July 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1969-1: moderate: Security update for singularity
by opensuse-security＠opensuse.org 16 Jul '18

16 Jul '18

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1969-1 Rating: moderate References: #1100333 Cross-References: CVE-2018-12021 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for singularity fixes the following issues: - CVE-2018-12021: A race condition might have allowed malicious users to bypass directory image restrictions, like mounting the host root filesystem as a container image (boo#1100333) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-730=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libsingularity1-2.3.2-11.1 libsingularity1-debuginfo-2.3.2-11.1 singularity-2.3.2-11.1 singularity-debuginfo-2.3.2-11.1 singularity-debugsource-2.3.2-11.1 singularity-devel-2.3.2-11.1 References: https://www.suse.com/security/cve/CVE-2018-12021.html https://bugzilla.suse.com/1100333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1963-1: moderate: Security update for nodejs8
by opensuse-security＠opensuse.org 14 Jul '18

14 Jul '18

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1963-1 Rating: moderate References: #1091764 #1097375 #1097401 #1097404 Cross-References: CVE-2018-1000168 CVE-2018-7161 CVE-2018-7167 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for nodejs8 to version 8.11.3 fixes the following issues: These security issues were fixed: - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-724=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): nodejs8-8.11.3-lp150.2.3.1 nodejs8-debuginfo-8.11.3-lp150.2.3.1 nodejs8-debugsource-8.11.3-lp150.2.3.1 nodejs8-devel-8.11.3-lp150.2.3.1 npm8-8.11.3-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): nodejs8-docs-8.11.3-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000168.html https://www.suse.com/security/cve/CVE-2018-7161.html https://www.suse.com/security/cve/CVE-2018-7167.html https://bugzilla.suse.com/1091764 https://bugzilla.suse.com/1097375 https://bugzilla.suse.com/1097401 https://bugzilla.suse.com/1097404 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1962-1: moderate: Security update for nodejs6
by opensuse-security＠opensuse.org 14 Jul '18

14 Jul '18

openSUSE Security Update: Security update for nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1962-1 Rating: moderate References: #1091764 #1097375 Cross-References: CVE-2018-7167 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nodejs6 to version 6.14.3 fixes the following issues: The following security vulnerability was addressed: - Fixed a denial of service (DoS) vulnerability in Buffer.fill(), which could hang when being called (CVE-2018-7167, bsc#1097375). The following other changes were made: - Use absolute paths in executable shebang lines - Fixed building with ICU61.1 (bsc#1091764) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-723=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs6-6.14.3-12.1 nodejs6-debuginfo-6.14.3-12.1 nodejs6-debugsource-6.14.3-12.1 nodejs6-devel-6.14.3-12.1 npm6-6.14.3-12.1 - openSUSE Leap 42.3 (noarch): nodejs6-docs-6.14.3-12.1 References: https://www.suse.com/security/cve/CVE-2018-7167.html https://bugzilla.suse.com/1091764 https://bugzilla.suse.com/1097375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1961-1: moderate: Security update for exiv2
by opensuse-security＠opensuse.org 14 Jul '18

