July 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:1913-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 07 Jul '18

07 Jul '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1913-1 Rating: moderate References: #1099098 Cross-References: CVE-2018-12882 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2018-12882: exif_read_from_impl allowed attackers to trigger a use-after-free (in exif_read_from_file) because it closed a stream that it is not responsible for closing (bsc#1099098) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-708=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-40.1 apache2-mod_php7-debuginfo-7.0.7-40.1 php7-7.0.7-40.1 php7-bcmath-7.0.7-40.1 php7-bcmath-debuginfo-7.0.7-40.1 php7-bz2-7.0.7-40.1 php7-bz2-debuginfo-7.0.7-40.1 php7-calendar-7.0.7-40.1 php7-calendar-debuginfo-7.0.7-40.1 php7-ctype-7.0.7-40.1 php7-ctype-debuginfo-7.0.7-40.1 php7-curl-7.0.7-40.1 php7-curl-debuginfo-7.0.7-40.1 php7-dba-7.0.7-40.1 php7-dba-debuginfo-7.0.7-40.1 php7-debuginfo-7.0.7-40.1 php7-debugsource-7.0.7-40.1 php7-devel-7.0.7-40.1 php7-dom-7.0.7-40.1 php7-dom-debuginfo-7.0.7-40.1 php7-enchant-7.0.7-40.1 php7-enchant-debuginfo-7.0.7-40.1 php7-exif-7.0.7-40.1 php7-exif-debuginfo-7.0.7-40.1 php7-fastcgi-7.0.7-40.1 php7-fastcgi-debuginfo-7.0.7-40.1 php7-fileinfo-7.0.7-40.1 php7-fileinfo-debuginfo-7.0.7-40.1 php7-firebird-7.0.7-40.1 php7-firebird-debuginfo-7.0.7-40.1 php7-fpm-7.0.7-40.1 php7-fpm-debuginfo-7.0.7-40.1 php7-ftp-7.0.7-40.1 php7-ftp-debuginfo-7.0.7-40.1 php7-gd-7.0.7-40.1 php7-gd-debuginfo-7.0.7-40.1 php7-gettext-7.0.7-40.1 php7-gettext-debuginfo-7.0.7-40.1 php7-gmp-7.0.7-40.1 php7-gmp-debuginfo-7.0.7-40.1 php7-iconv-7.0.7-40.1 php7-iconv-debuginfo-7.0.7-40.1 php7-imap-7.0.7-40.1 php7-imap-debuginfo-7.0.7-40.1 php7-intl-7.0.7-40.1 php7-intl-debuginfo-7.0.7-40.1 php7-json-7.0.7-40.1 php7-json-debuginfo-7.0.7-40.1 php7-ldap-7.0.7-40.1 php7-ldap-debuginfo-7.0.7-40.1 php7-mbstring-7.0.7-40.1 php7-mbstring-debuginfo-7.0.7-40.1 php7-mcrypt-7.0.7-40.1 php7-mcrypt-debuginfo-7.0.7-40.1 php7-mysql-7.0.7-40.1 php7-mysql-debuginfo-7.0.7-40.1 php7-odbc-7.0.7-40.1 php7-odbc-debuginfo-7.0.7-40.1 php7-opcache-7.0.7-40.1 php7-opcache-debuginfo-7.0.7-40.1 php7-openssl-7.0.7-40.1 php7-openssl-debuginfo-7.0.7-40.1 php7-pcntl-7.0.7-40.1 php7-pcntl-debuginfo-7.0.7-40.1 php7-pdo-7.0.7-40.1 php7-pdo-debuginfo-7.0.7-40.1 php7-pgsql-7.0.7-40.1 php7-pgsql-debuginfo-7.0.7-40.1 php7-phar-7.0.7-40.1 php7-phar-debuginfo-7.0.7-40.1 php7-posix-7.0.7-40.1 php7-posix-debuginfo-7.0.7-40.1 php7-pspell-7.0.7-40.1 php7-pspell-debuginfo-7.0.7-40.1 php7-readline-7.0.7-40.1 php7-readline-debuginfo-7.0.7-40.1 php7-shmop-7.0.7-40.1 php7-shmop-debuginfo-7.0.7-40.1 php7-snmp-7.0.7-40.1 php7-snmp-debuginfo-7.0.7-40.1 php7-soap-7.0.7-40.1 php7-soap-debuginfo-7.0.7-40.1 php7-sockets-7.0.7-40.1 php7-sockets-debuginfo-7.0.7-40.1 php7-sqlite-7.0.7-40.1 php7-sqlite-debuginfo-7.0.7-40.1 php7-sysvmsg-7.0.7-40.1 php7-sysvmsg-debuginfo-7.0.7-40.1 php7-sysvsem-7.0.7-40.1 php7-sysvsem-debuginfo-7.0.7-40.1 php7-sysvshm-7.0.7-40.1 php7-sysvshm-debuginfo-7.0.7-40.1 php7-tidy-7.0.7-40.1 php7-tidy-debuginfo-7.0.7-40.1 php7-tokenizer-7.0.7-40.1 php7-tokenizer-debuginfo-7.0.7-40.1 php7-wddx-7.0.7-40.1 php7-wddx-debuginfo-7.0.7-40.1 php7-xmlreader-7.0.7-40.1 php7-xmlreader-debuginfo-7.0.7-40.1 php7-xmlrpc-7.0.7-40.1 php7-xmlrpc-debuginfo-7.0.7-40.1 php7-xmlwriter-7.0.7-40.1 php7-xmlwriter-debuginfo-7.0.7-40.1 php7-xsl-7.0.7-40.1 php7-xsl-debuginfo-7.0.7-40.1 php7-zip-7.0.7-40.1 php7-zip-debuginfo-7.0.7-40.1 php7-zlib-7.0.7-40.1 php7-zlib-debuginfo-7.0.7-40.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-40.1 php7-pear-Archive_Tar-7.0.7-40.1 References: https://www.suse.com/security/cve/CVE-2018-12882.html https://bugzilla.suse.com/1099098 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1912-1: moderate: Security update for openvpn
