December 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:4029-1: Security update for messagelib
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4029-1 Rating: low References: #1117958 Cross-References: CVE-2018-19516 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for messagelib fixes the following issues: The following security vulnerability was addressed: - CVE-2018-19516: Fix a potential issue with opening messages in a new browser window when displaying mails as HTML (boo#1117958). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1508=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1508=1 Package List: - openSUSE Leap 15.0 (x86_64): messagelib-17.12.3-lp150.2.6.1 messagelib-debuginfo-17.12.3-lp150.2.6.1 messagelib-debugsource-17.12.3-lp150.2.6.1 messagelib-devel-17.12.3-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): messagelib-lang-17.12.3-lp150.2.6.1 - openSUSE Backports SLE-15 (x86_64): messagelib-17.12.3-bp150.3.6.1 messagelib-devel-17.12.3-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): messagelib-lang-17.12.3-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19516.html https://bugzilla.suse.com/1117958 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4007-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4007-1 Rating: important References: #1104199 Cross-References: CVE-2018-10915 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql94 to 9.4.19 fixes the following security issue: - CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could have bypassed client-side connection security features, obtain access to higher privileged connections or potentially cause other impact SQL injection, by causing the PQescape() functions to malfunction (bsc#1104199). A dump/restore is not required for this update unless you use the functions query_to_xml, cursor_to_xml, cursor_to_xmlschema, query_to_xmlschema, and query_to_xml_and_xmlschema. In this case please see the first entry of https://www.postgresql.org/docs/9.4/static/release-9-4-18.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1482=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.19-24.1 postgresql94-contrib-9.4.19-24.1 postgresql94-contrib-debuginfo-9.4.19-24.1 postgresql94-debuginfo-9.4.19-24.1 postgresql94-debugsource-9.4.19-24.1 postgresql94-devel-9.4.19-24.1 postgresql94-devel-debuginfo-9.4.19-24.1 postgresql94-libs-debugsource-9.4.19-24.1 postgresql94-plperl-9.4.19-24.1 postgresql94-plperl-debuginfo-9.4.19-24.1 postgresql94-plpython-9.4.19-24.1 postgresql94-plpython-debuginfo-9.4.19-24.1 postgresql94-pltcl-9.4.19-24.1 postgresql94-pltcl-debuginfo-9.4.19-24.1 postgresql94-server-9.4.19-24.1 postgresql94-server-debuginfo-9.4.19-24.1 postgresql94-test-9.4.19-24.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.19-24.1 References: https://www.suse.com/security/cve/CVE-2018-10915.html https://bugzilla.suse.com/1104199 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4005-1: moderate: Security update for glib2
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for glib2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4005-1 Rating: moderate References: #1107116 #1107121 #1111499 Cross-References: CVE-2018-16428 CVE-2018-16429 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for glib2 fixes the following issues: Security issues fixed: - CVE-2018-16428: Do not do a NULL pointer dereference (crash). Avoid that, at the cost of introducing a new translatable error message (bsc#1107121). - CVE-2018-16429: Fixed out-of-bounds read vulnerability ing_markup_parse_context_parse() (bsc#1107116). Non-security issue fixed: - various GVariant parsing issues have been resolved (bsc#1111499) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1485=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): glib2-debugsource-2.54.3-lp150.3.3.1 glib2-devel-2.54.3-lp150.3.3.1 glib2-devel-debuginfo-2.54.3-lp150.3.3.1 glib2-devel-static-2.54.3-lp150.3.3.1 glib2-tools-2.54.3-lp150.3.3.1 glib2-tools-debuginfo-2.54.3-lp150.3.3.1 libgio-2_0-0-2.54.3-lp150.3.3.1 libgio-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgio-fam-2.54.3-lp150.3.3.1 libgio-fam-debuginfo-2.54.3-lp150.3.3.1 libglib-2_0-0-2.54.3-lp150.3.3.1 libglib-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgmodule-2_0-0-2.54.3-lp150.3.3.1 libgmodule-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgobject-2_0-0-2.54.3-lp150.3.3.1 libgobject-2_0-0-debuginfo-2.54.3-lp150.3.3.1 libgthread-2_0-0-2.54.3-lp150.3.3.1 libgthread-2_0-0-debuginfo-2.54.3-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): glib2-devel-32bit-2.54.3-lp150.3.3.1 glib2-devel-32bit-debuginfo-2.54.3-lp150.3.3.1 