVE-2016-10092 CVE-2016-10093 CVE-2016-10094 CVE-2016-6223 CVE-2017-12944 CVE-2018-19210 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-19210: Fixed NULL pointer dereference in the TIFFWriteDirectorySec function (bsc#1115717). - CVE-2017-12944: Fixed denial of service issue in the TIFFReadDirEntryArray function (bsc#1054594). - CVE-2016-10094: Fixed heap-based buffer overflow in the _tiffWriteProc function (bsc#1017693). - CVE-2016-10093: Fixed heap-based buffer overflow in the _TIFFmemcpy function (bsc#1017693). - CVE-2016-10092: Fixed heap-based buffer overflow in the TIFFReverseBits function (bsc#1017693). - CVE-2016-6223: Fixed out-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1() (bsc#990460). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1522=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libtiff-devel-4.0.9-lp150.4.12.1 libtiff5-4.0.9-lp150.4.12.1 libtiff5-debuginfo-4.0.9-lp150.4.12.1 tiff-4.0.9-lp150.4.12.1 tiff-debuginfo-4.0.9-lp150.4.12.1 tiff-debugsource-4.0.9-lp150.4.12.1 - openSUSE Leap 15.0 (x86_64): libtiff-devel-32bit-4.0.9-lp150.4.12.1 libtiff5-32bit-4.0.9-lp150.4.12.1 libtiff5-32bit-debuginfo-4.0.9-lp150.4.12.1 References: https://www.suse.com/security/cve/CVE-2016-10092.html https://www.suse.com/security/cve/CVE-2016-10093.html https://www.suse.com/security/cve/CVE-2016-10094.html https://www.suse.com/security/cve/CVE-2016-6223.html https://www.suse.com/security/cve/CVE-2017-12944.html https://www.suse.com/security/cve/CVE-2018-19210.html https://bugzilla.suse.com/1017693 https://bugzilla.suse.com/1054594 https://bugzilla.suse.com/1115717 https://bugzilla.suse.com/990460 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4051-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4051-1 Rating: important References: #1110949 #1114729 Cross-References: CVE-2018-17456 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libgit2 fixes the following issues: Security issue fixed: - CVE-2018-17456: Submodule URLs and paths with a leading "-" are now ignored to avoid injecting options into library consumers that perform recursive clones (bsc#1110949). Non-security issues fixed: - Version update to version 0.26.8 (bsc#1114729). - Full changelog can be found at: * https://github.com/libgit2/libgit2/releases/tag/v0.26.8 * https://github.com/libgit2/libgit2/releases/tag/v0.26.7 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1517=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgit2-26-0.26.8-lp150.2.6.1 libgit2-26-debuginfo-0.26.8-lp150.2.6.1 libgit2-debugsource-0.26.8-lp150.2.6.1 libgit2-devel-0.26.8-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libgit2-26-32bit-0.26.8-lp150.2.6.1 libgit2-26-32bit-debuginfo-0.26.8-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-17456.html https://bugzilla.suse.com/1110949 https://bugzilla.suse.com/1114729 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4050-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4050-1 Rating: moderate References: #1100078 #1112209 #1113534 #1113652 #1113742 Cross-References: CVE-2018-0734 CVE-2018-5407 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for openssl-1_0_0 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes "PortSmash" (bsc#1113534). Non-security issues fixed: - Added missing timing side channel patch for DSA signature generation (bsc#1113742). - Set TLS version to 0 in msg_callback for record messages to avoid confusing applications (bsc#1100078). - Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1518=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.9.1 libopenssl1_0_0-1.0.2p-lp150.2.9.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.9.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.9.1 openssl-1_0_0-1.0.2p-lp150.2.9.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.9.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.9.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.9.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.9.