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1912-1 Rating: moderate References: #1090839 Cross-References: CVE-2018-9336 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn fixes the following issues: - CVE-2018-9336: Fix potential double-free() in Interactive Service could lead to denial of service (bsc#1090839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-705=1 Package List: - openSUSE Leap 15.0 (x86_64): openvpn-2.4.3-lp150.3.3.1 openvpn-auth-pam-plugin-2.4.3-lp150.3.3.1 openvpn-auth-pam-plugin-debuginfo-2.4.3-lp150.3.3.1 openvpn-debuginfo-2.4.3-lp150.3.3.1 openvpn-debugsource-2.4.3-lp150.3.3.1 openvpn-devel-2.4.3-lp150.3.3.1 openvpn-down-root-plugin-2.4.3-lp150.3.3.1 openvpn-down-root-plugin-debuginfo-2.4.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-9336.html https://bugzilla.suse.com/1090839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1909-1: moderate: Security update for ghostscript
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1909-1 Rating: moderate References: #1090099 Cross-References: CVE-2018-10194 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following issues: - CVE-2018-10194: The set_text_distance function did not prevent overflows in text-positioning calculation, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document (bsc#1090099). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-706=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ghostscript-9.23-lp150.2.3.1 ghostscript-debuginfo-9.23-lp150.2.3.1 ghostscript-debugsource-9.23-lp150.2.3.1 ghostscript-devel-9.23-lp150.2.3.1 ghostscript-mini-9.23-lp150.2.3.1 ghostscript-mini-debuginfo-9.23-lp150.2.3.1 ghostscript-mini-debugsource-9.23-lp150.2.3.1 ghostscript-mini-devel-9.23-lp150.2.3.1 ghostscript-x11-9.23-lp150.2.3.1 ghostscript-x11-debuginfo-9.23-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10194.html https://bugzilla.suse.com/1090099 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1908-1: important: Security update for rubygem-yard
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for rubygem-yard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1908-1 Rating: important References: #1070263 Cross-References: CVE-2017-17042 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-yard fixes the following issues: - CVE-2017-17042: The server in YARD did not block relative paths with an initial ../ sequence, which allowed attackers to conduct directory traversal attacks and read arbitrary files (bsc#1070263). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-707=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ruby2.1-rubygem-yard-0.8.7.3-8.3.1 ruby2.1-rubygem-yard-doc-0.8.7.3-8.3.1 ruby2.1-rubygem-yard-testsuite-0.8.7.3-8.3.1 ruby2.2-rubygem-yard-0.8.7.3-8.3.1 ruby2.2-rubygem-yard-doc-0.8.7.3-8.3.1 ruby2.2-rubygem-yard-testsuite-0.8.7.3-8.3.1 ruby2.3-rubygem-yard-0.8.7.3-8.3.1 ruby2.3-rubygem-yard-doc-0.8.7.3-8.3.1 ruby2.3-rubygem-yard-testsuite-0.8.7.3-8.3.1 ruby2.4-rubygem-yard-0.8.7.3-8.3.1 ruby2.4-rubygem-yard-doc-0.8.7.3-8.3.1 ruby2.4-rubygem-yard-testsuite-0.8.7.3-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-17042.html https://bugzilla.suse.com/1070263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1907-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1907-1 Rating: moderate References: #1076907 #1085780 #1091376 #1098998 #1100079 #1100081 #1100082 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374 CVE-2018-5188 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base (MFSA 2018-16, bsc#1098998): - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-5188: Memory safety bugs fixed in Thunderbird 52.9.0 Security issues fixed that affect e-mail privacy and integrity (including EFAIL): - CVE-2018-12372: S/MIME and PGP decryption oracles can be built with HTML emails (bsc#1100082) - CVE-2018-12373: S/MIME plaintext can be leaked through HTML reply/forward (bsc#1100079) - CVE-2018-12374: Using form to exfiltrate encrypted mail