July 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2055-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 25 Jul '18

25 Jul '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2055-1 Rating: important References: #1070421 #1093031 #1095163 #1095545 #1096508 #1097452 Cross-References: CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6138 CVE-2018-6139 CVE-2018-6140 CVE-2018-6141 CVE-2018-6142 CVE-2018-6143 CVE-2018-6144 CVE-2018-6145 CVE-2018-6147 CVE-2018-6148 CVE-2018-6149 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163): - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included: - Require ffmpeg >= 4.0 (boo#1095545) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-759=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-759=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-67.0.3396.99-161.4 chromedriver-debuginfo-67.0.3396.99-161.4 chromium-67.0.3396.99-161.4 chromium-debuginfo-67.0.3396.99-161.4 chromium-debugsource-67.0.3396.99-161.4 - openSUSE Leap 15.0 (x86_64): chromedriver-67.0.3396.99-lp150.2.3.3 chromedriver-debuginfo-67.0.3396.99-lp150.2.3.3 chromium-67.0.3396.99-lp150.2.3.3 chromium-debuginfo-67.0.3396.99-lp150.2.3.3 chromium-debugsource-67.0.3396.99-lp150.2.3.3 References: https://www.suse.com/security/cve/CVE-2018-6123.html https://www.suse.com/security/cve/CVE-2018-6124.html https://www.suse.com/security/cve/CVE-2018-6125.html https://www.suse.com/security/cve/CVE-2018-6126.html https://www.suse.com/security/cve/CVE-2018-6127.html https://www.suse.com/security/cve/CVE-2018-6128.html https://www.suse.com/security/cve/CVE-2018-6129.html https://www.suse.com/security/cve/CVE-2018-6130.html https://www.suse.com/security/cve/CVE-2018-6131.html https://www.suse.com/security/cve/CVE-2018-6132.html https://www.suse.com/security/cve/CVE-2018-6133.html https://www.suse.com/security/cve/CVE-2018-6134.html https://www.suse.com/security/cve/CVE-2018-6135.html https://www.suse.com/security/cve/CVE-2018-6136.html https://www.suse.com/security/cve/CVE-2018-6137.html https://www.suse.com/security/cve/CVE-2018-6138.html https://www.suse.com/security/cve/CVE-2018-6139.html https://www.suse.com/security/cve/CVE-2018-6140.html https://www.suse.com/security/cve/CVE-2018-6141.html https://www.suse.com/security/cve/CVE-2018-6142.html https://www.suse.com/security/cve/CVE-2018-6143.html https://www.suse.com/security/cve/CVE-2018-6144.html https://www.suse.com/security/cve/CVE-2018-6145.html https://www.suse.com/security/cve/CVE-2018-6147.html https://www.suse.com/security/cve/CVE-2018-6148.html https://www.suse.com/security/cve/CVE-2018-6149.html https://bugzilla.suse.com/1070421 https://bugzilla.suse.com/1093031 https://bugzilla.suse.com/1095163 https://bugzilla.suse.com/1095545 https://bugzilla.suse.com/1096508 https://bugzilla.suse.com/1097452 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2054-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 25 Jul '18

25 Jul '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2054-1 Rating: important References: #1070421 #1093031 #1095163 #1095545 #1096508 #1097452 Cross-References: CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6138 CVE-2018-6139 CVE-2018-6140 CVE-2018-6141 CVE-2018-6142 CVE-2018-6143 CVE-2018-6144 CVE-2018-6145 CVE-2018-6147 CVE-2018-6148 CVE-2018-6149 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163): - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included: - Require ffmpeg >= 4.0 (boo#1095545) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-759=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-67.0.3396.99-58.2 chromium-67.0.3396.99-58.2 References: https://www.suse.com/security/cve/CVE-2018-6123.html https://www.suse.com/security/cve/CVE-2018-6124.html https://www.suse.com/security/cve/CVE-2018-6125.html https://www.suse.com/security/cve/CVE-2018-6126.html https://www.suse.com/security/cve/CVE-2018-6127.html https://www.suse.com/security/cve/CVE-2018-6128.html https://www.suse.com/security/cve/CVE-2018-6129.html