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1100078 https://bugzilla.suse.com/1112209 https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1113742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4046-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4046-1 Rating: moderate References: #1115416 Cross-References: CVE-2018-19141 CVE-2018-19143 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for otrs fixes the following issues: Update to version 4.0.33. Security issues fixed: - CVE-2018-19141: Fixed privilege escalation, that an attacker who is logged into OTRS as an admin user cannot manipulate the URL to cause execution of JavaScript in the context of OTRS. - CVE-2018-19143: Fixed remote file deletion, that an attacker who is logged into OTRS as a user cannot manipulate the submission form to cause deletion of arbitrary files that the OTRS web server user has write access to. Non-security issues fixed: - Full release notes can be found at: * https://community.otrs.com/release-notes-otrs-4-patch-level-33/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1503=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1503=1 Package List: - openSUSE Leap 15.0 (noarch): otrs-4.0.33-lp150.2.6.1 otrs-doc-4.0.33-lp150.2.6.1 otrs-itsm-4.0.33-lp150.2.6.1 - openSUSE Backports SLE-15 (noarch): otrs-4.0.33-bp150.3.6.1 otrs-doc-4.0.33-bp150.3.6.1 otrs-itsm-4.0.33-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19141.html https://www.suse.com/security/cve/CVE-2018-19143.html https://bugzilla.suse.com/1115416 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4045-1: moderate: Security update for dom4j
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4045-1 Rating: moderate References: #1105443 Cross-References: CVE-2018-1000632 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection that could have resulted in an attacker tampering with XML documents (bsc#1105443). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1492=1 Package List: - openSUSE Backports SLE-15 (noarch): dom4j-1.6.1-bp150.2.3.1 dom4j-demo-1.6.1-bp150.2.3.1 dom4j-javadoc-1.6.1-bp150.2.3.1 dom4j-manual-1.6.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000632.html https://bugzilla.suse.com/1105443 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4043-1: important: Security update for pam
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for pam ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4043-1 Rating: important References: #1115640 Cross-References: CVE-2018-17953 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pam fixes the following issue: Security issue fixed: - CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified (bsc#1115640). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1511=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): pam-1.3.0-lp150.5.6.1 pam-debuginfo-1.3.0-lp150.5.6.1 pam-debugsource-1.3.0-lp150.5.6.1 pam-devel-1.3.0-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): pam-32bit-1.3.0-lp150.5.6.1 pam-32bit-debuginfo-1.3.0-lp150.5.6.1 pam-devel-32bit-1.3.0-lp150.5.6.1 - openSUSE Leap 15.0 (noarch): pam-doc-1.3.0-lp150.5.6.1 References: https://www.suse.com/security/cve/CVE-2018-17953.html https://bugzilla.suse.com/1115640 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4042-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4042-1 Rating: moderate References: #1110850 Cross-References: CVE-2018-11784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat to 9.0.12 fixes the following issues: See the full changelog at: http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.12_(markt ) Security issues fixed: - CVE-2018-11784: When the default servlet in Apache Tomcat returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. (bsc#1110850) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1504=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.12-lp150.2.6.1 tomcat-admin-webapps-9.0.12-lp150.2.6.1 tomcat-docs-webapp-9.0.12-lp150.2.6.1 tomcat-el-3_0-api-9.0.12-lp150.2.6.1 tomcat-embed-9.0.12-lp150.2.6.1 tomcat-javadoc-9.0.12-lp150.2.6.1 tomcat-jsp-2_3-api-9.0.12-lp150.2.6.1 tomcat-jsvc-9.0.12-lp150.2.6.1 tomcat-lib-9.0.12-lp150.2.6.1 tomcat-servlet-4_0-api-9.0.12-lp150.2.6.1 tomcat-webapps-9.0.12-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-11784.html https://bugzilla.suse.com/1110850 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4041-1: Security update for rubygem-activejob-5_1
