June 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1862-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1862-1 Rating: low References: #1075821 #1095812 Cross-References: CVE-2018-10805 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for GraphicsMagick fixes the following issues: The following security fixes were fixed: - CVE-2018-10805: Fixed a memory leak in ReadYCBCRImage in coders/ycbcr.c and rgb.c, cmyk.c and gray.c (boo#1095812) - Fixed invalid memory reads in dcm.c (boo#1075821#c14) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-689=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-689=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-93.1 GraphicsMagick-debuginfo-1.3.25-93.1 GraphicsMagick-debugsource-1.3.25-93.1 GraphicsMagick-devel-1.3.25-93.1 libGraphicsMagick++-Q16-12-1.3.25-93.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-93.1 libGraphicsMagick++-devel-1.3.25-93.1 libGraphicsMagick-Q16-3-1.3.25-93.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-93.1 libGraphicsMagick3-config-1.3.25-93.1 libGraphicsMagickWand-Q16-2-1.3.25-93.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-93.1 perl-GraphicsMagick-1.3.25-93.1 perl-GraphicsMagick-debuginfo-1.3.25-93.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.6.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.6.1 GraphicsMagick-debugsource-1.3.29-lp150.3.6.1 GraphicsMagick-devel-1.3.29-lp150.3.6.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.6.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.6.1 libGraphicsMagick++-devel-1.3.29-lp150.3.6.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.6.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.6.1 libGraphicsMagick3-config-1.3.29-lp150.3.6.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.6.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.6.1 perl-GraphicsMagick-1.3.29-lp150.3.6.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-10805.html https://bugzilla.suse.com/1075821 https://bugzilla.suse.com/1095812 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1860-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1860-1 Rating: moderate References: #1047356 #1056277 #1087820 #1094204 #1094237 #1095730 #1095812 #1095813 Cross-References: CVE-2017-10928 CVE-2017-13758 CVE-2017-18271 CVE-2018-10804 CVE-2018-10805 CVE-2018-11251 CVE-2018-11655 CVE-2018-9133 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: These security issues were fixed: - CVE-2017-13758: Prevent heap-based buffer overflow in the TracePoint() function (bsc#1056277). - CVE-2017-10928: Prevent heap-based buffer over-read in the GetNextToken function that allowed remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document (bsc#1047356). - CVE-2018-9133: Long compute times in the tiff decoder have been fixed (bsc#1087820). - CVE-2018-11251: Heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service (bsc#1094237). - CVE-2017-18271: Infinite loop in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (bsc#1094204). - CVE-2018-11655: Memory leak in the GetImagePixelCache in MagickCore/cache.c was fixed (bsc#1095730) - CVE-2018-10804: Memory leak in WriteTIFFImage in coders/tiff.c was fixed (bsc#1095813) - CVE-2018-10805: Fixed memory leaks in bgr.c, rgb.c, cmyk.c, gray.c, ycbcr.c (bsc#1095812) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-690=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-64.1 ImageMagick-debuginfo-6.8.8.1-64.1 ImageMagick-debugsource-6.8.8.1-64.1 ImageMagick-devel-6.8.8.1-64.1 ImageMagick-extra-6.8.8.1-64.1 ImageMagick-extra-debuginfo-6.8.8.1-64.1 libMagick++-6_Q16-3-6.8.8.1-64.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-64.1 libMagick++-devel-6.8.8.1-64.1 libMagickCore-6_Q16-1-6.8.8.1-64.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-64.1 libMagickWand-6_Q16-1-6.8.8.1-64.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-64.1 perl-PerlMagick-6.8.8.1-64.1 perl-PerlMagick-debuginfo-6.8.8.1-64.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-64.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-64.1 libMagick++-6_Q16-3-32bit-6.8.8.1-64.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-64.1 libMagick++-devel-32bit-6.8.8.1-64.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-64.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-64.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-64.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-64.1 References: https://www.suse.com/security/cve/CVE-2017-10928.html https://www.suse.com/security/cve/CVE-2017-13758.html https://www.suse.com/security/cve/CVE-2017-18271.html https://www.suse.com/security/cve/CVE-2018-10804.html https://www.suse.com/security/cve/CVE-2018-10805.html https://www.suse.com/security/cve/CVE-2018-11251.html https://www.suse.com/security/cve/CVE-2018-11655.html https://www.suse.com/security/cve/CVE-2018-9133.html https://bugzilla.suse.com/1047356 https://bugzilla.suse.com/1056277 https://bugzilla.suse.com/1087820 https://bugzilla.suse.com/1094204 https://bugzilla.suse.com/1094237 https://bugzilla.suse.com/1095730 https://bugzilla.suse.com/1095812 https://bugzilla.suse.com/1095813 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1859-1: moderate: Security update for Opera