https://www.suse.com/security/cve/CVE-2018-6130.html https://www.suse.com/security/cve/CVE-2018-6131.html https://www.suse.com/security/cve/CVE-2018-6132.html https://www.suse.com/security/cve/CVE-2018-6133.html https://www.suse.com/security/cve/CVE-2018-6134.html https://www.suse.com/security/cve/CVE-2018-6135.html https://www.suse.com/security/cve/CVE-2018-6136.html https://www.suse.com/security/cve/CVE-2018-6137.html https://www.suse.com/security/cve/CVE-2018-6138.html https://www.suse.com/security/cve/CVE-2018-6139.html https://www.suse.com/security/cve/CVE-2018-6140.html https://www.suse.com/security/cve/CVE-2018-6141.html https://www.suse.com/security/cve/CVE-2018-6142.html https://www.suse.com/security/cve/CVE-2018-6143.html https://www.suse.com/security/cve/CVE-2018-6144.html https://www.suse.com/security/cve/CVE-2018-6145.html https://www.suse.com/security/cve/CVE-2018-6147.html https://www.suse.com/security/cve/CVE-2018-6148.html https://www.suse.com/security/cve/CVE-2018-6149.html https://bugzilla.suse.com/1070421 https://bugzilla.suse.com/1093031 https://bugzilla.suse.com/1095163 https://bugzilla.suse.com/1095545 https://bugzilla.suse.com/1096508 https://bugzilla.suse.com/1097452 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2023-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2023-1 Rating: moderate References: #1100353 #1100354 #1100355 Cross-References: CVE-2018-13346 CVE-2018-13347 CVE-2018-13348 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mercurial fixes the following issues: Security issues fixed: - CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that mishandles certain situations where there should be at least 12 bytes remaining after thecurrent position in the patch data (boo#1100353). - CVE-2018-13347: Fix mpatch.c that mishandles integer addition and subtraction (boo#1100355). - CVE-2018-13346: Fix the mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (boo#1100354). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-734=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): mercurial-4.2.3-15.1 mercurial-debuginfo-4.2.3-15.1 mercurial-debugsource-4.2.3-15.1 - openSUSE Leap 42.3 (noarch): mercurial-lang-4.2.3-15.1 References: https://www.suse.com/security/cve/CVE-2018-13346.html https://www.suse.com/security/cve/CVE-2018-13347.html https://www.suse.com/security/cve/CVE-2018-13348.html https://bugzilla.suse.com/1100353 https://bugzilla.suse.com/1100354 https://bugzilla.suse.com/1100355 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2021-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2021-1 Rating: moderate References: #1099031 Cross-References: CVE-2018-1116 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: - CVE-2018-1116: Fixed trusting the client-supplied UID which could lead to a denial of service (too many dialogs) caused by local attackers (boo#1099031) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-735=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpolkit0-0.113-14.3.1 libpolkit0-debuginfo-0.113-14.3.1 polkit-0.113-14.3.1 polkit-debuginfo-0.113-14.3.1 polkit-debugsource-0.113-14.3.1 polkit-devel-0.113-14.3.1 polkit-devel-debuginfo-0.113-14.3.1 typelib-1_0-Polkit-1_0-0.113-14.3.1 - openSUSE Leap 42.3 (noarch): polkit-doc-0.113-14.3.1 - openSUSE Leap 42.3 (x86_64): libpolkit0-32bit-0.113-14.3.1 libpolkit0-debuginfo-32bit-0.113-14.3.1 References: https://www.suse.com/security/cve/CVE-2018-1116.html https://bugzilla.suse.com/1099031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2019-1: moderate: Security update for rsyslog