part by pressing enter in form field (bsc#1100081) The following options are available for added security in certain scenarios: - Option for not decrypting subordinate message parts that otherwise might reveal decryted content to the attacker. Preference mailnews.p7m_subparts_external needs to be set to true for added security. The following upstream changes are included: - Thunderbird will now prompt to compact IMAP folders even if the account is online - Fix various problems when forwarding messages inline when using "simple" HTML view The following tracked packaging changes are included: - correct requires and provides handling (boo#1076907) - reduce memory footprint with %ix86 at linking time via additional compiler flags (boo#1091376) - Build from upstream source archive and verify source signature (boo#1085780) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-701=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.9.0-65.1 MozillaThunderbird-buildsymbols-52.9.0-65.1 MozillaThunderbird-debuginfo-52.9.0-65.1 MozillaThunderbird-debugsource-52.9.0-65.1 MozillaThunderbird-devel-52.9.0-65.1 MozillaThunderbird-translations-common-52.9.0-65.1 MozillaThunderbird-translations-other-52.9.0-65.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12372.html https://www.suse.com/security/cve/CVE-2018-12373.html https://www.suse.com/security/cve/CVE-2018-12374.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1085780 https://bugzilla.suse.com/1091376 https://bugzilla.suse.com/1098998 https://bugzilla.suse.com/1100079 https://bugzilla.suse.com/1100081 https://bugzilla.suse.com/1100082 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1906-1: moderate: Security update for openssl
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1906-1 Rating: moderate References: #1097158 #1097624 #1098592 Cross-References: CVE-2018-0732 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for openssl fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158). - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-704=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenssl-devel-1.0.2j-25.1 libopenssl1_0_0-1.0.2j-25.1 libopenssl1_0_0-debuginfo-1.0.2j-25.1 libopenssl1_0_0-hmac-1.0.2j-25.1 openssl-1.0.2j-25.1 openssl-cavs-1.0.2j-25.1 openssl-cavs-debuginfo-1.0.2j-25.1 openssl-debuginfo-1.0.2j-25.1 openssl-debugsource-1.0.2j-25.1 - openSUSE Leap 42.3 (noarch): openssl-doc-1.0.2j-25.1 - openSUSE Leap 42.3 (x86_64): libopenssl-devel-32bit-1.0.2j-25.1 libopenssl1_0_0-32bit-1.0.2j-25.1 libopenssl1_0_0-debuginfo-32bit-1.0.2j-25.1 libopenssl1_0_0-hmac-32bit-1.0.2j-25.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097624 https://bugzilla.suse.com/1098592 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1905-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1905-1 Rating: moderate References: #1076907 #1085780 #1091376 #1098998 #1100079 #1100081 #1100082 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base (MFSA 2018-16, bsc#1098998): - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-5188: Memory safety bugs fixed in Thunderbird 52.9.0 Security issues fixed that affect e-mail privacy and integrity (including EFAIL): - CVE-2018-12372: S/MIME and PGP decryption oracles can be built with HTML emails (bsc#1100082) - CVE-2018-12373: S/MIME plaintext can be leaked through HTML reply/forward (bsc#1100079) - CVE-2018-12374: Using form to exfiltrate encrypted mail part by pressing enter in form field (bsc#1100081) The following options are available for added security in certain scenarios: - Option for not decrypting subordinate message parts that otherwise might reveal decryted content to the attacker. Preference mailnews.p7m_subparts_external needs to be set to true for added security. The following upstream changes are included: - Thunderbird will now prompt to compact IMAP folders even if the account is online - Fix various problems when forwarding messages