openSUSE Security Announce May 2018

security-announce@lists.opensuse.org

2 participants
115 discussions

[security-announce] openSUSE-SU-2018:1470-1: important: Security update for ceph
by opensuse-security＠opensuse.org 30 May '18

30 May '18

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1470-1 Rating: important References: #1051598 #1054061 #1056125 #1056967 #1059458 #1060904 #1061461 #1063014 #1066182 #1066502 #1067088 #1067119 #1067705 #1070357 #1071386 #1074301 #1079076 #1080788 #1081379 #1081600 #1086340 #1087269 #1087493 Cross-References: CVE-2017-16818 CVE-2018-7262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 21 fixes is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379). - CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014). Bug fixes: - bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster. - bsc#1079076: RGW openssl fixes. - bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start. - bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool. - bsc#1087269: allow_ec_overwrites option not in command options list. - bsc#1051598: Fix mountpoint check for systemctl enable --runtime. - bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR. - bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster. - bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs. - bsc#1060904: Loglevel misleading during keystone authentication. - bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs. - bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2. - bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw. - bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy. - bsc#1066182: Container synchronization between two Ceph clusters failed. - bsc#1081600: Crash in civetweb/RGW. - bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client. - bsc#1074301: OSDs keep aborting: SnapMapper failed asserts. - bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled. - bsc#1080788: fsid mismatch when creating additional OSDs. - bsc#1071386: Metadata spill onto block.slow. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-541=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 References: https://www.suse.com/security/cve/CVE-2017-16818.html https://www.suse.com/security/cve/CVE-2018-7262.html https://bugzilla.suse.com/1051598 https://bugzilla.suse.com/1054061 https://bugzilla.suse.com/1056125 https://bugzilla.suse.com/1056967 https://bugzilla.suse.com/1059458 https://bugzilla.suse.com/1060904 https://bugzilla.suse.com/1061461 https://bugzilla.suse.com/1063014 https://bugzilla.suse.com/1066182 https://bugzilla.suse.com/1066502 https://bugzilla.suse.com/1067088 https://bugzilla.suse.com/1067119 https://bugzilla.suse.com/1067705 https://bugzilla.suse.com/1070357 https://bugzilla.suse.com/1071386 https://bugzilla.suse.com/1074301 https://bugzilla.suse.com/1079076 https://bugzilla.suse.com/1080788 https://bugzilla.suse.com/1081379 https://bugzilla.suse.com/1081600 https://bugzilla.suse.com/1086340 https://bugzilla.suse.com/1087269 https://bugzilla.suse.com/1087493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1463-1: moderate: Security update for perl-DBD-mysql
by opensuse-security＠opensuse.org 29 May '18

29 May '18

openSUSE Security Update: Security update for perl-DBD-mysql ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1463-1 Rating: moderate References: #1047059 #1047095 Cross-References: CVE-2017-10788 CVE-2017-10789 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for perl-DBD-mysql fixes the following issues: - CVE-2017-10789: The DBD::mysql module when with mysql_ssl=1 setting enabled, means that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which could lead man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152. (bsc#1047059) - CVE-2017-10788: The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. (bsc#1047095) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-539=1 Package List: - openSUSE Leap 42.3 (x86_64): perl-DBD-mysql-4.021-18.3.1 perl-DBD-mysql-debuginfo-4.021-18.3.1 perl-DBD-mysql-debugsource-4.021-18.3.1 References: https://www.suse.com/security/cve/CVE-2017-10788.html https://www.suse.com/security/cve/CVE-2017-10789.html https://bugzilla.suse.com/1047059 https://bugzilla.suse.com/1047095 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1462-1: Security update for pdns
by opensuse-security＠opensuse.org 29 May '18