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2019-1 Rating: moderate References: #935393 Cross-References: CVE-2015-3243 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsyslog fixes the following security issue: - CVE-2015-3243: Prevent weak permissions for generated log files, which allowed local users to obtain sensitive information (bsc#935393). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-738=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): rsyslog-8.33.1-lp150.2.3.2 rsyslog-debuginfo-8.33.1-lp150.2.3.2 rsyslog-debugsource-8.33.1-lp150.2.3.2 rsyslog-diag-tools-8.33.1-lp150.2.3.2 rsyslog-diag-tools-debuginfo-8.33.1-lp150.2.3.2 rsyslog-doc-8.33.1-lp150.2.3.2 rsyslog-module-dbi-8.33.1-lp150.2.3.2 rsyslog-module-dbi-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-elasticsearch-8.33.1-lp150.2.3.2 rsyslog-module-elasticsearch-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-gcrypt-8.33.1-lp150.2.3.2 rsyslog-module-gcrypt-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-gssapi-8.33.1-lp150.2.3.2 rsyslog-module-gssapi-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-gtls-8.33.1-lp150.2.3.2 rsyslog-module-gtls-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-mmnormalize-8.33.1-lp150.2.3.2 rsyslog-module-mmnormalize-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-mysql-8.33.1-lp150.2.3.2 rsyslog-module-mysql-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-omamqp1-8.33.1-lp150.2.3.2 rsyslog-module-omamqp1-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-omhttpfs-8.33.1-lp150.2.3.2 rsyslog-module-omhttpfs-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-omtcl-8.33.1-lp150.2.3.2 rsyslog-module-omtcl-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-pgsql-8.33.1-lp150.2.3.2 rsyslog-module-pgsql-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-relp-8.33.1-lp150.2.3.2 rsyslog-module-relp-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-snmp-8.33.1-lp150.2.3.2 rsyslog-module-snmp-debuginfo-8.33.1-lp150.2.3.2 rsyslog-module-udpspoof-8.33.1-lp150.2.3.2 rsyslog-module-udpspoof-debuginfo-8.33.1-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2015-3243.html https://bugzilla.suse.com/935393 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2015-1: moderate: Security update for libopenmpt
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for libopenmpt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2015-1 Rating: moderate References: #1089080 #1095644 Cross-References: CVE-2018-10017 CVE-2018-11710 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libopenmpt to version 0.3.9 fixes the following issues: These security issues were fixed: - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files (bsc#1095644) - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files containing pattern loops (bsc#1089080) These non-security issues were fixed: - [Bug] openmpt123: Fixed build failure in C++17 due to use of removed feature std::random_shuffle. - STM: Having both Bxx and Cxx commands in a pattern imported the Bxx command incorrectly. - STM: Last character of sample name was missing. - Speed up reading of truncated ULT files. - ULT: Portamento import was sometimes broken. - The resonant filter was sometimes unstable when combining low-volume samples, low cutoff and high mixing rates. - Keep track of active SFx macro during seeking. - The "note cut" duplicate note action did not volume-ramp the previously playing sample. - A song starting with non-existing patterns could not be played. - DSM: Support restart position and 16-bit samples. - DTM: Import global volume. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-742=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmodplug-devel-0.3.9-lp150.2.3.1 libmodplug1-0.3.9-lp150.2.3.1 libmodplug1-debuginfo-0.3.9-lp150.2.3.1 libopenmpt-debugsource-0.3.9-lp150.2.3.1 libopenmpt-devel-0.3.9-lp150.2.3.1 libopenmpt0-0.3.9-lp150.2.3.1 libopenmpt0-debuginfo-0.3.9-lp150.2.3.1 libopenmpt_modplug1-0.3.9-lp150.2.3.1 libopenmpt_modplug1-debuginfo-0.3.9-lp150.2.3.1 openmpt123-0.3.9-lp150.2.3.1 openmpt123-debuginfo-0.3.9-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libmodplug1-32bit-0.3.9-lp150.2.3.1 libmodplug1-32bit-debuginfo-0.3.9-lp150.2.3.1 libopenmpt0-32bit-0.3.9-lp150.2.3.1 libopenmpt0-32bit-debuginfo-0.3.9-lp150.2.3.1 libopenmpt_modplug1-32bit-0.3.9-lp150.2.3.1 libopenmpt_modplug1-32bit-debuginfo-0.3.