August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2307-1: moderate: Recommended update for NetworkManager-vpnc
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Recommended update for NetworkManager-vpnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2307-1 Rating: moderate References: #1101147 Cross-References: CVE-2018-10900 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for NetworkManager-vpnc fixes the following issues: Security issue fixed: - CVE-2018-10900: Check configurations that contain newline characters and invalidate them to avoid security attacks (bsc#1101147). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-859=1 Package List: - openSUSE Leap 42.3 (x86_64): NetworkManager-vpnc-1.0.8-7.3.1 NetworkManager-vpnc-debuginfo-1.0.8-7.3.1 NetworkManager-vpnc-debugsource-1.0.8-7.3.1 NetworkManager-vpnc-gnome-1.0.8-7.3.1 NetworkManager-vpnc-gnome-debuginfo-1.0.8-7.3.1 - openSUSE Leap 42.3 (noarch): NetworkManager-vpnc-lang-1.0.8-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-10900.html https://bugzilla.suse.com/1101147 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2306-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2306-1 Rating: moderate References: #1074014 #1076861 #1079150 #1087416 #1092885 #1094325 #1094480 #1094725 #1095556 #959329 Cross-References: CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 9 fixes is now available. Description: This update for libvirt fixes the following issues: Security issue fixed: - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka "Memory Disambiguation" (bsc#1092885). Bug fixes: - bsc#1094325: Enable virsh blockresize for XEN guests (FATE#325467). - bsc#1095556: Fix qemu VM creating with --boot uefi due to missing AppArmor profile. - bsc#1094725: Fix `virsh blockresize` to work with Xen qdisks. - bsc#1094480: Fix `virsh list` to list domains with `xl list`. - bsc#1087416: Fix missing video device within guest with default installation by virt-mamanger. - bsc#1079150: Fix libvirt-guests start dependency. - bsc#1076861: Fix locking of lockspace resource '/devcfs/disks/uatidmsvn1-xvda'. - bsc#1074014: Fix KVM live migration when shutting down cluster node. - bsc#959329: Fix wrong state of VMs in virtual manager. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-860=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-18.1 libvirt-admin-3.3.0-18.1 libvirt-admin-debuginfo-3.3.0-18.1 libvirt-client-3.3.0-18.1 libvirt-client-debuginfo-3.3.0-18.1 libvirt-daemon-3.3.0-18.1 libvirt-daemon-config-network-3.3.0-18.1 libvirt-daemon-config-nwfilter-3.3.0-18.1 libvirt-daemon-debuginfo-3.3.0-18.1 libvirt-daemon-driver-interface-3.3.0-18.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-18.1 libvirt-daemon-driver-lxc-3.3.0-18.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-18.1 libvirt-daemon-driver-network-3.3.0-18.1 libvirt-daemon-driver-network-debuginfo-3.3.0-18.1 libvirt-daemon-driver-nodedev-3.3.0-18.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-18.1 libvirt-daemon-driver-nwfilter-3.3.0-18.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-18.1 libvirt-daemon-driver-qemu-3.3.0-18.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-18.1 libvirt-daemon-driver-secret-3.3.0-18.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-3.3.0-18.1 libvirt-daemon-driver-storage-core-3.3.0-18.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-disk-3.3.0-18.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-iscsi-3.3.0-18.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-logical-3.3.0-18.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-mpath-3.3.0-18.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-scsi-3.3.0-18.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-18.1 libvirt-daemon-driver-uml-3.3.0-18.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-18.1 libvirt-daemon-driver-vbox-3.3.0-18.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-18.1 libvirt-daemon-hooks-3.3.0-18.1 libvirt-daemon-lxc-3.3.0-18.1 libvirt-daemon-qemu-3.3.0-18.1 libvirt-daemon-uml-3.3.0-18.1 libvirt-daemon-vbox-3.3.0-18.1 libvirt-debugsource-3.3.0-18.1 libvirt-devel-3.3.0-18.1 libvirt-doc-3.3.0-18.1 libvirt-libs-3.3.0-18.1 libvirt-libs-debuginfo-3.3.0-18.1 libvirt-lock-sanlock-3.3.0-18.1 libvirt-lock-sanlock-debuginfo-3.3.0-18.1 libvirt-nss-3.3.0-18.1 libvirt-nss-debuginfo-3.3.0-18.