14 Jul '18

openSUSE Security Update: Security update for exiv2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1961-1 Rating: moderate References: #1048883 #1050257 #1051188 #1054590 #1054592 #1054593 #1060995 #1060996 #1061000 #1061023 Cross-References: CVE-2017-11337 CVE-2017-11338 CVE-2017-11339 CVE-2017-11340 CVE-2017-11553 CVE-2017-11591 CVE-2017-11592 CVE-2017-11683 CVE-2017-12955 CVE-2017-12956 CVE-2017-12957 CVE-2017-14859 CVE-2017-14860 CVE-2017-14862 CVE-2017-14864 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for exiv2 to 0.26 fixes the following security issues: - CVE-2017-14864: Prevent invalid memory address dereference in Exiv2::getULong that could have caused a segmentation fault and application crash, which leads to denial of service (bsc#1060995). - CVE-2017-14862: Prevent invalid memory address dereference in Exiv2::DataValue::read that could have caused a segmentation fault and application crash, which leads to denial of service (bsc#1060996). - CVE-2017-14859: Prevent invalid memory address dereference in Exiv2::StringValueBase::read that could have caused a segmentation fault and application crash, which leads to denial of service (bsc#1061000). - CVE-2017-14860: Prevent heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function via a crafted input that could have lead to a denial of service attack (bsc#1061023). - CVE-2017-11337: Prevent invalid free in the Action::TaskFactory::cleanup function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-11338: Prevent infinite loop in the Exiv2::Image::printIFDStructure function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-11339: Prevent heap-based buffer overflow in the Image::printIFDStructure function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-11340: Prevent Segmentation fault in the XmpParser::terminate() function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-12955: Prevent heap-based buffer overflow. The vulnerability caused an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact (bsc#1054593). - CVE-2017-12956: Preventn illegal address access in Exiv2::FileIo::path[abi:cxx11]() that could have lead to remote denial of service (bsc#1054592). - CVE-2017-12957: Prevent heap-based buffer over-read that was triggered in the Exiv2::Image::io function and could have lead to remote denial of service (bsc#1054590). - CVE-2017-11683: Prevent reachable assertion in the Internal::TiffReader::visitDirectory function that could have lead to a remote denial of service attack via crafted input (bsc#1051188). - CVE-2017-11591: Prevent Floating point exception in the Exiv2::ValueType function that could have lead to a remote denial of service attack via crafted input (bsc#1050257). - CVE-2017-11553: Prevent illegal address access in the extend_alias_table function via a crafted input could have lead to remote denial of service. - CVE-2017-11592: Prevent mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function that could have lead to a remote denial of service attack (heap memory corruption) via crafted input. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-727=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): exiv2-0.26-lp150.5.3.1 exiv2-debuginfo-0.26-lp150.5.3.1 exiv2-debugsource-0.26-lp150.5.3.1 libexiv2-26-0.26-lp150.5.3.1 libexiv2-26-debuginfo-0.26-lp150.5.3.1 libexiv2-devel-0.26-lp150.5.3.1 libexiv2-doc-0.26-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): libexiv2-26-32bit-0.26-lp150.5.3.1 libexiv2-26-32bit-debuginfo-0.26-lp150.5.3.1 - openSUSE Leap 15.0 (noarch): exiv2-lang-0.26-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-11337.html https://www.suse.com/security/cve/CVE-2017-11338.html https://www.suse.com/security/cve/CVE-2017-11339.html https://www.suse.com/security/cve/CVE-2017-11340.html https://www.suse.com/security/cve/CVE-2017-11553.html https://www.suse.com/security/cve/CVE-2017-11591.html https://www.suse.com/security/cve/CVE-2017-11592.html https://www.suse.com/security/cve/CVE-2017-11683.html https://www.suse.com/security/cve/CVE-2017-12955.html https://www.suse.com/security/cve/CVE-2017-12956.html https://www.suse.com/security/cve/CVE-2017-12957.html https://www.suse.com/security/cve/CVE-2017-14859.html https://www.suse.com/security/cve/CVE-2017-14860.html https://www.suse.com/security/cve/CVE-2017-14862.html https://www.suse.com/security/cve/CVE-2017-14864.html https://bugzilla.suse.com/1048883 https://bugzilla.suse.com/1050257 https://bugzilla.suse.com/1051188 https://bugzilla.suse.com/1054590 https://bugzilla.suse.com/1054592 https://bugzilla.suse.com/1054593 https://bugzilla.suse.com/1060995 https://bugzilla.suse.com/1060996 https://bugzilla.suse.com/1061000 https://bugzilla.suse.com/1061023 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1958-1: important: Security update for openslp
by opensuse-security＠opensuse.org 14 Jul '18

14 Jul '18

openSUSE Security Update: Security update for openslp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1958-1 Rating: important References: #1090638 Cross-References: CVE-2017-17833 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openslp fixes the following issues: - CVE-2017-17833: Prevent heap-related memory corruption issue which may have manifested itself as a denial-of-service or a remote code-execution vulnerability (bsc#1090638) - Prevent out of bounds reads in message parsing This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-725=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): openslp-2.0.0-lp150.5.3.1 openslp-debuginfo-2.0.0-lp150.5.3.1 openslp-debugsource-2.0.0-lp150.5.3.1 openslp-devel-2.0.0-lp150.5.3.1 openslp-server-2.0.0-lp150.5.3.1 openslp-server-debuginfo-2.0.0-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): openslp-32bit-2.0.0-lp150.5.3.1 openslp-32bit-debuginfo-2.0.0-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-17833.html https://bugzilla.suse.com/1090638 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1956-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 13 Jul '18