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for rubygem-activejob-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4041-1 Rating: low References: #1117632 Cross-References: CVE-2018-16476 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-activejob-5_1 fixes the following issues: Security issue fixed: - CVE-2018-16476: Fixed broken access control vulnerability (bsc#1117632). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1502=1 Package List: - openSUSE Leap 15.0 (x86_64): ruby2.5-rubygem-activejob-5_1-5.1.4-lp150.2.3.1 ruby2.5-rubygem-activejob-doc-5_1-5.1.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16476.html https://bugzilla.suse.com/1117632 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4038-1: moderate: Recommended update for php5
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Recommended update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4038-1 Rating: moderate References: #1117107 Cross-References: CVE-2018-19518 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: Security issue fixed: - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1506=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-109.1 apache2-mod_php5-debuginfo-5.5.14-109.1 php5-5.5.14-109.1 php5-bcmath-5.5.14-109.1 php5-bcmath-debuginfo-5.5.14-109.1 php5-bz2-5.5.14-109.1 php5-bz2-debuginfo-5.5.14-109.1 php5-calendar-5.5.14-109.1 php5-calendar-debuginfo-5.5.14-109.1 php5-ctype-5.5.14-109.1 php5-ctype-debuginfo-5.5.14-109.1 php5-curl-5.5.14-109.1 php5-curl-debuginfo-5.5.14-109.1 php5-dba-5.5.14-109.1 php5-dba-debuginfo-5.5.14-109.1 php5-debuginfo-5.5.14-109.1 php5-debugsource-5.5.14-109.1 php5-devel-5.5.14-109.1 php5-dom-5.5.14-109.1 php5-dom-debuginfo-5.5.14-109.1 php5-enchant-5.5.14-109.1 php5-enchant-debuginfo-5.5.14-109.1 php5-exif-5.5.14-109.1 php5-exif-debuginfo-5.5.14-109.1 php5-fastcgi-5.5.14-109.1 php5-fastcgi-debuginfo-5.5.14-109.1 php5-fileinfo-5.5.14-109.1 php5-fileinfo-debuginfo-5.5.14-109.1 php5-firebird-5.5.14-109.1 php5-firebird-debuginfo-5.5.14-109.1 php5-fpm-5.5.14-109.1 php5-fpm-debuginfo-5.5.14-109.1 php5-ftp-5.5.14-109.1 php5-ftp-debuginfo-5.5.14-109.1 php5-gd-5.5.14-109.1 php5-gd-debuginfo-5.5.14-109.1 php5-gettext-5.5.14-109.1 php5-gettext-debuginfo-5.5.14-109.1 php5-gmp-5.5.14-109.1 php5-gmp-debuginfo-5.5.14-109.1 php5-iconv-5.5.14-109.1 php5-iconv-debuginfo-5.5.14-109.1 php5-imap-5.5.14-109.1 php5-imap-debuginfo-5.5.14-109.1 php5-intl-5.5.14-109.1 php5-intl-debuginfo-5.5.14-109.1 php5-json-5.5.14-109.1 php5-json-debuginfo-5.5.14-109.1 php5-ldap-5.5.14-109.1 php5-ldap-debuginfo-5.5.14-109.1 php5-mbstring-5.5.14-109.1 php5-mbstring-debuginfo-5.5.14-109.1 php5-mcrypt-5.5.14-109.1 php5-mcrypt-debuginfo-5.5.14-109.1 php5-mssql-5.5.14-109.1 php5-mssql-debuginfo-5.5.14-109.1 php5-mysql-5.5.14-109.1 php5-mysql-debuginfo-5.5.14-109.1 php5-odbc-5.5.14-109.1 php5-odbc-debuginfo-5.5.14-109.1 php5-opcache-5.5.14-109.1 php5-opcache-debuginfo-5.5.14-109.1 php5-openssl-5.5.14-109.1 php5-openssl-debuginfo-5.5.14-109.1 php5-pcntl-5.5.14-109.1 php5-pcntl-debuginfo-5.5.14-109.1 php5-pdo-5.5.14-109.1 php5-pdo-debuginfo-5.5.14-109.1 php5-pgsql-5.5.14-109.1 php5-pgsql-debuginfo-5.5.14-109.1 php5-phar-5.5.14-109.1 php5-phar-debuginfo-5.5.14-109.1 php5-posix-5.5.14-109.1 php5-posix-debuginfo-5.5.14-109.1 php5-pspell-5.5.14-109.1 php5-pspell-debuginfo-5.5.14-109.1 php5-readline-5.5.14-109.1 php5-readline-debuginfo-5.5.14-109.1 php5-shmop-5.5.14-109.1 php5-shmop-debuginfo-5.5.14-109.1 php5-snmp-5.5.14-109.1 php5-snmp-debuginfo-5.5.14-109.1 