29 May '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1462-1 Rating: low References: #1092540 Cross-References: CVE-2018-1046 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: pdns was updated to 4.1.2. Security fixes: * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540) Improvements: * API: increase serial after dnssec related updates * Auth: lower ‘packet too short’ loglevel * Make check-zone error on rows that have content but shouldn’t * Auth: avoid an isane amount of new backend connections during an axfr * Report unparseable data in stoul invalid_argument exception * Backport: recheck serial when axfr is done * Backport: add tcp support for alias Bug Fixes: * Auth: allocate new statements after reconnecting to postgresql * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer) * Rather than crash, sheepishly report no file/linenum * Document undocumented config vars * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate Misc fixes: * Move includes around to avoid boost L conflict * Backport: update edns option code list * Auth: link dnspcap2protobuf against librt when needed * Fix a warning on botan >= 2.5.0 * Auth 4.1.x: unbreak build Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-538=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-8.1 pdns-backend-godbc-4.1.2-8.1 pdns-backend-ldap-4.1.2-8.1 pdns-backend-lua-4.1.2-8.1 pdns-backend-mydns-4.1.2-8.1 pdns-backend-mysql-4.1.2-8.1 pdns-backend-postgresql-4.1.2-8.1 pdns-backend-remote-4.1.2-8.1 pdns-backend-sqlite3-4.1.2-8.1 References: https://www.suse.com/security/cve/CVE-2018-1046.html https://bugzilla.suse.com/1092540 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1454-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 28 May '18

28 May '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1454-1 Rating: moderate References: #1094781 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for enigmail to version 2.0.6 fixes the following issues: Security issues fixed: - Replies to a partially encrypted message may have revealed protected information: no longer display PGP/MIME message part followed by unencrypted data (boo#1094781) - Signature could be spoofed via Inline-PGP in HTML Mails The following bugs were fixed: - Filter actions could forget selected mail folder names Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-535=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-535=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): enigmail-2.0.6-18.1 - openSUSE Leap 15.0 (x86_64): enigmail-2.0.6-lp150.2.9.1 References: https://bugzilla.suse.com/1094781 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1451-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 28 May '18

28 May '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1451-1 Rating: moderate References: #1094781 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for enigmail to version 2.0.6 fixes the following issues: Security issues fixed: - Replies to a partially encrypted message may have revealed protected information: no longer display PGP/MIME message part followed by unencrypted data (boo#1094781) - Signature could be spoofed via Inline-PGP in HTML Mails The following bugs were fixed: - Filter actions could forget selected mail folder names Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-535=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.6-15.1 References: https://bugzilla.suse.com/1094781 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1442-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 28 May '18

28 May '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1442-1 Rating: moderate References: #1092540 Cross-References: CVE-2018-1046 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-1046: Fix an issue with replaying a specially crafted PCAP file that can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution (bsc#1092540). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-532=1 Package List: - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.3.1 pdns-backend-geoip-4.1.2-lp150.3.3.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-godbc-4.1.2-lp150.3.3.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-ldap-4.1.2-lp150.3.3.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-lua-4.1.2-lp150.3.3.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-mydns-4.1.2-lp150.3.3.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-mysql-4.1.2-lp150.3.3.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-postgresql-4.1.2-lp150.3.3.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-remote-4.1.2-lp150.3.3.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.3.1 pdns-backend-sqlite3-4.1.2-lp150.3.3.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.3.1 pdns-debuginfo-4.1.2-lp150.3.3.1 pdns-debugsource-4.1.2-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1046.html https://bugzilla.suse.com/1092540 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1440-1: Security update for jasper
by opensuse-security＠opensuse.org 28 May '18

28 May '18

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1440-1 Rating: low References: #1087020 Cross-References: CVE-2018-9055 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jasper fixes the following issues: - CVE-2018-9055: denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c could lead to denial of service. (bsc#1087020) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-531=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): jasper-1.900.14-182.1 jasper-debuginfo-1.900.14-182.1 jasper-debugsource-1.900.14-182.1 libjasper-devel-1.900.14-182.1 libjasper1-1.900.14-182.1 libjasper1-debuginfo-1.900.14-182.1 - openSUSE Leap 42.3 (x86_64): libjasper1-32bit-1.900.14-182.1 libjasper1-debuginfo-32bit-1.900.14-182.1 References: https://www.suse.com/security/cve/CVE-2018-9055.html https://bugzilla.suse.com/1087020 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1439-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 28 May '18

