April 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1042-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1042-1 Rating: important References: #1086199 #1090000 Cross-References: CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102 CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106 CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114 CVE-2018-6115 CVE-2018-6116 CVE-2018-6117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for Chromium to version 66.0.3359.117 fixes the following issues: Security issues fixed (boo#1090000): - CVE-2018-6085: Use after free in Disk Cache - CVE-2018-6086: Use after free in Disk Cache - CVE-2018-6087: Use after free in WebAssembly - CVE-2018-6088: Use after free in PDFium - CVE-2018-6089: Same origin policy bypass in Service Worker - CVE-2018-6090: Heap buffer overflow in Skia - CVE-2018-6091: Incorrect handling of plug-ins by Service Worker - CVE-2018-6092: Integer overflow in WebAssembly - CVE-2018-6093: Same origin bypass in Service Worker - CVE-2018-6094: Exploit hardening regression in Oilpan - CVE-2018-6095: Lack of meaningful user interaction requirement before file upload - CVE-2018-6096: Fullscreen UI spoof - CVE-2018-6097: Fullscreen UI spoof - CVE-2018-6098: URL spoof in Omnibox - CVE-2018-6099: CORS bypass in ServiceWorker - CVE-2018-6100: URL spoof in Omnibox - CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools - CVE-2018-6102: URL spoof in Omnibox - CVE-2018-6103: UI spoof in Permissions - CVE-2018-6104: URL spoof in Omnibox - CVE-2018-6105: URL spoof in Omnibox - CVE-2018-6106: Incorrect handling of promises in V8 - CVE-2018-6107: URL spoof in Omnibox - CVE-2018-6108: URL spoof in Omnibox - CVE-2018-6109: Incorrect handling of files by FileAPI - CVE-2018-6110: Incorrect handling of plaintext files via file:// - CVE-2018-6111: Heap-use-after-free in DevTools - CVE-2018-6112: Incorrect URL handling in DevTools - CVE-2018-6113: URL spoof in Navigation - CVE-2018-6114: CSP bypass - CVE-2018-6115: SmartScreen bypass in downloads - CVE-2018-6116: Incorrect low memory handling in WebAssembly - CVE-2018-6117: Confusing autofill settings - Various fixes from internal audits, fuzzing and other initiatives This update also supports mitigation against the Spectre vulnerabilities: "Strict site isolation" is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out The following other changes are included: - distrust certificates issued by Symantec before 2016-06-01 - add option to export saved passwords - Reduce videos that auto-play with sound - boo#1086199: Fix UI freezing when loading/scaling down large images This update also contains a number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-381=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-66.0.3359.117-152.1 chromedriver-debuginfo-66.0.3359.117-152.1 chromium-66.0.3359.117-152.1 chromium-debuginfo-66.0.3359.117-152.1 chromium-debugsource-66.0.3359.117-152.1 References: https://www.suse.com/security/cve/CVE-2018-6085.html https://www.suse.com/security/cve/CVE-2018-6086.html https://www.suse.com/security/cve/CVE-2018-6087.html https://www.suse.com/security/cve/CVE-2018-6088.html https://www.suse.com/security/cve/CVE-2018-6089.html https://www.suse.com/security/cve/CVE-2018-6090.html https://www.suse.com/security/cve/CVE-2018-6091.html https://www.suse.com/security/cve/CVE-2018-6092.html https://www.suse.com/security/cve/CVE-2018-6093.html https://www.suse.com/security/cve/CVE-2018-6094.html https://www.suse.com/security/cve/CVE-2018-6095.html https://www.suse.com/security/cve/CVE-2018-6096.html https://www.suse.com/security/cve/CVE-2018-6097.html https://www.suse.com/security/cve/CVE-2018-6098.html https://www.suse.com/security/cve/CVE-2018-6099.html https://www.suse.com/security/cve/CVE-2018-6100.html https://www.suse.com/security/cve/CVE-2018-6101.html https://www.suse.com/security/cve/CVE-2018-6102.html https://www.suse.com/security/cve/CVE-2018-6103.html https://www.suse.com/security/cve/CVE-2018-6104.html https://www.suse.com/security/cve/CVE-2018-6105.html https://www.suse.com/security/cve/CVE-2018-6106.html https://www.suse.com/security/cve/CVE-2018-6107.html https://www.suse.com/security/cve/CVE-2018-6108.html https://www.suse.com/security/cve/CVE-2018-6109.html https://www.suse.com/security/cve/CVE-2018-6110.html https://www.suse.com/security/cve/CVE-2018-6111.html https://www.suse.com/security/cve/CVE-2018-6112.html https://www.suse.com/security/cve/CVE-2018-6113.html https://www.suse.com/security/cve/CVE-2018-6114.html https://www.suse.com/security/cve/CVE-2018-6115.html https://www.suse.com/security/cve/CVE-2018-6116.html https://www.suse.com/security/cve/CVE-2018-6117.html https://bugzilla.suse.com/1086199 https://bugzilla.suse.com/1090000 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1038-1: important: Security update for cfitsio
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

openSUSE Security Update: Security update for cfitsio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1038-1 Rating: important References: #1082318 #1088590 Cross-References: CVE-2018-1000166 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for cfitsio fixes the following issues: Security issues fixed: - CVE-2018-1000166: Unsafe use of sprintf() can allow a remote unauthenticated attacker to execute arbitrary code (boo#1088590) This update to version 3.430 also contains a number of upstream bug fixes. The following tracked packaging changes are included: - boo#1082318: package licence text as license, not as documentation Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-383=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cfitsio-3.430-4.3.1 cfitsio-debuginfo-3.430-4.3.1 cfitsio-debugsource-3.430-4.3.1 cfitsio-devel-3.430-4.3.1 cfitsio-devel-doc-3.430-4.3.1 libcfitsio5-3.430-4.3.1 libcfitsio5-debuginfo-3.430-4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000166.