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10017.html https://www.suse.com/security/cve/CVE-2018-11710.html https://bugzilla.suse.com/1089080 https://bugzilla.suse.com/1095644 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2014-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2014-1 Rating: moderate References: #1099098 Cross-References: CVE-2018-12882 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2018-12882: exif_read_from_impl allowed attackers to trigger a use-after-free (in exif_read_from_file) because it closed a stream that it is not responsible for closing (bsc#1099098). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-737=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.6.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.6.1 php7-7.2.5-lp150.2.6.1 php7-bcmath-7.2.5-lp150.2.6.1 php7-bcmath-debuginfo-7.2.5-lp150.2.6.1 php7-bz2-7.2.5-lp150.2.6.1 php7-bz2-debuginfo-7.2.5-lp150.2.6.1 php7-calendar-7.2.5-lp150.2.6.1 php7-calendar-debuginfo-7.2.5-lp150.2.6.1 php7-ctype-7.2.5-lp150.2.6.1 php7-ctype-debuginfo-7.2.5-lp150.2.6.1 php7-curl-7.2.5-lp150.2.6.1 php7-curl-debuginfo-7.2.5-lp150.2.6.1 php7-dba-7.2.5-lp150.2.6.1 php7-dba-debuginfo-7.2.5-lp150.2.6.1 php7-debuginfo-7.2.5-lp150.2.6.1 php7-debugsource-7.2.5-lp150.2.6.1 php7-devel-7.2.5-lp150.2.6.1 php7-dom-7.2.5-lp150.2.6.1 php7-dom-debuginfo-7.2.5-lp150.2.6.1 php7-embed-7.2.5-lp150.2.6.1 php7-embed-debuginfo-7.2.5-lp150.2.6.1 php7-enchant-7.2.5-lp150.2.6.1 php7-enchant-debuginfo-7.2.5-lp150.2.6.1 php7-exif-7.2.5-lp150.2.6.1 php7-exif-debuginfo-7.2.5-lp150.2.6.1 php7-fastcgi-7.2.5-lp150.2.6.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.6.1 php7-fileinfo-7.2.5-lp150.2.6.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.6.1 php7-firebird-7.2.5-lp150.2.6.1 php7-firebird-debuginfo-7.2.5-lp150.2.6.1 php7-fpm-7.2.5-lp150.2.6.1 php7-fpm-debuginfo-7.2.5-lp150.2.6.1 php7-ftp-7.2.5-lp150.2.6.1 php7-ftp-debuginfo-7.2.5-lp150.2.6.1 php7-gd-7.2.5-lp150.2.6.1 php7-gd-debuginfo-7.2.5-lp150.2.6.1 php7-gettext-7.2.5-lp150.2.6.1 php7-gettext-debuginfo-7.2.5-lp150.2.6.1 php7-gmp-7.2.5-lp150.2.6.1 php7-gmp-debuginfo-7.2.5-lp150.2.6.1 php7-iconv-7.2.5-lp150.2.6.1 php7-iconv-debuginfo-7.2.5-lp150.2.6.1 php7-intl-7.2.5-lp150.2.6.1 php7-intl-debuginfo-7.2.5-lp150.2.6.1 php7-json-7.2.5-lp150.2.6.1 php7-json-debuginfo-7.2.5-lp150.2.6.1 php7-ldap-7.2.5-lp150.2.6.1 php7-ldap-debuginfo-7.2.5-lp150.2.6.1 php7-mbstring-7.2.5-lp150.2.6.1 php7-mbstring-debuginfo-7.2.5-lp150.2.6.1 php7-mysql-7.2.5-lp150.2.6.1 php7-mysql-debuginfo-7.2.5-lp150.2.6.1 php7-odbc-7.2.5-lp150.2.6.1 php7-odbc-debuginfo-7.2.5-lp150.2.6.1 php7-opcache-7.2.5-lp150.2.6.1 php7-opcache-debuginfo-7.2.5-lp150.2.6.1 php7-openssl-7.2.5-lp150.2.6.1 php7-openssl-debuginfo-7.2.5-lp150.2.6.1 php7-pcntl-7.2.5-lp150.2.6.1 php7-pcntl-debuginfo-7.2.5-lp150.2.6.1 php7-pdo-7.2.5-lp150.2.6.1 php7-pdo-debuginfo-7.2.5-lp150.2.6.1 php7-pgsql-7.2.5-lp150.2.6.1 php7-pgsql-debuginfo-7.2.5-lp150.2.6.1 php7-phar-7.2.5-lp150.2.6.1 php7-phar-debuginfo-7.2.5-lp150.2.6.1 php7-posix-7.2.5-lp150.2.6.1 php7-posix-debuginfo-7.2.5-lp150.2.6.1 php7-readline-7.2.5-lp150.2.6.1 php7-readline-debuginfo-7.2.5-lp150.2.6.1 php7-shmop-7.2.5-lp150.2.6.1 php7-shmop-debuginfo-7.2.5-lp150.2.6.1 php7-snmp-7.2.5-lp150.2.6.1 php7-snmp-debuginfo-7.2.5-lp150.2.6.1 php7-soap-7.2.5-lp150.2.6.1 php7-soap-debuginfo-7.2.5-lp150.2.6.1 php7-sockets-7.2.5-lp150.2.6.1 php7-sockets-debuginfo-7.2.5-lp150.2.6.1 php7-sodium-7.2.5-lp150.2.6.1 php7-sodium-debuginfo-7.2.5-lp150.2.6.1 php7-sqlite-7.2.5-lp150.2.6.1 php7-sqlite-debuginfo-7.2.5-lp150.2.6.1 php7-sysvmsg-7.2.5-lp150.2.6.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.6.1 php7-sysvsem-7.2.5-lp150.2.6.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.6.1 php7-sysvshm-7.2.5-lp150.2.6.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.6.1 php7-tidy-7.2.5-lp150.2.6.1 php7-tidy-debuginfo-7.2.5-lp150.2.6.1 php7-tokenizer-7.2.5-lp150.2.6.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.6.1 php7-wddx-7.2.5-lp150.2.6.1 php7-wddx-debuginfo-7.2.5-lp150.2.6.1 php7-xmlreader-7.2.5-lp150.2.6.