php5-soap-5.5.14-109.1 php5-soap-debuginfo-5.5.14-109.1 php5-sockets-5.5.14-109.1 php5-sockets-debuginfo-5.5.14-109.1 php5-sqlite-5.5.14-109.1 php5-sqlite-debuginfo-5.5.14-109.1 php5-suhosin-5.5.14-109.1 php5-suhosin-debuginfo-5.5.14-109.1 php5-sysvmsg-5.5.14-109.1 php5-sysvmsg-debuginfo-5.5.14-109.1 php5-sysvsem-5.5.14-109.1 php5-sysvsem-debuginfo-5.5.14-109.1 php5-sysvshm-5.5.14-109.1 php5-sysvshm-debuginfo-5.5.14-109.1 php5-tidy-5.5.14-109.1 php5-tidy-debuginfo-5.5.14-109.1 php5-tokenizer-5.5.14-109.1 php5-tokenizer-debuginfo-5.5.14-109.1 php5-wddx-5.5.14-109.1 php5-wddx-debuginfo-5.5.14-109.1 php5-xmlreader-5.5.14-109.1 php5-xmlreader-debuginfo-5.5.14-109.1 php5-xmlrpc-5.5.14-109.1 php5-xmlrpc-debuginfo-5.5.14-109.1 php5-xmlwriter-5.5.14-109.1 php5-xmlwriter-debuginfo-5.5.14-109.1 php5-xsl-5.5.14-109.1 php5-xsl-debuginfo-5.5.14-109.1 php5-zip-5.5.14-109.1 php5-zip-debuginfo-5.5.14-109.1 php5-zlib-5.5.14-109.1 php5-zlib-debuginfo-5.5.14-109.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-109.1 References: https://www.suse.com/security/cve/CVE-2018-19518.html https://bugzilla.suse.com/1117107 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4034-1: important: Security update for ncurses
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4034-1 Rating: important References: #1115929 Cross-References: CVE-2018-19211 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ncurses fixes the following issue: Security issue fixed: - CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function _nc_parse_entry (bsc#1115929). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1509=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libncurses5-5.9-66.1 libncurses5-debuginfo-5.9-66.1 libncurses6-5.9-66.1 libncurses6-debuginfo-5.9-66.1 ncurses-debugsource-5.9-66.1 ncurses-devel-5.9-66.1 ncurses-devel-debuginfo-5.9-66.1 ncurses-utils-5.9-66.1 ncurses-utils-debuginfo-5.9-66.1 tack-5.9-66.1 tack-debuginfo-5.9-66.1 terminfo-5.9-66.1 terminfo-base-5.9-66.1 - openSUSE Leap 42.3 (x86_64): libncurses5-32bit-5.9-66.1 libncurses5-debuginfo-32bit-5.9-66.1 libncurses6-32bit-5.9-66.1 libncurses6-debuginfo-32bit-5.9-66.1 ncurses-devel-32bit-5.9-66.1 ncurses-devel-debuginfo-32bit-5.9-66.1 References: https://www.suse.com/security/cve/CVE-2018-19211.html https://bugzilla.suse.com/1115929 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4032-1: important: Security update for apache2-mod_jk
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for apache2-mod_jk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4032-1 Rating: important References: #1114612 Cross-References: CVE-2018-11759 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2-mod_jk fixes the following issue: Security issue fixed: - CVE-2018-11759: Fixed connector path traversal due to mishandled HTTP requests in httpd (bsc#1114612). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1510=1 Package List: - openSUSE Leap 15.0 (x86_64): apache2-mod_jk-1.2.43-lp150.2.3.1 apache2-mod_jk-debuginfo-1.2.43-lp150.2.3.1 apache2-mod_jk-debugsource-1.2.43-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11759.html https://bugzilla.suse.com/1114612 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4031-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4031-1 Rating: moderate References: #1114837 Cross-References: CVE-2018-16850 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2018-16850: Fixed improper quoting of transition table names when pg_dump emits CREATE TRIGGER could have caused privilege escalation (bsc#1114837). Non-security issues fixed: - Update to release 10.6: * https://www.postgresql.org/docs/current/static/release-10-6.