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1088590 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1035-1: important: Security update for the Linux Kernel (Live Patch 33 for SLE 12)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 33 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1035-1 Rating: important References: #1083488 Cross-References: CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.61-52_125 fixes one issue. The following security issue was fixed: - CVE-2018-7566: The Linux kernel had a buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-708=1 Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_125-default-2-2.1 kgraft-patch-3_12_61-52_125-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1083488 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1034-1: important: Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP1)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1034-1 Rating: important References: #1076017 #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1000004 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_63 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447). - CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-692=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-692=1 Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_63-default-4-2.1 kgraft-patch-3_12_74-60_64_63-xen-4-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_63-default-4-2.1 kgraft-patch-3_12_74-60_64_63-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1033-1: important: Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP2)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1033-1 Rating: important References: #1073230 #1076017 #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1000004 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP2 SUSE Linux Enterprise Server 12-SP2-LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for the Linux Kernel 4.4.74-92_29 fixes several issues. The following security issues were fixed: - CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447). - CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488). - CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2018-669=1 - SUSE Linux Enterprise Server 12-SP2-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-669=1 Package List: - SUSE Linux Enterprise Server for SAP 12-SP2 (x86_64): kgraft-patch-4_4_74-92_29-default-9-2.2 - SUSE Linux Enterprise Server 12-SP2-LTSS (x86_64): kgraft-patch-4_4_74-92_29-default-9-2.2 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1073230 https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1032-1: important: Security update for the Linux Kernel (Live Patch 19 for SLE 12 SP1)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 19 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1032-1 Rating: important References: #1076017 #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1000004 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447). - CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-685=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-685=1 Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_54-default-7-2.1 kgraft-patch-3_12_74-60_64_54-xen-7-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_54-default-7-2.1 kgraft-patch-3_12_74-60_64_54-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1031-1: important: Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP2)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1031-1 Rating: important References: #1073230 #1076017 #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1000004 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP2 SUSE Linux Enterprise Server 12-SP2-LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for the Linux Kernel 4.4.103-92_56 fixes several issues. The following security issues were fixed: - CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447). - CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488). - CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2018-671=1 - SUSE Linux Enterprise Server 12-SP2-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-671=1 Package List: - SUSE Linux Enterprise Server for SAP 12-SP2 (x86_64): kgraft-patch-4_4_103-92_56-default-4-2.2 - SUSE Linux Enterprise Server 12-SP2-LTSS (x86_64): kgraft-patch-4_4_103-92_56-default-4-2.2 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1073230 https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1030-1: important: Security update for the Linux Kernel (Live Patch 32 for SLE 12)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 32 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1030-1 Rating: important References: #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_122 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447). - CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-7566: The Linux kernel had a buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-707=1 Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_122-default-3-2.1 kgraft-patch-3_12_61-52_122-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1029-1: important: Security update for the Linux Kernel (Live Patch 29 for SLE 12)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 29 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1029-1 Rating: important References: #1076017 #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1000004 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_106 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447). - CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-697=1 Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_106-default-4-2.1 kgraft-patch-3_12_61-52_106-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:1028-1: important: Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP3)
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP3) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1028-1 Rating: important References: #1073230 #1076017 #1083488 #1085114 #1085447 Cross-References: CVE-2017-13166 CVE-2018-1000004 CVE-2018-1068 CVE-2018-7566 Affected Products: SUSE Linux Enterprise Live Patching 12-SP3 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for the Linux Kernel 4.4.92-6_30 fixes several issues. The following security issues were fixed: - CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447). - CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114). - CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488). - CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2018-680=1 Package List: - SUSE Linux Enterprise Live Patching 12-SP3 (ppc64le x86_64): kgraft-patch-4_4_92-6_30-default-4-2.1 kgraft-patch-4_4_92-6_30-default-debuginfo-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-13166.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-1068.html https://www.suse.com/security/cve/CVE-2018-7566.html https://bugzilla.suse.com/1073230 https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1083488 https://bugzilla.suse.com/1085114 https://bugzilla.suse.com/1085447 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0