June 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1697-1: moderate: Security update for opencv
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for opencv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1697-1 Rating: moderate References: #1074312 Cross-References: CVE-2017-18009 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opencv fixes this security issue: - CVE-2017-18009: Prevent heap-based buffer over-read in the function cv::HdrDecoder::checkSignature (bsc#1074312). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-629=1 Package List: - openSUSE Leap 15.0 (x86_64): libopencv3_3-3.3.1-lp150.4.3.1 libopencv3_3-debuginfo-3.3.1-lp150.4.3.1 opencv-3.3.1-lp150.4.3.1 opencv-debuginfo-3.3.1-lp150.4.3.1 opencv-debugsource-3.3.1-lp150.4.3.1 opencv-devel-3.3.1-lp150.4.3.1 opencv-doc-3.3.1-lp150.4.3.1 python2-opencv-3.3.1-lp150.4.3.1 python2-opencv-debuginfo-3.3.1-lp150.4.3.1 python3-opencv-3.3.1-lp150.4.3.1 python3-opencv-debuginfo-3.3.1-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-18009.html https://bugzilla.suse.com/1074312 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1689-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 14 Jun '18

14 Jun '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1689-1 Rating: moderate References: #1072697 #1095722 #1095849 #1095850 #1095852 #1095853 #1095854 #1096022 #1096024 #1096025 #1096026 Cross-References: CVE-2016-1000338 CVE-2016-1000339 CVE-2016-1000340 CVE-2016-1000341 CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000344 CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000352 CVE-2017-13098 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for bouncycastle to version 1.59 fixes the following issues: These security issues were fixed: - CVE-2017-13098: BouncyCastle, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provided a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange was negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT" (bsc#1072697). - CVE-2016-1000338: Ensure full validation of ASN.1 encoding of signature on verification. It was possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may have allowed the introduction of 'invisible' data into a signed structure (bsc#1095722). - CVE-2016-1000339: Prevent AESEngine key information leak via lookup table accesses (boo#1095853). - CVE-2016-1000340: Preventcarry propagation bugs in the implementation of squaring for several raw math classes (boo#1095854). - CVE-2016-1000341: Fix DSA signature generation vulnerability to timing attack (boo#1095852). - CVE-2016-1000341: DSA signature generation was vulnerable to timing attack. Where timings can be closely observed for the generation of signatures may have allowed an attacker to gain information about the signature's k value and ultimately the private value as well (bsc#1095852). - CVE-2016-1000342: Ensure that ECDSA does fully validate ASN.1 encoding of signature on verification. It was possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may have allowed the introduction of 'invisible' data into a signed structure (bsc#1095850). - CVE-2016-1000343: Prevent weak default settings for private DSA key pair generation (boo#1095849). - CVE-2016-1000344: Removed DHIES from the provider to disable the unsafe usage of ECB mode (boo#1096026). - CVE-2016-1000345: The DHIES/ECIES CBC mode was vulnerable to padding oracle attack. In an environment where timings can be easily observed, it was possible with enough observations to identify when the decryption is failing due to padding (bsc#1096025). - CVE-2016-1000346: The other party DH public key was not fully validated. This could have caused issues as invalid keys could be used to reveal details about the other party's private key where static Diffie-Hellman is in use (bsc#1096024). - CVE-2016-1000352: Remove ECIES from the provider to disable the unsafe usage of ECB mode (boo#1096022). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-628=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.59-23.3.1 bouncycastle-javadoc-1.59-23.3.1 References: https://www.suse.com/security/cve/CVE-2016-1000338.html https://www.suse.com/security/cve/CVE-2016-1000339.html https://www.suse.com/security/cve/CVE-2016-1000340.html https://www.suse.com/security/cve/CVE-2016-1000341.html https://www.suse.com/security/cve/CVE-2016-1000342.html https://www.suse.com/security/cve/CVE-2016-1000343.html https://www.suse.com/security/cve/CVE-2016-1000344.html https://www.suse.com/security/cve/CVE-2016-1000345.html https://www.suse.com/security/cve/CVE-2016-1000346.html https://www.suse.com/security/cve/CVE-2016-1000352.html https://www.suse.com/security/cve/CVE-2017-13098.html https://bugzilla.suse.com/1072697 https://bugzilla.suse.com/1095722 https://bugzilla.suse.com/1095849 https://bugzilla.suse.com/1095850 https://bugzilla.suse.com/1095852 https://bugzilla.suse.com/1095853 https://bugzilla.suse.com/1095854 https://bugzilla.suse.com/1096022 https://bugzilla.suse.com/1096024 https://bugzilla.suse.com/1096025 https://bugzilla.suse.com/1096026 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1686-1: Security update for taglib
by opensuse-security＠opensuse.org 13 Jun '18

13 Jun '18

openSUSE Security Update: Security update for taglib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1686-1 Rating: low References: #1096180 Cross-References: CVE-2018-11439 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for taglib fixes this security issues: - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file (bsc#1096180). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-627=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-627=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtag-devel-1.11-8.1 libtag1-1.11-8.1 libtag1-debuginfo-1.11-8.1 libtag_c0-1.11-8.1 libtag_c0-debuginfo-1.11-8.1 taglib-1.11-8.1 taglib-debuginfo-1.11-8.1 taglib-debugsource-1.11-8.1 - openSUSE Leap 42.3 (x86_64): libtag1-32bit-1.11-8.1 libtag1-debuginfo-32bit-1.11-8.1 libtag_c0-32bit-1.11-8.1 libtag_c0-debuginfo-32bit-1.11-8.1 - openSUSE Leap 15.0 (i586 x86_64): libtag-devel-1.11.1-lp150.3.3.1 libtag1-1.11.1-lp150.3.3.1 libtag1-debuginfo-1.11.1-lp150.3.3.1 libtag_c0-1.11.1-lp150.3.3.1 libtag_c0-debuginfo-1.11.1-lp150.3.3.1 taglib-1.11.1-lp150.3.3.1 taglib-debuginfo-1.11.1-lp150.3.3.1 taglib-debugsource-1.11.1-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libtag1-32bit-1.11.1-lp150.3.3.1 libtag1-32bit-debuginfo-1.11.1-lp150.3.3.1 libtag_c0-32bit-1.11.1-lp150.3.3.1 libtag_c0-32bit-debuginfo-1.11.1-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11439.html https://bugzilla.suse.com/1096180 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1634-1: moderate: Security update for mupdf
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1634-1 Rating: moderate References: #1080531 Cross-References: CVE-2018-1000051 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mupdf fixes the following security issue: - CVE-2018-1000051: Prevent use after free in fz_keep_key_storable that can result in DOS / possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF (bsc#1080531). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-592=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): mupdf-1.12.0-lp150.3.3.1 mupdf-debuginfo-1.12.0-lp150.3.3.1 mupdf-debugsource-1.12.0-lp150.3.3.1 mupdf-devel-static-1.12.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000051.html https://bugzilla.suse.com/1080531 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1633-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1633-1 Rating: moderate References: #1092877 #1094154 Cross-References: CVE-2018-11237 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: This security issue was fixed: - Fixed an buffer overwrite issue in memcpy for Knights Landing CPUs (boo#1092877, CVE-2018-11237) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-600=1 Package List: - openSUSE Leap 15.0 (i586 i686 x86_64): glibc-2.26-lp150.11.3.2 glibc-debuginfo-2.26-lp150.11.3.2 glibc-debugsource-2.26-lp150.11.3.2 glibc-devel-2.26-lp150.11.3.2 glibc-devel-debuginfo-2.26-lp150.11.3.2 glibc-devel-static-2.26-lp150.11.3.2 glibc-locale-2.26-lp150.11.3.2 glibc-locale-debuginfo-2.26-lp150.11.3.2 glibc-profile-2.26-lp150.11.3.2 - openSUSE Leap 15.0 (i586 x86_64): glibc-extra-2.26-lp150.11.3.2 glibc-extra-debuginfo-2.26-lp150.11.3.2 