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1493=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.6-lp150.3.6.1 libecpg6-debuginfo-10.6-lp150.3.6.1 libpq5-10.6-lp150.3.6.1 libpq5-debuginfo-10.6-lp150.3.6.1 postgresql10-10.6-lp150.3.6.1 postgresql10-contrib-10.6-lp150.3.6.1 postgresql10-contrib-debuginfo-10.6-lp150.3.6.1 postgresql10-debuginfo-10.6-lp150.3.6.1 postgresql10-debugsource-10.6-lp150.3.6.1 postgresql10-devel-10.6-lp150.3.6.1 postgresql10-devel-debuginfo-10.6-lp150.3.6.1 postgresql10-plperl-10.6-lp150.3.6.1 postgresql10-plperl-debuginfo-10.6-lp150.3.6.1 postgresql10-plpython-10.6-lp150.3.6.1 postgresql10-plpython-debuginfo-10.6-lp150.3.6.1 postgresql10-pltcl-10.6-lp150.3.6.1 postgresql10-pltcl-debuginfo-10.6-lp150.3.6.1 postgresql10-server-10.6-lp150.3.6.1 postgresql10-server-debuginfo-10.6-lp150.3.6.1 postgresql10-test-10.6-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.6-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.6-lp150.3.6.1 libecpg6-32bit-debuginfo-10.6-lp150.3.6.1 libpq5-32bit-10.6-lp150.3.6.1 libpq5-32bit-debuginfo-10.6-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-16850.html https://bugzilla.suse.com/1114837 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4030-1: moderate: Recommended update for php7
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Recommended update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4030-1 Rating: moderate References: #1117107 Cross-References: CVE-2018-19518 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1507=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-52.1 apache2-mod_php7-debuginfo-7.0.7-52.1 php7-7.0.7-52.1 php7-bcmath-7.0.7-52.1 php7-bcmath-debuginfo-7.0.7-52.1 php7-bz2-7.0.7-52.1 php7-bz2-debuginfo-7.0.7-52.1 php7-calendar-7.0.7-52.1 php7-calendar-debuginfo-7.0.7-52.1 php7-ctype-7.0.7-52.1 php7-ctype-debuginfo-7.0.7-52.1 php7-curl-7.0.7-52.1 php7-curl-debuginfo-7.0.7-52.1 php7-dba-7.0.7-52.1 php7-dba-debuginfo-7.0.7-52.1 php7-debuginfo-7.0.7-52.1 php7-debugsource-7.0.7-52.1 php7-devel-7.0.7-52.1 php7-dom-7.0.7-52.1 php7-dom-debuginfo-7.0.7-52.1 php7-enchant-7.0.7-52.1 php7-enchant-debuginfo-7.0.7-52.1 php7-exif-7.0.7-52.1 php7-exif-debuginfo-7.0.7-52.1 php7-fastcgi-7.0.7-52.1 php7-fastcgi-debuginfo-7.0.7-52.1 php7-fileinfo-7.0.7-52.1 php7-fileinfo-debuginfo-7.0.7-52.1 php7-firebird-7.0.7-52.1 php7-firebird-debuginfo-7.0.7-52.1 php7-fpm-7.0.7-52.1 php7-fpm-debuginfo-7.0.7-52.1 php7-ftp-7.0.7-52.1 php7-ftp-debuginfo-7.0.7-52.1 php7-gd-7.0.7-52.1 php7-gd-debuginfo-7.0.7-52.1 php7-gettext-7.0.7-52.1 php7-gettext-debuginfo-7.0.7-52.1 php7-gmp-7.0.7-52.1 php7-gmp-debuginfo-7.0.7-52.1 php7-iconv-7.0.7-52.1 php7-iconv-debuginfo-7.0.7-52.1 php7-imap-7.0.7-52.1 php7-imap-debuginfo-7.0.7-52.1 php7-intl-7.0.7-52.1 php7-intl-debuginfo-7.0.7-52.1 php7-json-7.0.7-52.1 php7-json-debuginfo-7.0.7-52.1 php7-ldap-7.0.7-52.1 php7-ldap-debuginfo-7.0.7-52.1 php7-mbstring-7.0.7-52.1 php7-mbstring-debuginfo-7.0.7-52.1 php7-mcrypt-7.0.7-52.1 php7-mcrypt-debuginfo-7.0.7-52.1 php7-mysql-7.0.7-52.1 php7-mysql-debuginfo-7.0.7-52.1 php7-odbc-7.0.7-52.1 php7-odbc-debuginfo-7.0.7-52.1 php7-opcache-7.0.7-52.1 php7-opcache-debuginfo-7.0.7-52.1 php7-openssl-7.0.7-52.1 php7-openssl-debuginfo-7.0.7-52.1 php7-pcntl-7.0.7-52.1 php7-pcntl-debuginfo-7.0.7-52.1 php7-pdo-7.0.7-52.1 php7-pdo-debuginfo-7.0.7-52.1 php7-pgsql-7.0.7-52.1 php7-pgsql-debuginfo-7.0.7-52.1 php7-phar-7.0.7-52.1 php7-phar-debuginfo-7.0.7-52.1 php7-posix-7.0.7-52.1 php7-posix-debuginfo-7.0.7-52.1 php7-pspell-7.0.7-52.1 php7-pspell-debuginfo-7.0.7-52.1 php7-readline-7.0.7-52.1 php7-readline-debuginfo-7.0.7-52.1 php7-shmop-7.0.7-52.1 php7-shmop-debuginfo-7.0.7-52.1 php7-snmp-7.0.7-52.1 php7-snmp-debuginfo-7.0.7-52.1 php7-soap-7.0.7-52.1 php7-soap-debuginfo-7.0.7-52.1 php7-sockets-7.0.7-52.1 php7-sockets-debuginfo-7.0.7-52.1 php7-sqlite-7.0.7-52.1 php7-sqlite-debuginfo-7.0.7-52.1 php7-sysvmsg-7.0.7-52.1 php7-sysvmsg-debuginfo-7.0.7-52.1 php7-sysvsem-7.0.7-52.1 php7-sysvsem-debuginfo-7.0.7-52.1 php7-sysvshm-7.0.7-52.1 php7-sysvshm-debuginfo-7.0.7-52.1 php7-tidy-7.0.7-52.1 php7-tidy-debuginfo-7.0.7-52.1 php7-tokenizer-7.0.7-52.1 php7-tokenizer-debuginfo-7.0.7-52.1 php7-wddx-7.0.7-52.1 php7-wddx-debuginfo-7.0.7-52.1 php7-xmlreader-7.0.7-52.1 php7-xmlreader-debuginfo-7.0.7-52.1 php7-xmlrpc-7.0.7-52.1 php7-xmlrpc-debuginfo-7.0.7-52.1 php7-xmlwriter-7.0.7-52.1 php7-xmlwriter-debuginfo-7.0.7-52.1 php7-xsl-7.0.7-52.1 php7-xsl-debuginfo-7.0.7-52.1 php7-zip-7.0.7-52.1 php7-zip-debuginfo-7.0.7-52.1 php7-zlib-7.0.7-52.1 php7-zlib-debuginfo-7.0.7-52.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-52.1 php7-pear-Archive_Tar-7.0.7-52.1 References: https://www.suse.com/security/cve/CVE-2018-19518.html https://bugzilla.suse.com/1117107 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4029-1: Security update for messagelib