inline when using "simple" HTML view The following tracked packaging changes are included: - correct requires and provides handling (boo#1076907) - reduce memory footprint with %ix86 at linking time via additional compiler flags (boo#1091376) - Build from upstream source archive and verify source signature (boo#1085780) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-701=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-701=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-52.9.0-68.1 MozillaThunderbird-buildsymbols-52.9.0-68.1 MozillaThunderbird-debuginfo-52.9.0-68.1 MozillaThunderbird-debugsource-52.9.0-68.1 MozillaThunderbird-devel-52.9.0-68.1 MozillaThunderbird-translations-common-52.9.0-68.1 MozillaThunderbird-translations-other-52.9.0-68.1 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-52.9.0-lp150.3.8.1 MozillaThunderbird-buildsymbols-52.9.0-lp150.3.8.1 MozillaThunderbird-debuginfo-52.9.0-lp150.3.8.1 MozillaThunderbird-debugsource-52.9.0-lp150.3.8.1 MozillaThunderbird-devel-52.9.0-lp150.3.8.1 MozillaThunderbird-translations-common-52.9.0-lp150.3.8.1 MozillaThunderbird-translations-other-52.9.0-lp150.3.8.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12372.html https://www.suse.com/security/cve/CVE-2018-12373.html https://www.suse.com/security/cve/CVE-2018-12374.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1085780 https://bugzilla.suse.com/1091376 https://bugzilla.suse.com/1098998 https://bugzilla.suse.com/1100079 https://bugzilla.suse.com/1100081 https://bugzilla.suse.com/1100082 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1904-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1904-1 Rating: important References: #1087082 #1087083 #1100147 Cross-References: CVE-2018-3639 CVE-2018-3640 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ucode-intel fixes the following issues: The microcode bundles was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and helps mitigating CVE-2018-3639 (Spectre v4) (bsc#1100147 bsc#1087082 bsc#1087083). More information on: https://downloadcenter.intel.com/download/27945/Linux-Processor-Microcode-D ata-File Following chipsets are fixed in this round: Model Stepping F-MO-S/PI Old->New ---- updated platforms ------------------------------------ SNB-EP C1 6-2d-6/6d 0000061c->0000061d Xeon E5 SNB-EP C2 6-2d-7/6d 00000713->00000714 Xeon E5 IVT C0 6-3e-4/ed 0000042c->0000042d Xeon E5 v2; Core i7-4960X/4930K/4820K IVT D1 6-3e-7/ed 00000713->00000714 Xeon E5 v2 HSX-E/EP/4S C0 6-3f-2/6f 0000003c->0000003d Xeon E5 v3 HSX-EX E0 6-3f-4/80 00000011->00000012 Xeon E7 v3 SKX-SP/D/W/X H0 6-55-4/b7 02000043->0200004d Xeon Bronze 31xx, Silver 41xx, Gold 51xx/61xx Platinum 81xx, D/W-21xx; Core i9-7xxxX BDX-DE A1 6-56-5/10 0e000009->0e00000a Xeon D-15x3N BDX-ML B/M/R0 6-4f-1/ef 0b00002c->0b00002e Xeon E5/E7 v4; Core i7-69xx/68xx Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-700=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-700=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ucode-intel-20180703-25.1 ucode-intel-blob-20180703-25.1 ucode-intel-debuginfo-20180703-25.1 ucode-intel-debugsource-20180703-25.1 - openSUSE Leap 15.0 (x86_64): ucode-intel-20180703-lp150.2.4.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2018-3640.html https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1087083 https://bugzilla.suse.com/1100147 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1900-1: moderate: Recommended update for postgresql95
by opensuse-security＠opensuse.org 05 Jul '18

05 Jul '18