glibc-utils-2.26-lp150.11.3.2 glibc-utils-debuginfo-2.26-lp150.11.3.2 glibc-utils-src-debugsource-2.26-lp150.11.3.2 nscd-2.26-lp150.11.3.2 nscd-debuginfo-2.26-lp150.11.3.2 - openSUSE Leap 15.0 (noarch): glibc-html-2.26-lp150.11.3.2 glibc-i18ndata-2.26-lp150.11.3.2 glibc-info-2.26-lp150.11.3.2 - openSUSE Leap 15.0 (x86_64): glibc-32bit-2.26-lp150.11.3.2 glibc-32bit-debuginfo-2.26-lp150.11.3.2 glibc-devel-32bit-2.26-lp150.11.3.2 glibc-devel-32bit-debuginfo-2.26-lp150.11.3.2 glibc-devel-static-32bit-2.26-lp150.11.3.2 glibc-locale-32bit-2.26-lp150.11.3.2 glibc-locale-32bit-debuginfo-2.26-lp150.11.3.2 glibc-profile-32bit-2.26-lp150.11.3.2 glibc-utils-32bit-2.26-lp150.11.3.2 glibc-utils-32bit-debuginfo-2.26-lp150.11.3.2 References: https://www.suse.com/security/cve/CVE-2018-11237.html https://bugzilla.suse.com/1092877 https://bugzilla.suse.com/1094154 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1632-1: moderate: Security update for prosody
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1632-1 Rating: moderate References: #1094890 Cross-References: CVE-2018-10847 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prosody to version 0.10.2 fixes the following issues: This security issue was fixed: - CVE-2018-10847: Prevent insufficient validation of client-provided parameters during XMPP stream restarts. Authenticated users may have overriden the realm associated with their session, potentially bypassing security policies and allowing impersonation (bsc#1094890). These non-security issues were fixed: - mod_websocket: Store the request object on the session for use by other modules - mod_c2s: Avoid concatenating potential nil value - core.certmanager: Allow all non-whitespace in service name - mod_disco: Skip code specific to disco on user accounts - mod_bosh: Store the normalized hostname on session - MUC: Fix error logged when no persistent rooms present Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-596=1 Package List: - openSUSE Leap 15.0 (x86_64): prosody-0.10.2-lp150.3.6.2 prosody-debuginfo-0.10.2-lp150.3.6.2 prosody-debugsource-0.10.2-lp150.3.6.2 References: https://www.suse.com/security/cve/CVE-2018-10847.html https://bugzilla.suse.com/1094890 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1631-1: moderate: Security update for kernel-firmware
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1631-1 Rating: moderate References: #1095735 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kernel-firmware fixes the following issues: This security issue was fixed: - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction (bsc#1095735) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-590=1 Package List: - openSUSE Leap 42.3 (noarch): kernel-firmware-20170530-20.1 ucode-amd-20170530-20.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1095735 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1629-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1629-1 Rating: moderate References: #1093395 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ImageMagick to version 7.0.7-34 fixes the following issues: The following security issue was fixed: - Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts. The following non-security issues were fixed: - Added support for reading eXIf chunks to the PNG coder. - Improved clip / composite mask handling. - Restore SetImageAlpha() behavior. - Fix -clip and -mask options. - Missing break when checking "compliance" element. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-598=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.3.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.3.1 ImageMagick-debugsource-7.0.7.34-lp150.2.3.1 ImageMagick-devel-7.0.7.34-lp150.2.3.1 ImageMagick-extra-7.0.7.34-lp150.2.3.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.3.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.3.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.3.1 libMagick++-devel-7.0.7.34-lp150.2.3.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.3.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.3.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.3.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.3.1 perl-PerlMagick-7.0.7.34-lp150.2.3.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.3.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.3.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.3.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.3.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.3.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.3.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.3.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.3.1 References: https://bugzilla.suse.com/1093395 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1628-1: important: Security update for qemu