28 May '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1439-1 Rating: moderate References: #1094204 Cross-References: CVE-2017-18271 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2017-18271: An infinite loop in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service was fixed. (boo#1094204) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-533=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-90.1 GraphicsMagick-debuginfo-1.3.25-90.1 GraphicsMagick-debugsource-1.3.25-90.1 GraphicsMagick-devel-1.3.25-90.1 libGraphicsMagick++-Q16-12-1.3.25-90.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-90.1 libGraphicsMagick++-devel-1.3.25-90.1 libGraphicsMagick-Q16-3-1.3.25-90.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-90.1 libGraphicsMagick3-config-1.3.25-90.1 libGraphicsMagickWand-Q16-2-1.3.25-90.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-90.1 perl-GraphicsMagick-1.3.25-90.1 perl-GraphicsMagick-debuginfo-1.3.25-90.1 References: https://www.suse.com/security/cve/CVE-2017-18271.html https://bugzilla.suse.com/1094204 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1438-1: important: Security update for opencv
by opensuse-security＠opensuse.org 28 May '18

28 May '18

openSUSE Security Update: Security update for opencv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1438-1 Rating: important References: #1074312 #1074313 #1074487 #1075017 #1075019 Cross-References: CVE-2017-1000450 CVE-2017-17760 CVE-2017-18009 CVE-2018-5268 CVE-2018-5269 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for opencv fixes the following issues: - CVE-2018-5268: Fixed a heap-based buffer overflow in incv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cppwhen parsing a crafted image file. (boo#1075017) - CVE-2017-17760: Fixed an buffer overflow in function cv::PxMDecoder::readData (boo#1074313) - CVE-2017-18009: Fixed a heap-based buffer over-read in function cv::HdrDecoder::checkSignature (boo#1074312) - CVE-2017-1000450: Functions FillUniColor and FillUniGray do not check the input length which could lead to out of bounds writes and crashes (boo#1074487) - CVE-2018-5269: Fixed an assertion failure happens in cv::RBaseStream::setPos inmodules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast (bsc#1075019). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-534=1 Package List: - openSUSE Leap 42.3 (x86_64): libopencv-qt56_3-3.1.0-4.11.1 libopencv-qt56_3-debuginfo-3.1.0-4.11.1 libopencv3_1-3.1.0-4.11.1 libopencv3_1-debuginfo-3.1.0-4.11.1 opencv-3.1.0-4.11.1 opencv-debuginfo-3.1.0-4.11.1 opencv-debugsource-3.1.0-4.11.1 opencv-devel-3.1.0-4.11.1 opencv-doc-3.1.0-4.11.1 opencv-qt5-3.1.0-4.11.1 opencv-qt5-debuginfo-3.1.0-4.11.1 opencv-qt5-debugsource-3.1.0-4.11.1 opencv-qt5-devel-3.1.0-4.11.1 opencv-qt5-doc-3.1.0-4.11.1 python-opencv-3.1.0-4.11.1 python-opencv-debuginfo-3.1.0-4.11.1 python-opencv-qt5-3.1.0-4.11.1 python-opencv-qt5-debuginfo-3.1.0-4.11.1 python3-opencv-3.1.0-4.11.1 python3-opencv-debuginfo-3.1.0-4.11.1 python3-opencv-qt5-3.1.0-4.11.1 python3-opencv-qt5-debuginfo-3.1.0-4.11.1 References: https://www.suse.com/security/cve/CVE-2017-1000450.html https://www.suse.com/security/cve/CVE-2017-17760.html https://www.suse.com/security/cve/CVE-2017-18009.html https://www.suse.com/security/cve/CVE-2018-5268.html https://www.suse.com/security/cve/CVE-2018-5269.html https://bugzilla.suse.com/1074312 https://bugzilla.suse.com/1074313 https://bugzilla.suse.com/1074487 https://bugzilla.suse.com/1075017 https://bugzilla.suse.com/1075019 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1437-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 27 May '18