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.6.1 php7-xmlrpc-7.2.5-lp150.2.6.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.6.1 php7-xmlwriter-7.2.5-lp150.2.6.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.6.1 php7-xsl-7.2.5-lp150.2.6.1 php7-xsl-debuginfo-7.2.5-lp150.2.6.1 php7-zip-7.2.5-lp150.2.6.1 php7-zip-debuginfo-7.2.5-lp150.2.6.1 php7-zlib-7.2.5-lp150.2.6.1 php7-zlib-debuginfo-7.2.5-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.6.1 php7-pear-Archive_Tar-7.2.5-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-12882.html https://bugzilla.suse.com/1099098 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2013-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2013-1 Rating: moderate References: #1074462 Cross-References: CVE-2017-1000422 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdk-pixbuf fixes the following security issue: - CVE-2017-1000422: Prevent several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution (bsc#1074462). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-741=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gdk-pixbuf-debugsource-2.34.0-16.1 gdk-pixbuf-devel-2.34.0-16.1 gdk-pixbuf-devel-debuginfo-2.34.0-16.1 gdk-pixbuf-query-loaders-2.34.0-16.1 gdk-pixbuf-query-loaders-debuginfo-2.34.0-16.1 libgdk_pixbuf-2_0-0-2.34.0-16.1 libgdk_pixbuf-2_0-0-debuginfo-2.34.0-16.1 typelib-1_0-GdkPixbuf-2_0-2.34.0-16.1 - openSUSE Leap 42.3 (noarch): gdk-pixbuf-lang-2.34.0-16.1 - openSUSE Leap 42.3 (x86_64): gdk-pixbuf-devel-32bit-2.34.0-16.1 gdk-pixbuf-devel-debuginfo-32bit-2.34.0-16.1 gdk-pixbuf-query-loaders-32bit-2.34.0-16.1 gdk-pixbuf-query-loaders-debuginfo-32bit-2.34.0-16.1 libgdk_pixbuf-2_0-0-32bit-2.34.0-16.1 libgdk_pixbuf-2_0-0-debuginfo-32bit-2.34.0-16.1 References: https://www.suse.com/security/cve/CVE-2017-1000422.html https://bugzilla.suse.com/1074462 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2011-1: moderate: Security update for perl
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2011-1 Rating: moderate References: #1096718 Cross-References: CVE-2018-12015 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl fixes the following issues: - CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-751=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): perl-5.26.1-lp150.6.3.1 perl-base-5.26.1-lp150.6.3.1 perl-base-debuginfo-5.26.1-lp150.6.3.1 perl-debuginfo-5.26.1-lp150.6.3.1 perl-debugsource-5.26.1-lp150.6.3.1 - openSUSE Leap 15.0 (noarch): perl-doc-5.26.1-lp150.6.3.1 - openSUSE Leap 15.0 (x86_64): perl-32bit-5.26.1-lp150.6.3.1 perl-32bit-debuginfo-5.26.1-lp150.6.3.1 perl-base-32bit-5.26.1-lp150.6.3.1 perl-base-32bit-debuginfo-5.26.1-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-12015.html https://bugzilla.suse.com/1096718 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2010-1: important: Security update for perl
by opensuse-security＠opensuse.org 20 Jul '18

20 Jul '18

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2010-1 Rating: important References: #1068565 #1096718 Cross-References: CVE-2018-12015 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for perl fixes the following issues: This security issue was fixed: - CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718) This non-security issue was fixed: - fix debugger crash in tab completion with Term::ReadLine::Gnu [bsc#1068565] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-750=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): perl-5.18.2-15.2 perl-base-5.18.2-15.2 perl-base-debuginfo-5.18.2-15.2 perl-debuginfo-5.18.2-15.2 perl-debugsource-5.18.2-15.2 - openSUSE Leap 42.3 (x86_64): perl-32bit-5.18.2-15.2 perl-base-32bit-5.18.2-15.2 perl-base-debuginfo-32bit-5.18.2-15.2 perl-debuginfo-32bit-5.18.2-15.2 - openSUSE Leap 42.3 (noarch): perl-doc-5.18.2-15.2 References: https://www.suse.com/security/cve/CVE-2018-12015.html https://bugzilla.suse.com/1068565 https://bugzilla.suse.com/1096718 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0