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for Opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1859-1 Rating: moderate References: #1096508 #1099568 Cross-References: CVE-2018-6148 Affected Products: openSUSE Leap 42.3:NonFree openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for Opera 54.0.2952.41 fixes multiple issues. - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) This update to version 54.0.2952.41 also contains all security and bug fixes in this upstream version, including all fixes in the chromium engine. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3:NonFree: zypper in -t patch openSUSE-2018-687=1 - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2018-687=1 Package List: - openSUSE Leap 42.3:NonFree (x86_64): opera-54.0.2952.41-68.1 - openSUSE Leap 15.0:NonFree (x86_64): opera-54.0.2952.41-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-6148.html https://bugzilla.suse.com/1096508 https://bugzilla.suse.com/1099568 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1858-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 30 Jun '18

30 Jun '18

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1858-1 Rating: moderate References: #1099510 Cross-References: CVE-2018-0618 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman to version 2.1.27 fixes the following issues: This security issue was fixed: - CVE-2018-0618: Additional protections against injecting scripts into listinfo and error messages pages (bsc#1099510). These non-security issues were fixed: - The hash generated when SUBSCRIBE_FORM_SECRET is set could have been the same as one generated at the same time for a different list and IP address. - An option has been added to bin/add_members to issue invitations instead of immediately adding members. - A new BLOCK_SPAMHAUS_LISTED_IP_SUBSCRIBE setting has been added to enable blocking web subscribes from IPv4 addresses listed in Spamhaus SBL, CSS or XBL. It will work with IPv6 addresses if Python's py2-ipaddress module is installed. The module can be installed via pip if not included in your Python. - Mailman has a new 'security' log and logs authentication failures to the various web CGI functions. The logged data include the remote IP and can be used to automate blocking of IPs with something like fail2ban. Since Mailman 2.1.14, these have returned an http 401 status and the information should be logged by the web server, but this new log makes that more convenient. Also, the 'mischief' log entries for 'hostile listname' noe include the remote IP if available. - admin notices of (un)subscribes now may give the source of the action. This consists of a %(whence)s replacement that has been added to the admin(un)subscribeack.txt templates. Thanks to Yasuhito FUTATSUKI for updating the non-English templates and help with internationalizing the reasons. - there is a new BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE setting to enable blocking web subscribes for addresses in domains listed in the Spamhaus DBL. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-691=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-691=1 Package List: - openSUSE Leap 42.3 (x86_64): mailman-2.1.27-2.6.1 mailman-debuginfo-2.1.27-2.6.1 mailman-debugsource-2.1.27-2.6.1 - openSUSE Leap 15.0 (x86_64): mailman-2.1.27-lp150.2.3.1 mailman-debuginfo-2.1.27-lp150.2.3.1 mailman-debugsource-2.1.27-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0618.html https://bugzilla.suse.com/1099510 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1854-1: important: Security update for rubygem-sprockets