openSUSE Security Update: Recommended update for postgresql95 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1900-1 Rating: moderate References: #1091610 Cross-References: CVE-2018-1115 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql95 fixes the following issues: - Update to PostgreSQL 9.5.13: * https://www.postgresql.org/docs/9.5/static/release-9-5-13.html A dump/restore is not required for those running 9.5.X. However, if the function marking mistakes mentioned belowpg_logfile_rotate affect you, you will want to take steps to correct your database catalogs. The functions query_to_xml, cursor_to_xml, cursor_to_xmlschema, query_to_xmlschema, and query_to_xml_and_xmlschema should be marked volatile because they execute user-supplied queries that might contain volatile operations. They were not, leading to a risk of incorrect query optimization. This has been repaired for new installations by correcting the initial catalog data, but existing installations will continue to contain the incorrect markings. Practical use of these functions seems to pose little hazard, but in case of trouble, it can be fixed by manually updating these functions' pg_proc entries, for example: ALTER FUNCTION pg_catalog.query_to_xml(text, boolean, boolean, text) VOLATILE. (Note that that will need to be done in each database of the installation.) Another option is to pg_upgrade the database to a version containing the corrected initial data. Security issue fixed: - CVE-2018-1115: Remove public execute privilege from contrib/adminpack's pg_logfile_rotate() function pg_logfile_rotate() is a deprecated wrapper for the core function pg_rotate_logfile(). When that function was changed to rely on SQL privileges for access control rather than a hard-coded superuser check, pg_logfile_rotate() should have been updated as well, but the need for this was missed. Hence, if adminpack is installed, any user could request a logfile rotation, creating a minor security issue. After installing this update, administrators should update adminpack by performing ALTER EXTENSION adminpack UPDATE in each database in which adminpack is installed. (bsc#1091610) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-696=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql95-9.5.13-2.9.1 postgresql95-contrib-9.5.13-2.9.1 postgresql95-contrib-debuginfo-9.5.13-2.9.1 postgresql95-debuginfo-9.5.13-2.9.1 postgresql95-debugsource-9.5.13-2.9.1 postgresql95-devel-9.5.13-2.9.1 postgresql95-devel-debuginfo-9.5.13-2.9.1 postgresql95-libs-debugsource-9.5.13-2.9.1 postgresql95-plperl-9.5.13-2.9.1 postgresql95-plperl-debuginfo-9.5.13-2.9.1 postgresql95-plpython-9.5.13-2.9.1 postgresql95-plpython-debuginfo-9.5.13-2.9.1 postgresql95-pltcl-9.5.13-2.9.1 postgresql95-pltcl-debuginfo-9.5.13-2.9.1 postgresql95-server-9.5.13-2.9.1 postgresql95-server-debuginfo-9.5.13-2.9.1 postgresql95-test-9.5.13-2.9.1 - openSUSE Leap 42.3 (noarch): postgresql95-docs-9.5.13-2.9.1 References: https://www.suse.com/security/cve/CVE-2018-1115.html https://bugzilla.suse.com/1091610 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:1897-1: moderate: Security update for git-annex
by opensuse-security＠opensuse.org 05 Jul '18

05 Jul '18

openSUSE Security Update: Security update for git-annex ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1897-1 Rating: moderate References: #1098062 #1098364 Cross-References: CVE-2018-10857 CVE-2018-10859 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git-annex to version 6.20180626 fixes the following issues: - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier (bsc#1098062). - CVE-2018-10859: Prevent local gpg encrypted file disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes (bsc#1098364). This update brings many other bug fixes and new features. http://hackage.haskell.org/package/git-annex-6.20180626/changelog has a detailed list of changes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-697=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): git-annex-6.20180626-7.1 git-annex-bash-completion-6.20180626-7.1 References: https://www.suse.com/security/cve/CVE-2018-10857.html https://www.suse.com/security/cve/CVE-2018-10859.html https://bugzilla.suse.com/1098062 https://bugzilla.suse.com/1098364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0