glib2-tools-32bit-2.54.3-lp150.3.3.1 glib2-tools-32bit-debuginfo-2.54.3-lp150.3.3.1 libgio-2_0-0-32bit-2.54.3-lp150.3.3.1 libgio-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgio-fam-32bit-2.54.3-lp150.3.3.1 libgio-fam-32bit-debuginfo-2.54.3-lp150.3.3.1 libglib-2_0-0-32bit-2.54.3-lp150.3.3.1 libglib-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgmodule-2_0-0-32bit-2.54.3-lp150.3.3.1 libgmodule-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgobject-2_0-0-32bit-2.54.3-lp150.3.3.1 libgobject-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 libgthread-2_0-0-32bit-2.54.3-lp150.3.3.1 libgthread-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): gio-branding-upstream-2.54.3-lp150.3.3.1 glib2-lang-2.54.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16428.html https://www.suse.com/security/cve/CVE-2018-16429.html https://bugzilla.suse.com/1107116 https://bugzilla.suse.com/1107121 https://bugzilla.suse.com/1111499 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4004-1: important: Security update for qemu
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4004-1 Rating: important References: #1106222 #1107489 #1110910 #1111006 #1111010 #1111013 #1112499 #1114422 #1114529 Cross-References: CVE-2018-10839 CVE-2018-15746 CVE-2018-16847 CVE-2018-17958 CVE-2018-17962 CVE-2018-17963 CVE-2018-18849 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS (bsc#1110910). - CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread (bsc#1106222). - CVE-2018-16847: Fixed an OOB heap buffer r/w access issue that was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process (bsc#1114529). - CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used (bsc#1111006). - CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used (bsc#1111010). - CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111013) - CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value. A user/process could use this flaw to crash the Qemu process resulting in DoS (bsc#1114422). Non-security issues fixed: - Fix slowness in arm32 emulation (bsc#1112499). - In order to improve spectre mitigation for s390x, add a new feature in the QEMU cpu model to provide the etoken cpu feature for guests (bsc#1107489). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1483=1 Package List: - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.12.1 qemu-seabios-1.11.0-lp150.7.12.1 qemu-sgabios-8-lp150.7.12.1 qemu-vgabios-1.11.0-lp150.7.12.1 - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.12.1 qemu-arm-2.11.2-lp150.7.12.1 qemu-arm-debuginfo-2.11.2-lp150.7.12.1 qemu-block-curl-2.11.2-lp150.7.12.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.12.1 qemu-block-dmg-2.11.2-lp150.7.12.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.12.1 qemu-block-gluster-2.11.2-lp150.7.12.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.12.1 qemu-block-iscsi-2.11.2-lp150.7.12.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.12.1 qemu-block-rbd-2.11.2-lp150.7.12.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.12.1 qemu-block-ssh-2.11.2-lp150.7.12.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.12.1 qemu-debuginfo-2.11.2-lp150.7.12.1 qemu-debugsource-2.11.2-lp150.7.12.1 qemu-extra-2.11.2-lp150.7.12.1 qemu-extra-debuginfo-2.11.2-lp150.7.12.1 qemu-guest-agent-2.11.2-lp150.7.12.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.12.1 qemu-ksm-2.11.2-lp150.7.12.1 qemu-kvm-2.11.2-lp150.7.12.1 qemu-lang-2.11.2-lp150.7.12.1 qemu-linux-user-2.11.2-lp150.7.12.1 qemu-linux-user-debuginfo-2.11.2-lp150.7.12.1 qemu-linux-user-debugsource-2.11.2-lp150.7.12.1 qemu-ppc-2.11.2-lp150.7.12.1 qemu-ppc-debuginfo-2.11.2-lp150.7.12.1 qemu-s390-2.11.2-lp150.7.12.1 qemu-s390-debuginfo-2.11.2-lp150.7.12.1 qemu-testsuite-2.11.2-lp150.7.12.1 qemu-tools-2.11.2-lp150.7.12.1 qemu-tools-debuginfo-2.11.2-lp150.7.12.1 qemu-x86-2.11.2-lp150.7.12.1 qemu-x86-debuginfo-2.11.2-lp150.7.12.1 References: https://www.suse.com/security/cve/CVE-2018-10839.html https://www.suse.com/security/cve/CVE-2018-15746.html https://www.suse.com/security/cve/CVE-2018-16847.html https://www.suse.com/security/cve/CVE-2018-17958.html https://www.suse.com/security/cve/CVE-2018-17962.html https://www.suse.com/security/cve/CVE-2018-17963.html https://www.suse.com/security/cve/CVE-2018-18849.html https://bugzilla.suse.com/1106222 https://bugzilla.suse.com/1107489 https://bugzilla.suse.com/1110910 https://bugzilla.suse.com/1111006 https://bugzilla.suse.com/1111010 https://bugzilla.suse.com/1111013 https://bugzilla.suse.com/1112499 https://bugzilla.suse.com/1114422 https://bugzilla.suse.com/1114529 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4003-1: moderate: Security update for dpdk