by opensuse-security＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Security Update: Security update for rubygem-sprockets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1854-1 Rating: important References: #1098369 Cross-References: CVE-2018-3760 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-sprockets fixes the following issues: The following security vulnerability was addressed: - CVE-2018-3760: Fixed a directory traversal issue in sprockets/server.rb:forbidden_request?(), which allowed remote attackers to read arbitrary files via specially crafted requests. (boo#1098369) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-686=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ruby2.1-rubygem-sprockets-3.3.5-5.3.1 ruby2.1-rubygem-sprockets-doc-3.3.5-5.3.1 ruby2.2-rubygem-sprockets-3.3.5-5.3.1 ruby2.2-rubygem-sprockets-doc-3.3.5-5.3.1 ruby2.3-rubygem-sprockets-3.3.5-5.3.1 ruby2.3-rubygem-sprockets-doc-3.3.5-5.3.1 ruby2.4-rubygem-sprockets-3.3.5-5.3.1 ruby2.4-rubygem-sprockets-doc-3.3.5-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-3760.html https://bugzilla.suse.com/1098369 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1848-1: moderate: Security update for procps
by opensuse-security＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Security Update: Security update for procps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1848-1 Rating: moderate References: #1092100 Cross-References: CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for procps fixes the following security issues: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-685=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libprocps3-3.3.9-20.1 libprocps3-debuginfo-3.3.9-20.1 procps-3.3.9-20.1 procps-debuginfo-3.3.9-20.1 procps-debugsource-3.3.9-20.1 procps-devel-3.3.9-20.1 References: https://www.suse.com/security/cve/CVE-2018-1122.html https://www.suse.com/security/cve/CVE-2018-1123.html https://www.suse.com/security/cve/CVE-2018-1124.html https://www.suse.com/security/cve/CVE-2018-1125.html https://www.suse.com/security/cve/CVE-2018-1126.html https://bugzilla.suse.com/1092100 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1845-1: moderate: Security update for unixODBC
by opensuse-security＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Security Update: Security update for unixODBC ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1845-1 Rating: moderate References: #1044970 #1082060 #1082290 #1082484 Cross-References: CVE-2018-7409 CVE-2018-7485 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for unixODBC to version 2.3.6 fixes the following issues: - CVE-2018-7409: Buffer overflow in unicode_to_ansi_copy() was fixed in 2.3.5 (bsc#1082290) - CVE-2018-7485: Swapped arguments in SQLWriteFileDSN() in odbcinst/SQLWriteFileDSN.c (bsc#1082484) Other fixes: - Enabled --enable-fastvalidate option in configure (bsc#1044970) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-684=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): unixODBC-2.3.6-8.1 unixODBC-debuginfo-2.3.6-8.1 unixODBC-debugsource-2.3.6-8.1 unixODBC-devel-2.3.6-8.1 - openSUSE Leap 42.3 (x86_64): unixODBC-32bit-2.3.6-8.1 unixODBC-debuginfo-32bit-2.3.6-8.1 References: https://www.suse.com/security/cve/CVE-2018-7409.html https://www.suse.com/security/cve/CVE-2018-7485.html https://bugzilla.suse.com/1044970 https://bugzilla.suse.com/1082060 https://bugzilla.suse.com/1082290 https://bugzilla.suse.com/1082484 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1834-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 28 Jun '18

28 Jun '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1834-1 Rating: moderate References: #1007276 #1074317 #1082332 #1082825 #1086408 #1092949 #974621 Cross-References: CVE-2016-3632 CVE-2016-8331 CVE-2017-11613 CVE-2017-13726 CVE-2017-18013 CVE-2018-10963 CVE-2018-7456 CVE-2018-8905 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for tiff fixes the following issues: These security issues were fixed: - CVE-2017-18013: There was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. (bsc#1074317) - CVE-2018-10963: The TIFFWriteDirectorySec() function in tif_dirwrite.c allowed remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726. (bsc#1092949) - CVE-2018-7456: Prevent a NULL Pointer dereference in the function TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013 (bsc#1082825) - CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer (bsc#1082332) - CVE-2018-8905: Prevent heap-based buffer overflow in the function LZWDecodeCompat via a crafted TIFF file (bsc#1086408) - CVE-2016-8331: Prevent remote code execution because of incorrect handling of TIFF images. A crafted TIFF document could have lead to a type confusion vulnerability resulting in remote code execution. This vulnerability could have been be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality (bsc#1007276) - CVE-2016-3632: The _TIFFVGetField function allowed remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image (bsc#974621) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-677=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-31.1 libtiff5-4.0.9-31.1 libtiff5-debuginfo-4.0.9-31.1 tiff-4.0.9-31.1 tiff-debuginfo-4.0.9-31.1 tiff-debugsource-4.0.9-31.