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-18.1 libvirt-daemon-driver-libxl-3.3.0-18.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-rbd-3.3.0-18.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-18.1 libvirt-daemon-xen-3.3.0-18.1 libvirt-devel-32bit-3.3.0-18.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1074014 https://bugzilla.suse.com/1076861 https://bugzilla.suse.com/1079150 https://bugzilla.suse.com/1087416 https://bugzilla.suse.com/1092885 https://bugzilla.suse.com/1094325 https://bugzilla.suse.com/1094480 https://bugzilla.suse.com/1094725 https://bugzilla.suse.com/1095556 https://bugzilla.suse.com/959329 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2296-1: moderate: Security update for libsoup
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libsoup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2296-1 Rating: moderate References: #1052916 #1086036 #1100097 Cross-References: CVE-2017-2885 CVE-2018-12910 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libsoup fixes the following issues: Security issue fixed: - CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097). - CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916). Bug fixes: - bsc#1086036: translation-update-upstream commented out for Leap This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-856=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsoup-2_4-1-2.62.2-8.1 libsoup-2_4-1-debuginfo-2.62.2-8.1 libsoup-debugsource-2.62.2-8.1 libsoup-devel-2.62.2-8.1 typelib-1_0-Soup-2_4-2.62.2-8.1 - openSUSE Leap 42.3 (noarch): libsoup-lang-2.62.2-8.1 - openSUSE Leap 42.3 (x86_64): libsoup-2_4-1-32bit-2.62.2-8.1 libsoup-2_4-1-debuginfo-32bit-2.62.2-8.1 libsoup-devel-32bit-2.62.2-8.1 References: https://www.suse.com/security/cve/CVE-2017-2885.html https://www.suse.com/security/cve/CVE-2018-12910.html https://bugzilla.suse.com/1052916 https://bugzilla.suse.com/1086036 https://bugzilla.suse.com/1100097 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2295-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2295-1 Rating: important References: #1101667 Cross-References: CVE-2018-3005 CVE-2018-3055 CVE-2018-3085 CVE-2018-3086 CVE-2018-3087 CVE-2018-3088 CVE-2018-3089 CVE-2018-3090 CVE-2018-3091 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for virtualbox to version 5.2.16 fixes the following issues: The following security vulnerabilities were fixed (boo#1101667): - CVE-2018-3005: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. - CVE-2018-3055: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2018-3085: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2018-3086: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3087: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3088: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3089: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3090: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3091: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The following bugs were fixed: - OVF: case insensitive comparison of manifest attribute values, to improve compatibility Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-853=1 Package List: - openSUSE Leap 15.0 (x86_64): python3-virtualbox-5.2.16-lp150.4.9.1 python3-virtualbox-debuginfo-5.2.16-lp150.4.9.1 virtualbox-5.2.16-lp150.4.9.1 virtualbox-debuginfo-5.2.16-lp150.4.9.1 virtualbox-debugsource-5.2.16-lp150.4.9.1 virtualbox-devel-5.2.16-lp150.4.9.1 virtualbox-guest-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-guest-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-guest-tools-5.2.16-lp150.4.9.1 virtualbox-guest-tools-debuginfo-5.2.16-lp150.4.9.1 virtualbox-guest-x11-5.2.16-lp150.4.9.1 virtualbox-guest-x11-debuginfo-5.2.16-lp150.4.9.1 virtualbox-host-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-host-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-qt-5.2.16-lp150.4.9.1 virtualbox-qt-debuginfo-5.2.16-lp150.4.9.1 virtualbox-vnc-5.2.16-lp150.4.9.1 virtualbox-websrv-5.2.16-lp150.4.9.1 