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4029-1 Rating: low References: #1117958 Cross-References: CVE-2018-19516 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for messagelib fixes the following issues: The following security vulnerability was addressed: - CVE-2018-19516: Fix a potential issue with opening messages in a new browser window when displaying mails as HTML (boo#1117958). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1508=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1508=1 Package List: - openSUSE Leap 15.0 (x86_64): messagelib-17.12.3-lp150.2.6.1 messagelib-debuginfo-17.12.3-lp150.2.6.1 messagelib-debugsource-17.12.3-lp150.2.6.1 messagelib-devel-17.12.3-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): messagelib-lang-17.12.3-lp150.2.6.1 - openSUSE Backports SLE-15 (x86_64): messagelib-17.12.3-bp150.3.6.1 messagelib-devel-17.12.3-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): messagelib-lang-17.12.3-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19516.html https://bugzilla.suse.com/1117958 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4007-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4007-1 Rating: important References: #1104199 Cross-References: CVE-2018-10915 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql94 to 9.4.19 fixes the following security issue: - CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could have bypassed client-side connection security features, obtain access to higher privileged connections or potentially cause other impact SQL injection, by causing the PQescape() functions to malfunction (bsc#1104199). A dump/restore is not required for this update unless you use the functions query_to_xml, cursor_to_xml, cursor_to_xmlschema, query_to_xmlschema, and query_to_xml_and_xmlschema. In this case please see the first entry of https://www.postgresql.org/docs/9.4/static/release-9-4-18.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1482=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.19-24.1 postgresql94-contrib-9.4.19-24.1 postgresql94-contrib-debuginfo-9.4.19-24.1 postgresql94-debuginfo-9.4.19-24.1 postgresql94-debugsource-9.4.19-24.1 postgresql94-devel-9.4.19-24.1 postgresql94-devel-debuginfo-9.4.19-24.1 postgresql94-libs-debugsource-9.4.19-24.1 postgresql94-plperl-9.4.19-24.1 postgresql94-plperl-debuginfo-9.4.19-24.1 postgresql94-plpython-9.4.19-24.1 postgresql94-plpython-debuginfo-9.4.19-24.1 postgresql94-pltcl-9.4.19-24.1 postgresql94-pltcl-debuginfo-9.4.19-24.1 postgresql94-server-9.4.19-24.1 postgresql94-server-debuginfo-9.4.19-24.1 postgresql94-test-9.4.19-24.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.19-24.1 References: https://www.suse.com/security/cve/CVE-2018-10915.html https://bugzilla.suse.com/1104199 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4005-1: moderate: Security update for glib2