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-31.1 libtiff5-32bit-4.0.9-31.1 libtiff5-debuginfo-32bit-4.0.9-31.1 References: https://www.suse.com/security/cve/CVE-2016-3632.html https://www.suse.com/security/cve/CVE-2016-8331.html https://www.suse.com/security/cve/CVE-2017-11613.html https://www.suse.com/security/cve/CVE-2017-13726.html https://www.suse.com/security/cve/CVE-2017-18013.html https://www.suse.com/security/cve/CVE-2018-10963.html https://www.suse.com/security/cve/CVE-2018-7456.html https://www.suse.com/security/cve/CVE-2018-8905.html https://bugzilla.suse.com/1007276 https://bugzilla.suse.com/1074317 https://bugzilla.suse.com/1082332 https://bugzilla.suse.com/1082825 https://bugzilla.suse.com/1086408 https://bugzilla.suse.com/1092949 https://bugzilla.suse.com/974621 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1833-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 28 Jun '18

28 Jun '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1833-1 Rating: important References: #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12367 CVE-2018-12369 CVE-2018-12371 CVE-2018-5156 CVE-2018-5187 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This security update for MozillaFirefox to version 60.1.0esr fixes multiple issues. Security issues fixed (MFSA 2018-16, boo#1098998): - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-12361: Integer overflow in SwizzleData - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12371: Integer overflow in Skia library during edge builder allocation - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming - CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments - CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1 - CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Other issues fixed: - various stability and regression fixes - do not disable system installed unsigned language packs (bmo#1464766) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-676=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-676=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.1.0-106.1 MozillaFirefox-branding-upstream-60.1.0-106.1 MozillaFirefox-buildsymbols-60.1.0-106.1 MozillaFirefox-debuginfo-60.1.0-106.1 MozillaFirefox-debugsource-60.1.0-106.1 MozillaFirefox-devel-60.1.0-106.1 MozillaFirefox-translations-common-60.1.0-106.1 MozillaFirefox-translations-other-60.1.0-106.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.1.0-lp150.3.11.1 MozillaFirefox-branding-upstream-60.1.0-lp150.3.11.1 MozillaFirefox-buildsymbols-60.1.0-lp150.3.11.1 MozillaFirefox-debuginfo-60.1.0-lp150.3.11.1 MozillaFirefox-debugsource-60.1.0-lp150.3.11.1 MozillaFirefox-devel-60.1.0-lp150.3.11.1 MozillaFirefox-translations-common-60.1.0-lp150.3.11.1 MozillaFirefox-translations-other-60.1.0-lp150.3.11.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12369.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1098998 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1811-1: moderate: Security update for go1.9
by opensuse-security＠opensuse.org 23 Jun '18

23 Jun '18

openSUSE Security Update: Security update for go1.9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1811-1 Rating: moderate References: #1081495 Cross-References: CVE-2018-7187 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for go1.9 fixes the following issues: Security issues fixed: - CVE-2018-7187: arbitrary command execution via VCS path (boo#1081495) Non-security changes: - Update to version 1.9.7 - fixes to the go command and compiler - minimal support to the go command for the vgo transition Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-672=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-672=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): go-1.9.7-37.2 go-doc-1.9.7-37.2 go1.9-1.9.7-10.1 go1.9-doc-1.9.7-10.1 - openSUSE Leap 42.3 (x86_64): go-race-1.9.7-37.2 go1.9-race-1.9.7-10.1 - openSUSE Leap 15.0 (i586 x86_64): go-1.9.7-lp150.2.4.1 go-doc-1.9.7-lp150.2.4.1 go1.9-1.9.7-lp150.2.4.2 go1.9-doc-1.9.7-lp150.2.4.2 - openSUSE Leap 15.0 (x86_64): go-race-1.9.7-lp150.2.4.1 go1.9-race-1.9.7-lp150.2.4.2 References: https://www.suse.com/security/cve/CVE-2018-7187.html https://bugzilla.suse.com/1081495 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0