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4003-1 Rating: moderate References: #1069601 #1073363 #1089638 #1102310 Cross-References: CVE-2018-1059 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for dpdk to version 16.11.8 provides the following security fix: - CVE-2018-1059: restrict untrusted guest to misuse virtio to corrupt host application (ovs-dpdk) memory which could have lead all VM to lose connectivity (bsc#1089638) and following non-security fixes: - Enable the broadcom chipset family Broadcom NetXtreme II BCM57810 (bsc#1073363) - Fix a latency problem by using cond_resched rather than schedule_timeout_interruptible (bsc#1069601) - Fix a syntax error affecting csh environment configuration (bsc#1102310) - Fixes in net/bnxt: * Fix HW Tx checksum offload check * Fix incorrect IO address handling in Tx * Fix Rx ring count limitation * Check access denied for HWRM commands * Fix RETA size * Fix close operation - Fixes in eal/linux: * Fix an invalid syntax in interrupts * Fix return codes on thread naming failure - Fixes in kni: * Fix crash with null name * Fix build with gcc 8.1 - Fixes in net/thunderx: * Fix build with gcc optimization on * Avoid sq door bell write on zero packet - net/bonding: Fix MAC address reset - vhost: Fix missing increment of log cache count This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1484=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dpdk-16.11.8-6.8.1 dpdk-debuginfo-16.11.8-6.8.1 dpdk-debugsource-16.11.8-6.8.1 dpdk-devel-16.11.8-6.8.1 dpdk-devel-debuginfo-16.11.8-6.8.1 dpdk-examples-16.11.8-6.8.1 dpdk-examples-debuginfo-16.11.8-6.8.1 dpdk-tools-16.11.8-6.8.1 - openSUSE Leap 42.3 (x86_64): dpdk-kmp-default-16.11.8_k4.4.162_78-6.8.1 dpdk-kmp-default-debuginfo-16.11.8_k4.4.162_78-6.8.1 - openSUSE Leap 42.3 (noarch): dpdk-doc-16.11.8-6.8.1 References: https://www.suse.com/security/cve/CVE-2018-1059.html https://bugzilla.suse.com/1069601 https://bugzilla.suse.com/1073363 https://bugzilla.suse.com/1089638 https://bugzilla.suse.com/1102310 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:4002-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4002-1 Rating: moderate References: #1114817 Cross-References: CVE-2018-3780 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud fixes security issues and bugs. Security issues fixed: - CVE-2018-3780: Stored XSS in autocomplete suggestions for file comments (boo#1114817) This update also contains all bug fixes and improvements in the 13.0.8 version, including: - Password expiration time changed from 12h to 7d - Bug fixes to the OAuth brute force protection - Various other bug fixes and improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1487=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1487=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1487=1 Package List: - openSUSE Leap 42.3 (noarch): nextcloud-13.0.8-15.1 - openSUSE Leap 15.0 (noarch): nextcloud-13.0.8-lp150.2.9.1 - openSUSE Backports SLE-15 (noarch): nextcloud-13.0.8-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1114817 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3999-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3999-1 Rating: moderate References: #1114817 Cross-References: CVE-2018-3780 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud fixes security issues and bugs. Security issues fixed: - CVE-2018-3780: Stored XSS in autocomplete suggestions for file comments (boo#1114817) This update also contains all bug fixes and improvements in the 13.0.8 version, including: - Password expiration time changed from 12h to 7d - Bug fixes to the OAuth brute force protection - Various other bug fixes and improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1487=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-13.0.8-8.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1114817 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:3998-1: moderate: Security update for dom4j
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3998-1 Rating: moderate References: #1105443 Cross-References: CVE-2018-1000632 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection that could have resulted in an attacker tampering with XML documents (bsc#1105443). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1486=1 Package List: - openSUSE Leap 15.0 (noarch): dom4j-1.6.1-lp150.3.3.1 dom4j-demo-1.6.1-lp150.3.3.1 dom4j-javadoc-1.6.1-lp150.3.3.1 dom4j-manual-1.6.1-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000632.html https://bugzilla.suse.com/1105443 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0