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for glib2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4005-1 Rating: moderate References: #1107116 #1107121 #1111499 Cross-References: CVE-2018-16428 CVE-2018-16429 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for glib2 fixes the following issues: Security issues fixed: - CVE-2018-16428: Do not do a NULL pointer dereference (crash). Avoid that, at the cost of introducing a new translatable error message (bsc#1107121). - CVE-2018-16429: Fixed out-of-bounds read vulnerability ing_markup_parse_context_parse() (bsc#1107116). Non-security issue fixed: - various GVariant parsing issues have been resolved (bsc#1111499) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1485=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): glib2-debugsource-2.54.3-lp150.3.3.1 glib2-devel-2.54.3-lp150.3.3.1 glib2-devel-debuginfo-2.54.3-lp150.3.3.1 glib2-devel-static-2.54.3-lp150.3.3.1 glib2-tools-2.54.3-lp150.3.3.1 glib2-tools-debuginfo-2.54.3-lp150.3.3.1 libgio-2_0-0-2.54.3-lp150.3.3.1 libgio-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgio-fam-2.54.3-lp150.3.3.1 libgio-fam-debuginfo-2.54.3-lp150.3.3.1 libglib-2_0-0-2.54.3-lp150.3.3.1 libglib-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgmodule-2_0-0-2.54.3-lp150.3.3.1 libgmodule-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgobject-2_0-0-2.54.3-lp150.3.3.1 libgobject-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgthread-2_0-0-2.54.3-lp150.3.3.1 libgthread-2_0-0-debuginfo-2.54.3-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): glib2-devel-32bit-2.54.3-lp150.3.3.1 glib2-devel-32bit-debuginfo-2.54.3-lp150.3.3.1 glib2-tools-32bit-2.54.3-lp150.3.3.1 glib2-tools-32bit-debuginfo-2.54.3-lp150.3.3.1 libgio-2_0-0-32bit-2.54.3-lp150.3.3.1 libgio-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgio-fam-32bit-2.54.3-lp150.3.3.1 libgio-fam-32bit-debuginfo-2.54.3-lp150.3.3.1 libglib-2_0-0-32bit-2.54.3-lp150.3.3.1 libglib-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgmodule-2_0-0-32bit-2.54.3-lp150.3.3.1 libgmodule-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgobject-2_0-0-32bit-2.54.3-lp150.3.3.1 libgobject-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgthread-2_0-0-32bit-2.54.3-lp150.3.3.1 libgthread-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): gio-branding-upstream-2.54.3-lp150.3.3.1 glib2-lang-2.54.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16428.html https://www.suse.com/security/cve/CVE-2018-16429.html https://bugzilla.suse.com/1107116 https://bugzilla.suse.com/1107121 https://bugzilla.suse.com/1111499 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4004-1: important: Security update for qemu
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4004-1 Rating: important References: #1106222 #1107489 #1110910 #1111006 #1111010 #1111013 #1112499 #1114422 #1114529 Cross-References: CVE-2018-10839 CVE-2018-15746 CVE-2018-16847 CVE-2018-17958 CVE-2018-17962 CVE-2018-17963 CVE-2018-18849 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS (bsc#1110910). - CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread (bsc#1106222). - CVE-2018-16847: Fixed an OOB heap buffer r/w access issue that was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process (bsc#1114529). - CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used (bsc#1111006). - CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used (bsc#1111010). - CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111013) - CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value. A user/process could use this flaw to crash the Qemu process resulting in DoS (bsc#1114422). Non-security issues fixed: - Fix slowness in arm32 emulation (bsc#1112499). - In order to improve spectre mitigation for s390x, add a new feature in the QEMU cpu model to provide the etoken cpu feature for guests (bsc#1107489). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1483=1 Package List: - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.12.1 qemu-seabios-1.11.0-lp150.7.12.1 qemu-sgabios-8-lp150.7.12.1 qemu-vgabios-1.11.0-lp150.7.12.1 - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.12.1 qemu-arm-2.11.2-lp150.7.12.1 qemu-arm-debuginfo-2.11.2-lp150.7.12.1 qemu-block-curl-2.11.2-lp150.7.12.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.12.1 qemu-block-dmg-2.11.2-lp150.7.12.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.12.1 qemu-block-gluster-2.11.2-lp150.7.12.