13 Jul '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1956-1 Rating: moderate References: #1074317 #1082332 #1082825 #1086408 #1092949 Cross-References: CVE-2017-11613 CVE-2017-18013 CVE-2018-10963 CVE-2018-7456 CVE-2018-8905 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for tiff fixes the following security issues: These security issues were fixed: - CVE-2017-18013: Fixed a NULL pointer dereference in the tif_print.cTIFFPrintDirectory function that could have lead to denial of service (bsc#1074317). - CVE-2018-10963: Fixed an assertion failure in the TIFFWriteDirectorySec() function in tif_dirwrite.c, which allowed remote attackers to cause a denial of service via a crafted file (bsc#1092949). - CVE-2018-7456: Prevent a NULL Pointer dereference in the function TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013 (bsc#1082825). - CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer (bsc#1082332). - CVE-2018-8905: Prevent heap-based buffer overflow in the function LZWDecodeCompat via a crafted TIFF file (bsc#1086408). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-728=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libtiff-devel-4.0.9-lp150.4.3.1 libtiff5-4.0.9-lp150.4.3.1 libtiff5-debuginfo-4.0.9-lp150.4.3.1 tiff-4.0.9-lp150.4.3.1 tiff-debuginfo-4.0.9-lp150.4.3.1 tiff-debugsource-4.0.9-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): libtiff-devel-32bit-4.0.9-lp150.4.3.1 libtiff5-32bit-4.0.9-lp150.4.3.1 libtiff5-32bit-debuginfo-4.0.9-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-11613.html https://www.suse.com/security/cve/CVE-2017-18013.html https://www.suse.com/security/cve/CVE-2018-10963.html https://www.suse.com/security/cve/CVE-2018-7456.html https://www.suse.com/security/cve/CVE-2018-8905.html https://bugzilla.suse.com/1074317 https://bugzilla.suse.com/1082332 https://bugzilla.suse.com/1082825 https://bugzilla.suse.com/1086408 https://bugzilla.suse.com/1092949 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1955-1: moderate: Security update for slurm
by opensuse-security＠opensuse.org 13 Jul '18

13 Jul '18

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1955-1 Rating: moderate References: #1095508 #1100850 Cross-References: CVE-2018-10995 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for slurm to version 17.11.7 fixes the following issues: This security issue was fixed: - CVE-2018-10995: Ensure correct handling of user names and group ids (bsc#1095508). These non-security issues were fixed: - CRAY - Add slurmsmwd to the contribs/cray dir - PMIX - Added the direct connect authentication. - Prevent the backup slurmctld from losing the active/available node features list on takeover. - Be able to force power_down of cloud node even if in power_save state. - Allow cloud nodes to be recognized in Slurm when booted out of band. - Notify srun and ctld when unkillable stepd exits. - Fixes daemoniziation in newly introduced slurmsmwd daemon. The following tracked packaging changes are included: - avoid postun error in libpmi0 (bsc#1100850) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-729=1 Package List: - openSUSE Leap 15.0 (x86_64): libpmi0-17.11.7-lp150.5.7.1 libpmi0-debuginfo-17.11.7-lp150.5.7.1 libslurm32-17.11.7-lp150.5.7.1 libslurm32-debuginfo-17.11.7-lp150.5.7.1 perl-slurm-17.11.7-lp150.5.7.1 perl-slurm-debuginfo-17.11.7-lp150.5.7.1 slurm-17.11.7-lp150.5.7.1 slurm-auth-none-17.11.7-lp150.5.7.1 slurm-auth-none-debuginfo-17.11.7-lp150.5.7.1 slurm-config-17.11.7-lp150.5.7.1 slurm-debuginfo-17.11.7-lp150.5.7.1 slurm-debugsource-17.11.7-lp150.5.7.1 slurm-devel-17.11.7-lp150.5.7.1 slurm-doc-17.11.7-lp150.5.7.1 slurm-lua-17.11.7-lp150.5.7.1 slurm-lua-debuginfo-17.11.7-lp150.5.7.1 slurm-munge-17.11.7-lp150.5.7.1 slurm-munge-debuginfo-17.11.7-lp150.5.7.1 slurm-node-17.11.7-lp150.5.7.1 slurm-node-debuginfo-17.11.7-lp150.5.7.1 slurm-openlava-17.11.7-lp150.5.7.1 slurm-pam_slurm-17.11.7-lp150.5.7.1 slurm-pam_slurm-debuginfo-17.11.7-lp150.5.7.1 slurm-plugins-17.11.7-lp150.5.7.1 slurm-plugins-debuginfo-17.11.7-lp150.5.7.1 slurm-seff-17.11.7-lp150.5.7.1 slurm-sjstat-17.11.7-lp150.5.7.1 slurm-slurmdbd-17.11.7-lp150.5.7.1 slurm-slurmdbd-debuginfo-17.11.7-lp150.5.7.1 slurm-sql-17.11.7-lp150.5.7.1 slurm-sql-debuginfo-17.11.7-lp150.5.7.1 slurm-sview-17.11.7-lp150.5.7.1 slurm-sview-debuginfo-17.11.7-lp150.5.7.1 slurm-torque-17.11.7-lp150.5.7.1 slurm-torque-debuginfo-17.11.7-lp150.5.7.1 References: https://www.suse.com/security/cve/CVE-2018-10995.html https://bugzilla.suse.com/1095508 https://bugzilla.suse.com/1100850 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1953-1: moderate: Security update for libvorbis
by opensuse-security＠opensuse.org 13 Jul '18