27 May '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1437-1 Rating: important References: #1084296 #1086124 #1090000 #1091288 #1092272 #1092923 #1093031 Cross-References: CVE-2017-11215 CVE-2017-11225 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073 CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077 CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081 CVE-2018-6082 CVE-2018-6083 CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102 CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106 CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114 CVE-2018-6115 CVE-2018-6116 CVE-2018-6117 CVE-2018-6118 CVE-2018-6120 CVE-2018-6121 CVE-2018-6122 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 64 vulnerabilities is now available. Description: This update for Chromium to version 66.0.3359.181 fixes the following issues: - CVE-2018-6118: Use after free in Media Cache (bsc#1091288) - CVE-2018-6085: Use after free in Disk Cache - CVE-2018-6086: Use after free in Disk Cache - CVE-2018-6087: Use after free in WebAssembly - CVE-2018-6088: Use after free in PDFium - CVE-2018-6089: Same origin policy bypass in Service Worker - CVE-2018-6090: Heap buffer overflow in Skia - CVE-2018-6091: Incorrect handling of plug-ins by Service Worker - CVE-2018-6092: Integer overflow in WebAssembly - CVE-2018-6093: Same origin bypass in Service Worker - CVE-2018-6094: Exploit hardening regression in Oilpan - CVE-2018-6095: Lack of meaningful user interaction requirement before file upload - CVE-2018-6096: Fullscreen UI spoof - CVE-2018-6097: Fullscreen UI spoof - CVE-2018-6098: URL spoof in Omnibox - CVE-2018-6099: CORS bypass in ServiceWorker - CVE-2018-6100: URL spoof in Omnibox - CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools - CVE-2018-6102: URL spoof in Omnibox - CVE-2018-6103: UI spoof in Permissions - CVE-2018-6104: URL spoof in Omnibox - CVE-2018-6105: URL spoof in Omnibox - CVE-2018-6106: Incorrect handling of promises in V8 - CVE-2018-6107: URL spoof in Omnibox - CVE-2018-6108: URL spoof in Omnibox - CVE-2018-6109: Incorrect handling of files by FileAPI - CVE-2018-6110: Incorrect handling of plaintext files via file:// - CVE-2018-6111: Heap-use-after-free in DevTools - CVE-2018-6112: Incorrect URL handling in DevTools - CVE-2018-6113: URL spoof in Navigation - CVE-2018-6114: CSP bypass - CVE-2018-6115: SmartScreen bypass in downloads - CVE-2018-6116: Incorrect low memory handling in WebAssembly - CVE-2018-6117: Confusing autofill settings - CVE-2017-11215: Use after free in Flash - CVE-2017-11225: Use after free in Flash - CVE-2018-6060: Use after free in Blink - CVE-2018-6061: Race condition in V8 - CVE-2018-6062: Heap buffer overflow in Skia - CVE-2018-6057: Incorrect permissions on shared memory - CVE-2018-6063: Incorrect permissions on shared memory - CVE-2018-6064: Type confusion in V8 - CVE-2018-6065: Integer overflow in V8 - CVE-2018-6066: Same Origin Bypass via canvas - CVE-2018-6067: Buffer overflow in Skia - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab - CVE-2018-6069: Stack buffer overflow in Skia - CVE-2018-6070: CSP bypass through extensions - CVE-2018-6071: Heap bufffer overflow in Skia - CVE-2018-6072: Integer overflow in PDFium - CVE-2018-6073: Heap bufffer overflow in WebGL - CVE-2018-6074: Mark-of-the-Web bypass - CVE-2018-6075: Overly permissive cross origin downloads - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink - CVE-2018-6077: Timing attack using SVG filters - CVE-2018-6078: URL Spoof in OmniBox - CVE-2018-6079: Information disclosure via texture data in WebGL - CVE-2018-6080: Information disclosure in IPC call - CVE-2018-6081: XSS in interstitials - CVE-2018-6082: Circumvention of port blocking - CVE-2018-6083: Incorrect processing of AppManifests - CVE-2018-6121: Privilege Escalation in extensions - CVE-2018-6122: Type confusion in V8 - CVE-2018-6120: Heap buffer overflow in PDFium - bsc#1086124: Various fixes from internal audits, fuzzing and other initiatives This update also supports mitigation against the Spectre vulnerabilities: "Strict site isolation" is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out The following tracked packaging bug were