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.12.1 qemu-block-iscsi-2.11.2-lp150.7.12.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.12.1 qemu-block-rbd-2.11.2-lp150.7.12.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.12.1 qemu-block-ssh-2.11.2-lp150.7.12.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.12.1 qemu-debuginfo-2.11.2-lp150.7.12.1 qemu-debugsource-2.11.2-lp150.7.12.1 qemu-extra-2.11.2-lp150.7.12.1 qemu-extra-debuginfo-2.11.2-lp150.7.12.1 qemu-guest-agent-2.11.2-lp150.7.12.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.12.1 qemu-ksm-2.11.2-lp150.7.12.1 qemu-kvm-2.11.2-lp150.7.12.1 qemu-lang-2.11.2-lp150.7.12.1 qemu-linux-user-2.11.2-lp150.7.12.1 qemu-linux-user-debuginfo-2.11.2-lp150.7.12.1 qemu-linux-user-debugsource-2.11.2-lp150.7.12.1 qemu-ppc-2.11.2-lp150.7.12.1 qemu-ppc-debuginfo-2.11.2-lp150.7.12.1 qemu-s390-2.11.2-lp150.7.12.1 qemu-s390-debuginfo-2.11.2-lp150.7.12.1 qemu-testsuite-2.11.2-lp150.7.12.1 qemu-tools-2.11.2-lp150.7.12.1 qemu-tools-debuginfo-2.11.2-lp150.7.12.1 qemu-x86-2.11.2-lp150.7.12.1 qemu-x86-debuginfo-2.11.2-lp150.7.12.1 References: https://www.suse.com/security/cve/CVE-2018-10839.html https://www.suse.com/security/cve/CVE-2018-15746.html https://www.suse.com/security/cve/CVE-2018-16847.html https://www.suse.com/security/cve/CVE-2018-17958.html https://www.suse.com/security/cve/CVE-2018-17962.html https://www.suse.com/security/cve/CVE-2018-17963.html https://www.suse.com/security/cve/CVE-2018-18849.html https://bugzilla.suse.com/1106222 https://bugzilla.suse.com/1107489 https://bugzilla.suse.com/1110910 https://bugzilla.suse.com/1111006 https://bugzilla.suse.com/1111010 https://bugzilla.suse.com/1111013 https://bugzilla.suse.com/1112499 https://bugzilla.suse.com/1114422 https://bugzilla.suse.com/1114529 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4003-1: moderate: Security update for dpdk
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4003-1 Rating: moderate References: #1069601 #1073363 #1089638 #1102310 Cross-References: CVE-2018-1059 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for dpdk to version 16.11.8 provides the following security fix: - CVE-2018-1059: restrict untrusted guest to misuse virtio to corrupt host application (ovs-dpdk) memory which could have lead all VM to lose connectivity (bsc#1089638) and following non-security fixes: - Enable the broadcom chipset family Broadcom NetXtreme II BCM57810 (bsc#1073363) - Fix a latency problem by using cond_resched rather than schedule_timeout_interruptible (bsc#1069601) - Fix a syntax error affecting csh environment configuration (bsc#1102310) - Fixes in net/bnxt: * Fix HW Tx checksum offload check * Fix incorrect IO address handling in Tx * Fix Rx ring count limitation * Check access denied for HWRM commands * Fix RETA size * Fix close operation - Fixes in eal/linux: * Fix an invalid syntax in interrupts * Fix return codes on thread naming failure - Fixes in kni: * Fix crash with null name * Fix build with gcc 8.1 - Fixes in net/thunderx: * Fix build with gcc optimization on * Avoid sq door bell write on zero packet - net/bonding: Fix MAC address reset - vhost: Fix missing increment of log cache count This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1484=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dpdk-16.11.8-6.8.1 dpdk-debuginfo-16.11.8-6.8.1 dpdk-debugsource-16.11.8-6.8.1 dpdk-devel-16.11.8-6.8.1 dpdk-devel-debuginfo-16.11.8-6.8.1 dpdk-examples-16.11.8-6.8.1 dpdk-examples-debuginfo-16.11.8-6.8.1 dpdk-tools-16.11.8-6.8.1 - openSUSE Leap 42.3 (x86_64): dpdk-kmp-default-16.11.8_k4.4.162_78-6.8.1 dpdk-kmp-default-debuginfo-16.11.8_k4.4.162_78-6.8.1 - openSUSE Leap 42.3 (noarch): dpdk-doc-16.11.8-6.8.1 References: https://www.suse.com/security/cve/CVE-2018-1059.html https://bugzilla.suse.com/1069601 https://bugzilla.suse.com/1073363 https://bugzilla.suse.com/1089638 https://bugzilla.suse.com/1102310 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0