13 Jul '18

openSUSE Security Update: Security update for libvorbis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1953-1 Rating: moderate References: #1091070 Cross-References: CVE-2018-10392 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvorbis fixes the following issues: The following security issue was fixed: - Fixed the validation of channels in mapping0_forward(), which previously allowed remote attackers to cause a denial of service via specially crafted files (CVE-2018-10392, bsc#1091070) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-722=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvorbis-debugsource-1.3.6-lp150.3.3.1 libvorbis-devel-1.3.6-lp150.3.3.1 libvorbis0-1.3.6-lp150.3.3.1 libvorbis0-debuginfo-1.3.6-lp150.3.3.1 libvorbisenc2-1.3.6-lp150.3.3.1 libvorbisenc2-debuginfo-1.3.6-lp150.3.3.1 libvorbisfile3-1.3.6-lp150.3.3.1 libvorbisfile3-debuginfo-1.3.6-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libvorbis-devel-32bit-1.3.6-lp150.3.3.1 libvorbis0-32bit-1.3.6-lp150.3.3.1 libvorbis0-32bit-debuginfo-1.3.6-lp150.3.3.1 libvorbisenc2-32bit-1.3.6-lp150.3.3.1 libvorbisenc2-32bit-debuginfo-1.3.6-lp150.3.3.1 libvorbisfile3-32bit-1.3.6-lp150.3.3.1 libvorbisfile3-32bit-debuginfo-1.3.6-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): libvorbis-doc-1.3.6-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10392.html https://bugzilla.suse.com/1091070 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1924-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 11 Jul '18

11 Jul '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1924-1 Rating: moderate References: #1100343 #1100344 Cross-References: CVE-2018-3761 CVE-2018-3762 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Security issues fixed: - CVE-2018-3761: Fix improper authentication on the OAuth2 token endpoint (bsc#1100344). - CVE-2018-3762: Fix improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to (bsc#1100343). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-712=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-712=1 Package List: - openSUSE Leap 42.3 (noarch): nextcloud-13.0.4-9.1 - openSUSE Leap 15.0 (noarch): nextcloud-13.0.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-3761.html https://www.suse.com/security/cve/CVE-2018-3762.html https://bugzilla.suse.com/1100343 https://bugzilla.suse.com/1100344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1914-1: moderate: Security update for unzip
by opensuse-security＠opensuse.org 07 Jul '18

07 Jul '18

openSUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1914-1 Rating: moderate References: #1080074 #910683 #914442 Cross-References: CVE-2014-9636 CVE-2018-1000035 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for unzip fixes the following issues: - CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442) - CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074) This non-security issue was fixed: +- Allow processing of Windows zip64 archives (Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher) (bnc#910683) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-709=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): unzip-6.00-lp150.3.3.1 unzip-debuginfo-6.00-lp150.3.3.1 unzip-debugsource-6.00-lp150.3.3.1 unzip-doc-6.00-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): unzip-rcc-6.00-lp150.3.3.1 unzip-rcc-debuginfo-6.00-lp150.3.3.1 unzip-rcc-debugsource-6.00-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2014-9636.html https://www.suse.com/security/cve/CVE-2018-1000035.html https://bugzilla.suse.com/1080074 https://bugzilla.suse.com/910683 https://bugzilla.suse.com/914442 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0