virtualbox-websrv-debuginfo-5.2.16-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-5.2.16-lp150.4.9.1 virtualbox-guest-source-5.2.16-lp150.4.9.1 virtualbox-host-source-5.2.16-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2018-3005.html https://www.suse.com/security/cve/CVE-2018-3055.html https://www.suse.com/security/cve/CVE-2018-3085.html https://www.suse.com/security/cve/CVE-2018-3086.html https://www.suse.com/security/cve/CVE-2018-3087.html https://www.suse.com/security/cve/CVE-2018-3088.html https://www.suse.com/security/cve/CVE-2018-3089.html https://www.suse.com/security/cve/CVE-2018-3090.html https://www.suse.com/security/cve/CVE-2018-3091.html https://bugzilla.suse.com/1101667 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2294-1: Security update for libcdio
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libcdio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2294-1 Rating: low References: #1082821 #1082877 Cross-References: CVE-2017-18199 CVE-2017-18201 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libcdio fixes the following issues: The following security vulnerabilities were addressed: - CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c (bsc#1082821) - CVE-2017-18201: Fixed a double free vulnerability in get_cdtext_generic() in _cdio_generic.c (bsc#1082877) - Fixed several memory leaks (bsc#1082821) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-857=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libcdio++0-0.94-lp150.5.3.1 libcdio++0-debuginfo-0.94-lp150.5.3.1 libcdio-debugsource-0.94-lp150.5.3.1 libcdio-devel-0.94-lp150.5.3.1 libcdio16-0.94-lp150.5.3.1 libcdio16-debuginfo-0.94-lp150.5.3.1 libiso9660-10-0.94-lp150.5.3.1 libiso9660-10-debuginfo-0.94-lp150.5.3.1 libudf0-0.94-lp150.5.3.1 libudf0-debuginfo-0.94-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): cdio-utils-0.94-lp150.5.3.1 cdio-utils-debuginfo-0.94-lp150.5.3.1 cdio-utils-debugsource-0.94-lp150.5.3.1 libcdio++0-32bit-0.94-lp150.5.3.1 libcdio++0-32bit-debuginfo-0.94-lp150.5.3.1 libcdio16-32bit-0.94-lp150.5.3.1 libcdio16-32bit-debuginfo-0.94-lp150.5.3.1 libiso9660-10-32bit-0.94-lp150.5.3.1 libiso9660-10-32bit-debuginfo-0.94-lp150.5.3.1 libudf0-32bit-0.94-lp150.5.3.1 libudf0-32bit-debuginfo-0.94-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-18199.html https://www.suse.com/security/cve/CVE-2017-18201.html https://bugzilla.suse.com/1082821 https://bugzilla.suse.com/1082877 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2293-1: moderate: Security update for mysql-community-server
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2293-1 Rating: moderate References: #1087102 #1088681 #1101676 #1101678 #1101679 #1101680 #1103342 #1103344 Cross-References: CVE-2018-0739 CVE-2018-2767 CVE-2018-3058 CVE-2018-3062 CVE-2018-3064 CVE-2018-3066 CVE-2018-3070 CVE-2018-3081 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for mysql-community-server to version 5.6.41 fixes the following issues: Security vulnerabilities fixed: - CVE-2018-3064: Fixed an easily exploitable vulnerability that allowed a low privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (bsc#1103342) - CVE-2018-3070: Fixed an easily exploitable vulnerability that allowed a low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (bsc#1101679) - CVE-2018-0739: Fixed a stack exhaustion in case of recursively constructed ASN.1 types. (boo#1087102) - CVE-2018-3062: Fixed a difficult to exploit vulnerability that allowed low privileged attacker with network access via memcached to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (bsc#1103344) - CVE-2018-3081: Fixed a difficult to exploit vulnerability that allowed high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client as well as unauthorized update, insert or delete access to some of MySQL Client accessible data. (bsc#1101680) - CVE-2018-3058: Fixed an easily exploitable vulnerability that allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. (bsc#1101676) - CVE-2018-3066: Fixed a difficult to exploit vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. (bsc#1101678) - CVE-2018-2767: Fixed a difficult to exploit vulnerability that allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. (boo#1088681) You can find more detailed information about this update in the [release notes](http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-41.html) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-844=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.41-39.1 libmysql56client18-debuginfo-5.6.41-39.1 libmysql56client_r18-5.6.41-39.1 mysql-community-server-5.6.41-39.1 mysql-community-server-bench-5.6.41-39.1 mysql-community-server-bench-debuginfo-5.6.41-39.1 mysql-community-server-client-5.6.41-39.1 mysql-community-server-client-debuginfo-5.6.41-39.1 mysql-community-server-debuginfo-5.6.41-39.1 mysql-community-server-debugsource-5.6.41-39.1 mysql-community-server-test-5.6.41-39.1 mysql-community-server-test-debuginfo-5.6.41-39.1 mysql-community-server-tools-5.6.41-39.1 mysql-community-server-tools-debuginfo-5.6.41-39.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.41-39.1 libmysql56client18-debuginfo-32bit-5.6.41-39.1 libmysql56client_r18-32bit-5.6.41-39.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.41-39.1 References: https://www.suse.com/security/cve/CVE-2018-0739.html https://www.suse.com/security/cve/CVE-2018-2767.html https://www.suse.com/security/cve/CVE-2018-3058.html https://www.suse.com/security/cve/CVE-2018-3062.html https://www.suse.com/security/cve/CVE-2018-3064.html https://www.suse.com/security/cve/CVE-2018-3066.html https://www.suse.com/security/cve/CVE-2018-3070.html https://www.suse.com/security/cve/CVE-2018-3081.html https://bugzilla.suse.com/1087102 https://bugzilla.suse.com/1088681 https://bugzilla.suse.com/1101676 https://bugzilla.suse.com/1101678 https://bugzilla.suse.com/1101679 https://bugzilla.suse.com/1101680 https://bugzilla.suse.com/1103342 https://bugzilla.suse.com/1103344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2292-1: moderate: Security update for cups
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2292-1 Rating: moderate References: #1096405 #1096406 #1096407 #1096408 Cross-References: CVE-2018-4180 CVE-2018-4181 CVE-2018-4182 CVE-2018-4183 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for cups fixes the following issues: The following security vulnerabilities were fixed: - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend (bsc#1096405) - CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406) - CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling (bsc#1096407) - CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration (bsc#1096408) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-852=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cups-2.2.7-lp150.2.3.1 cups-client-2.2.7-lp150.2.3.1 cups-client-debuginfo-2.2.7-lp150.2.3.1 cups-config-2.2.7-lp150.2.3.1 cups-ddk-2.2.7-lp150.2.3.1 cups-ddk-debuginfo-2.2.7-lp150.2.3.1 cups-debuginfo-2.2.7-lp150.2.3.1 cups-debugsource-2.2.7-lp150.2.3.1 cups-devel-2.2.7-lp150.2.3.1 libcups2-2.2.7-lp150.2.3.1 libcups2-debuginfo-2.2.7-lp150.2.3.1 libcupscgi1-2.2.7-lp150.2.3.1 libcupscgi1-debuginfo-2.2.7-lp150.2.3.1 libcupsimage2-2.2.7-lp150.2.3.1 libcupsimage2-debuginfo-2.2.7-lp150.2.3.1 libcupsmime1-2.2.7-lp150.2.3.1 libcupsmime1-debuginfo-2.2.7-lp150.2.3.1 libcupsppdc1-2.2.7-lp150.2.3.1 libcupsppdc1-debuginfo-2.2.7-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): cups-devel-32bit-2.2.7-lp150.2.3.1 libcups2-32bit-2.2.7-lp150.2.3.1 libcups2-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupscgi1-32bit-2.2.7-lp150.2.3.1 libcupscgi1-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupsimage2-32bit-2.2.7-lp150.2.3.1 libcupsimage2-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupsmime1-32bit-2.2.7-lp150.2.3.1 libcupsmime1-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupsppdc1-32bit-2.2.7-lp150.2.3.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-4180.html https://www.suse.com/security/cve/CVE-2018-4181.html https://www.suse.com/security/cve/CVE-2018-4182.html https://www.suse.com/security/cve/CVE-2018-4183.html https://bugzilla.suse.com/1096405 https://bugzilla.suse.com/1096406 https://bugzilla.suse.com/1096407 https://bugzilla.suse.com/1096408 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2291-1: moderate: Security update for python-mitmproxy