fixed: - Chromium could not be installed from SUSE PackageHub 12 without having the SDK enabled (bsc#1070421) - Chromium could not be installed when libminizip1 was not available (bsc#1093031) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-436=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-66.0.3359.181-55.1 chromedriver-debuginfo-66.0.3359.181-55.1 chromium-66.0.3359.181-55.1 chromium-debuginfo-66.0.3359.181-55.1 chromium-debugsource-66.0.3359.181-55.1 References: https://www.suse.com/security/cve/CVE-2017-11215.html https://www.suse.com/security/cve/CVE-2017-11225.html https://www.suse.com/security/cve/CVE-2018-6057.html https://www.suse.com/security/cve/CVE-2018-6060.html https://www.suse.com/security/cve/CVE-2018-6061.html https://www.suse.com/security/cve/CVE-2018-6062.html https://www.suse.com/security/cve/CVE-2018-6063.html https://www.suse.com/security/cve/CVE-2018-6064.html https://www.suse.com/security/cve/CVE-2018-6065.html https://www.suse.com/security/cve/CVE-2018-6066.html https://www.suse.com/security/cve/CVE-2018-6067.html https://www.suse.com/security/cve/CVE-2018-6068.html https://www.suse.com/security/cve/CVE-2018-6069.html https://www.suse.com/security/cve/CVE-2018-6070.html https://www.suse.com/security/cve/CVE-2018-6071.html https://www.suse.com/security/cve/CVE-2018-6072.html https://www.suse.com/security/cve/CVE-2018-6073.html https://www.suse.com/security/cve/CVE-2018-6074.html https://www.suse.com/security/cve/CVE-2018-6075.html https://www.suse.com/security/cve/CVE-2018-6076.html https://www.suse.com/security/cve/CVE-2018-6077.html https://www.suse.com/security/cve/CVE-2018-6078.html https://www.suse.com/security/cve/CVE-2018-6079.html https://www.suse.com/security/cve/CVE-2018-6080.html https://www.suse.com/security/cve/CVE-2018-6081.html https://www.suse.com/security/cve/CVE-2018-6082.html https://www.suse.com/security/cve/CVE-2018-6083.html https://www.suse.com/security/cve/CVE-2018-6085.html https://www.suse.com/security/cve/CVE-2018-6086.html https://www.suse.com/security/cve/CVE-2018-6087.html https://www.suse.com/security/cve/CVE-2018-6088.html https://www.suse.com/security/cve/CVE-2018-6089.html https://www.suse.com/security/cve/CVE-2018-6090.html https://www.suse.com/security/cve/CVE-2018-6091.html https://www.suse.com/security/cve/CVE-2018-6092.html https://www.suse.com/security/cve/CVE-2018-6093.html https://www.suse.com/security/cve/CVE-2018-6094.html https://www.suse.com/security/cve/CVE-2018-6095.html https://www.suse.com/security/cve/CVE-2018-6096.html https://www.suse.com/security/cve/CVE-2018-6097.html https://www.suse.com/security/cve/CVE-2018-6098.html https://www.suse.com/security/cve/CVE-2018-6099.html https://www.suse.com/security/cve/CVE-2018-6100.html https://www.suse.com/security/cve/CVE-2018-6101.html https://www.suse.com/security/cve/CVE-2018-6102.html https://www.suse.com/security/cve/CVE-2018-6103.html https://www.suse.com/security/cve/CVE-2018-6104.html https://www.suse.com/security/cve/CVE-2018-6105.html https://www.suse.com/security/cve/CVE-2018-6106.html https://www.suse.com/security/cve/CVE-2018-6107.html https://www.suse.com/security/cve/CVE-2018-6108.html https://www.suse.com/security/cve/CVE-2018-6109.html https://www.suse.com/security/cve/CVE-2018-6110.html https://www.suse.com/security/cve/CVE-2018-6111.html https://www.suse.com/security/cve/CVE-2018-6112.html https://www.suse.com/security/cve/CVE-2018-6113.html https://www.suse.com/security/cve/CVE-2018-6114.html https://www.suse.com/security/cve/CVE-2018-6115.html https://www.suse.com/security/cve/CVE-2018-6116.html https://www.suse.com/security/cve/CVE-2018-6117.html https://www.suse.com/security/cve/CVE-2018-6118.html https://www.suse.com/security/cve/CVE-2018-6120.html https://www.suse.com/security/cve/CVE-2018-6121.html https://www.suse.com/security/cve/CVE-2018-6122.html https://bugzilla.suse.com/1084296 https://bugzilla.suse.com/1086124 https://bugzilla.suse.com/1090000 https://bugzilla.suse.com/1091288 https://bugzilla.suse.com/1092272 https://bugzilla.suse.com/1092923 https://bugzilla.suse.com/1093031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

openSUSE Security Announce May 2018