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1628-1 Rating: important References: #1092885 #1093169 Cross-References: CVE-2018-3639 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for qemu fixes the following issues: This security issue was fixed: - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests (bsc#1092885). Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. This patch permits the new x86 cpu feature flag named "ssbd" to be presented to the guest, given that the host has this feature, and KVM exposes it to the guest as well. For this feature to be enabled please use the qemu commandline -cpu $MODEL,+spec-ctrl,+ssbd so the guest OS can take advantage of the feature. spec-ctrl and ssbd support is also required in the host. This non-security issue was fixed: - Fix qemu-guest-agent uninstall (boo#1093169) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-603=1 Package List: - openSUSE Leap 15.0 (x86_64): qemu-2.11.1-lp150.7.3.1 qemu-arm-2.11.1-lp150.7.3.1 qemu-arm-debuginfo-2.11.1-lp150.7.3.1 qemu-block-curl-2.11.1-lp150.7.3.1 qemu-block-curl-debuginfo-2.11.1-lp150.7.3.1 qemu-block-dmg-2.11.1-lp150.7.3.1 qemu-block-dmg-debuginfo-2.11.1-lp150.7.3.1 qemu-block-gluster-2.11.1-lp150.7.3.1 qemu-block-gluster-debuginfo-2.11.1-lp150.7.3.1 qemu-block-iscsi-2.11.1-lp150.7.3.1 qemu-block-iscsi-debuginfo-2.11.1-lp150.7.3.1 qemu-block-rbd-2.11.1-lp150.7.3.1 qemu-block-rbd-debuginfo-2.11.1-lp150.7.3.1 qemu-block-ssh-2.11.1-lp150.7.3.1 qemu-block-ssh-debuginfo-2.11.1-lp150.7.3.1 qemu-debuginfo-2.11.1-lp150.7.3.1 qemu-debugsource-2.11.1-lp150.7.3.1 qemu-extra-2.11.1-lp150.7.3.1 qemu-extra-debuginfo-2.11.1-lp150.7.3.1 qemu-guest-agent-2.11.1-lp150.7.3.1 qemu-guest-agent-debuginfo-2.11.1-lp150.7.3.1 qemu-ksm-2.11.1-lp150.7.3.1 qemu-kvm-2.11.1-lp150.7.3.1 qemu-lang-2.11.1-lp150.7.3.1 qemu-linux-user-2.11.1-lp150.7.3.1 qemu-linux-user-debuginfo-2.11.1-lp150.7.3.1 qemu-linux-user-debugsource-2.11.1-lp150.7.3.1 qemu-ppc-2.11.1-lp150.7.3.1 qemu-ppc-debuginfo-2.11.1-lp150.7.3.1 qemu-s390-2.11.1-lp150.7.3.1 qemu-s390-debuginfo-2.11.1-lp150.7.3.1 qemu-testsuite-2.11.1-lp150.7.3.1 qemu-tools-2.11.1-lp150.7.3.1 qemu-tools-debuginfo-2.11.1-lp150.7.3.1 qemu-x86-2.11.1-lp150.7.3.1 qemu-x86-debuginfo-2.11.1-lp150.7.3.1 - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0-lp150.7.3.1 qemu-seabios-1.11.0-lp150.7.3.1 qemu-sgabios-8-lp150.7.3.1 qemu-vgabios-1.11.0-lp150.7.3.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1092885 https://bugzilla.suse.com/1093169 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1627-1: moderate: Security update for prosody
by opensuse-security＠opensuse.org 09 Jun '18

09 Jun '18

openSUSE Security Update: Security update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1627-1 Rating: moderate References: #1094890 Cross-References: CVE-2018-10847 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prosody fixes the following issues: This security issue was fixed: - CVE-2018-10847: Prevent insufficient validation of client-provided parameters during XMPP stream restarts. Authenticated users may have overriden the realm associated with their session, potentially bypassing security policies and allowing impersonation (bsc#1094890). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-597=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): prosody-0.9.13-2.6.1 prosody-debuginfo-0.9.13-2.6.1 prosody-debugsource-0.9.13-2.6.1 References: https://www.suse.com/security/cve/CVE-2018-10847.html https://bugzilla.suse.com/1094890 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0