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for python-mitmproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2291-1 Rating: moderate References: #1101457 #1102178 Cross-References: CVE-2018-14505 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for python-mitmproxy fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14505: Fixed multiple DNS rebinding attacks related to tools/web/app.py (boo#1102178) The following other issue was fixed: - Fixed a dependency issue with python-ldap3 (boo#1101457) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-850=1 Package List: - openSUSE Leap 15.0 (noarch): python3-mitmproxy-3.0.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14505.html https://bugzilla.suse.com/1101457 https://bugzilla.suse.com/1102178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2290-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2290-1 Rating: moderate References: #1083066 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-855=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-855=1 Package List: - openSUSE Leap 42.3 (x86_64): blueman-2.0.6-2.3.1 blueman-debuginfo-2.0.6-2.3.1 blueman-debugsource-2.0.6-2.3.1 - openSUSE Leap 42.3 (noarch): blueman-lang-2.0.6-2.3.1 thunar-sendto-blueman-2.0.6-2.3.1 - openSUSE Leap 15.0 (x86_64): blueman-2.0.6-lp150.3.3.1 blueman-debuginfo-2.0.6-lp150.3.3.1 blueman-debugsource-2.0.6-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): blueman-lang-2.0.6-lp150.3.3.1 thunar-sendto-blueman-2.0.6-lp150.3.3.1 References: https://bugzilla.suse.com/1083066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2289-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2289-1 Rating: moderate References: #1098163 #1098377 Cross-References: CVE-2018-10852 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sssd fixes the following security issue: - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-847=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libipa_hbac-devel-1.16.1-lp150.2.3.1 libipa_hbac0-1.16.1-lp150.2.3.1 libipa_hbac0-debuginfo-1.16.1-lp150.2.3.1 libnfsidmap-sss-1.16.1-lp150.2.3.1 libnfsidmap-sss-debuginfo-1.16.1-lp150.2.3.1 libsss_certmap-devel-1.16.1-lp150.2.3.1 libsss_certmap0-1.16.1-lp150.2.3.1 libsss_certmap0-debuginfo-1.16.1-lp150.2.3.1 libsss_idmap-devel-1.16.1-lp150.2.3.1 libsss_idmap0-1.16.1-lp150.2.3.1 libsss_idmap0-debuginfo-1.16.1-lp150.2.3.1 libsss_nss_idmap-devel-1.16.1-lp150.2.3.1 libsss_nss_idmap0-1.16.1-lp150.2.3.1 libsss_nss_idmap0-debuginfo-1.16.1-lp150.2.3.1 libsss_simpleifp-devel-1.16.1-lp150.2.3.1 libsss_simpleifp0-1.16.1-lp150.2.3.1 libsss_simpleifp0-debuginfo-1.16.1-lp150.2.3.1 python3-ipa_hbac-1.16.1-lp150.2.3.1 python3-ipa_hbac-debuginfo-1.16.1-lp150.2.3.1 python3-sss-murmur-1.16.1-lp150.2.3.1 python3-sss-murmur-debuginfo-1.16.1-lp150.2.3.1 python3-sss_nss_idmap-1.16.1-lp150.2.3.1 python3-sss_nss_idmap-debuginfo-1.16.1-lp150.2.3.1 python3-sssd-config-1.16.1-lp150.2.3.1 python3-sssd-config-debuginfo-1.16.1-lp150.2.3.1 sssd-1.16.1-lp150.2.3.1 sssd-ad-1.16.1-lp150.2.3.1 sssd-ad-debuginfo-1.16.1-lp150.2.3.1 sssd-dbus-1.16.1-lp150.2.3.1 sssd-dbus-debuginfo-1.16.1-lp150.2.3.1 sssd-debuginfo-1.16.1-lp150.2.3.1 sssd-debugsource-1.16.1-lp150.2.3.1 sssd-ipa-1.16.1-lp150.2.3.1 sssd-ipa-debuginfo-1.16.1-lp150.2.3.1 sssd-krb5-1.16.1-lp150.2.3.1 sssd-krb5-common-1.16.1-lp150.2.3.1 sssd-krb5-common-debuginfo-1.16.1-lp150.2.3.1 sssd-krb5-debuginfo-1.16.1-lp150.2.3.1 sssd-ldap-1.16.1-lp150.2.3.1 sssd-ldap-debuginfo-1.16.1-lp150.2.3.1 sssd-proxy-1.16.1-lp150.2.3.1 sssd-proxy-debuginfo-1.16.1-lp150.2.3.1 sssd-tools-1.16.1-lp150.2.3.1 sssd-tools-debuginfo-1.16.1-lp150.2.3.1 sssd-wbclient-1.16.1-lp150.2.3.1 sssd-wbclient-debuginfo-1.16.1-lp150.2.3.1 sssd-wbclient-devel-1.16.1-lp150.2.3.1 sssd-winbind-idmap-1.16.1-lp150.2.3.1 sssd-winbind-idmap-debuginfo-1.16.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): sssd-32bit-1.16.1-lp150.2.3.1 sssd-32bit-debuginfo-1.16.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10852.html https://bugzilla.suse.com/1098163 https://bugzilla.suse.com/1098377 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0