August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2288-1: important: Security update for libtirpc
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libtirpc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2288-1 Rating: important References: #1072183 #968175 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libtirpc fixes the following issues: Security issue fixed: - bsc#968175: Fix remote crash of RPC services. Bug fixes: - bsc#1072183: Send RPC getport call as specified via parameter. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-851=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtirpc-debugsource-1.0.1-5.3.1 libtirpc-devel-1.0.1-5.3.1 libtirpc-netconfig-1.0.1-5.3.1 libtirpc3-1.0.1-5.3.1 libtirpc3-debuginfo-1.0.1-5.3.1 - openSUSE Leap 42.3 (x86_64): libtirpc3-32bit-1.0.1-5.3.1 libtirpc3-debuginfo-32bit-1.0.1-5.3.1 References: https://bugzilla.suse.com/1072183 https://bugzilla.suse.com/968175 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2287-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2287-1 Rating: moderate References: #1053417 Cross-References: CVE-2015-4491 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdk-pixbuf fixes the following issues: Security issue fixed: - CVE-2015-4491: Fix integer multiplication overflow that allows for DoS or potentially RCE (bsc#1053417). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-846=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gdk-pixbuf-debugsource-2.34.0-19.1 gdk-pixbuf-devel-2.34.0-19.1 gdk-pixbuf-devel-debuginfo-2.34.0-19.1 gdk-pixbuf-query-loaders-2.34.0-19.1 gdk-pixbuf-query-loaders-debuginfo-2.34.0-19.1 libgdk_pixbuf-2_0-0-2.34.0-19.1 libgdk_pixbuf-2_0-0-debuginfo-2.34.0-19.1 typelib-1_0-GdkPixbuf-2_0-2.34.0-19.1 - openSUSE Leap 42.3 (noarch): gdk-pixbuf-lang-2.34.0-19.1 - openSUSE Leap 42.3 (x86_64): gdk-pixbuf-devel-32bit-2.34.0-19.1 gdk-pixbuf-devel-debuginfo-32bit-2.34.0-19.1 gdk-pixbuf-query-loaders-32bit-2.34.0-19.1 gdk-pixbuf-query-loaders-debuginfo-32bit-2.34.0-19.1 libgdk_pixbuf-2_0-0-32bit-2.34.0-19.1 libgdk_pixbuf-2_0-0-debuginfo-32bit-2.34.0-19.1 References: https://www.suse.com/security/cve/CVE-2015-4491.html https://bugzilla.suse.com/1053417 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2286-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2286-1 Rating: moderate References: #1103200 #1103206 #1103353 #1103359 #1103360 #1103361 Cross-References: CVE-2018-5807 CVE-2018-5810 CVE-2018-5811 CVE-2018-5812 CVE-2018-5813 CVE-2018-5815 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for libraw fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-5813: Fixed an error within the "parse_minolta()" function (dcraw/dcraw.c) that could be exploited to trigger an infinite loop via a specially crafted file. This could be exploited to cause a DoS.(boo#1103200). - CVE-2018-5815: Fixed an integer overflow in the internal/dcraw_common.cpp:parse_qt() function, that could be exploited to cause an infinite loop via a specially crafted Apple QuickTime file. (boo#1103206) - CVE-2018-5810: Fixed an error within the rollei_load_raw() function (internal/dcraw_common.cpp) that could be exploited to cause a heap-based buffer overflow and subsequently cause a crash. (boo#1103353) - CVE-2018-5811: Fixed an error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) that could be exploited to cause an out-of-bounds read memory access and subsequently cause a crash. (boo#1103359) - CVE-2018-5812: Fixed another error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) that could be exploited to trigger a NULL pointer dereference. (boo#1103360) - CVE-2018-5807: Fixed an error within the samsung_load_raw() function (internal/dcraw_common.cpp) that could be exploited to cause an out-of-bounds read memory access and subsequently cause a crash. (boo#1103361) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-849=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-23.1 libraw-devel-0.17.1-23.1 libraw-devel-static-0.17.1-23.1 libraw-tools-0.17.1-23.1 libraw-tools-debuginfo-0.17.1-23.1 libraw15-0.17.1-23.1 libraw15-debuginfo-0.17.1-23.1 References: https://www.suse.com/security/cve/CVE-2018-5807.html https://www.suse.com/security/cve/CVE-2018-5810.html https://www.suse.com/security/cve/CVE-2018-5811.html https://www.suse.com/security/cve/CVE-2018-5812.html https://www.suse.com/security/cve/CVE-2018-5813.html https://www.suse.com/security/cve/CVE-2018-5815.html https://bugzilla.suse.com/1103200 https://bugzilla.suse.com/1103206 https://bugzilla.suse.com/1103353 https://bugzilla.suse.com/1103359 https://bugzilla.suse.com/1103360 https://bugzilla.suse.com/1103361 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2285-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2285-1 Rating: moderate References: #1095611 #1097693 Cross-References: CVE-2018-11646 CVE-2018-4190 CVE-2018-4199 CVE-2018-4218 CVE-2018-4222 CVE-2018-4232 CVE-2018-4233 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.20.3 fixes the following issues: These security issues were fixed: - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch (bsc#1097693). - CVE-2018-4199: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site (bsc#1097693) - CVE-2018-4218: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free (bsc#1097693) - CVE-2018-4222: An unspecified issue allowed remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation (bsc#1097693) - CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite cookies via a crafted web site (bsc#1097693) - CVE-2018-4233: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1097693) - CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL mishandle an unset pageURL, leading to an application crash (bsc#1095611). These non-security issues were fixed: - Disable Gigacage if mmap fails to allocate in Linux. - Add user agent quirk for paypal website. - Fix a network process crash when trying to get cookies of about:blank page. - Fix UI process crash when closing the window under Wayland. - Fix several crashes and rendering issues. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-845=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.20.3-lp150.2.3.1 libjavascriptcoregtk-4_0-18-debuginfo-2.20.3-lp150.2.3.1 libwebkit2gtk-4_0-37-2.20.3-lp150.2.3.1 libwebkit2gtk-4_0-37-debuginfo-2.20.3-lp150.2.3.1 typelib-1_0-JavaScriptCore-4_0-2.20.3-lp150.2.3.1 typelib-1_0-WebKit2-4_0-2.20.3-lp150.2.3.1 typelib-1_0-WebKit2WebExtension-4_0-2.20.3-lp150.2.3.1 webkit-jsc-4-2.20.3-lp150.2.3.1 webkit-jsc-4-debuginfo-2.20.3-lp150.2.3.1 webkit2gtk-4_0-injected-bundles-2.20.3-lp150.2.3.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.20.3-lp150.2.3.1 webkit2gtk3-debugsource-2.20.3-lp150.2.3.1 webkit2gtk3-devel-2.20.3-lp150.2.3.1 webkit2gtk3-plugin-process-gtk2-2.20.3-lp150.2.3.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.20.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.20.3-lp150.2.3.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.20.3-lp150.2.3.1 libwebkit2gtk-4_0-37-32bit-2.20.3-lp150.2.3.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.20.3-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.20.3-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11646.html https://www.suse.com/security/cve/CVE-2018-4190.html https://www.suse.com/security/cve/CVE-2018-4199.html https://www.suse.com/security/cve/CVE-2018-4218.html https://www.suse.com/security/cve/CVE-2018-4222.html https://www.suse.com/security/cve/CVE-2018-4232.html https://www.suse.com/security/cve/CVE-2018-4233.html https://bugzilla.suse.com/1095611 https://bugzilla.suse.com/1097693 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2284-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2284-1 Rating: moderate References: #1099031 Cross-References: CVE-2018-1116 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2018-1116: Fix uid comparison lacking in polkit_backend_interactive_authority_check_authorization (bsc#1099031). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-848=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpolkit0-0.114-lp150.2.3.1 libpolkit0-debuginfo-0.114-lp150.2.3.1 polkit-0.114-lp150.2.3.1 polkit-debuginfo-0.114-lp150.2.3.1 polkit-debugsource-0.114-lp150.2.3.1 polkit-devel-0.114-lp150.2.3.1 polkit-devel-debuginfo-0.114-lp150.2.3.1 typelib-1_0-Polkit-1_0-0.114-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libpolkit0-32bit-0.114-lp150.2.3.1 libpolkit0-32bit-debuginfo-0.114-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): polkit-doc-0.114-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1116.html https://bugzilla.suse.com/1099031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2283-1: important: Security update for ceph
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2283-1 Rating: important References: #1092874 #1094932 #1096748 #1099162 Cross-References: CVE-2018-10861 CVE-2018-1128 CVE-2018-1129 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops (bsc#1099162) - CVE-2018-1129: cephx signature check bypass (bsc#1096748) - CVE-2018-1128: cephx protocol was vulnerable to replay attack (bsc#1096748) Bugs fixed in 12.2.7-420-gc0ef85b854: - luminous: osd: eternal stuck PG in 'unfound_recovery' (bsc#1094932) - bluestore: db.slow used when db is not full (bsc#1092874) - Upstream fixes and improvements, see https://ceph.com/releases/12-2-7-luminous-released/ This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-854=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-base-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-base-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-common-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-common-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-debugsource-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-fuse-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-fuse-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-mds-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-mds-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-mgr-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-mgr-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-mon-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-mon-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-osd-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-osd-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-radosgw-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-radosgw-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-resource-agents-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-test-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-test-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 ceph-test-debugsource-12.2.7+git.1531910353.c0ef85b854-12.1 libcephfs-devel-12.2.7+git.1531910353.c0ef85b854-12.1 libcephfs2-12.2.7+git.1531910353.c0ef85b854-12.1 libcephfs2-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 librados-devel-12.2.7+git.1531910353.c0ef85b854-12.1 librados-devel-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 librados2-12.2.7+git.1531910353.c0ef85b854-12.1 librados2-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 libradosstriper-devel-12.2.7+git.1531910353.c0ef85b854-12.1 libradosstriper1-12.2.7+git.1531910353.c0ef85b854-12.1 libradosstriper1-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 librbd-devel-12.2.7+git.1531910353.c0ef85b854-12.1 librbd1-12.2.7+git.1531910353.c0ef85b854-12.1 librbd1-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 librgw-devel-12.2.7+git.1531910353.c0ef85b854-12.1 librgw2-12.2.7+git.1531910353.c0ef85b854-12.1 librgw2-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python-ceph-compat-12.2.7+git.1531910353.c0ef85b854-12.1 python-cephfs-12.2.7+git.1531910353.c0ef85b854-12.1 python-cephfs-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python-rados-12.2.7+git.1531910353.c0ef85b854-12.1 python-rados-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python-rbd-12.2.7+git.1531910353.c0ef85b854-12.1 python-rbd-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python-rgw-12.2.7+git.1531910353.c0ef85b854-12.1 python-rgw-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python3-ceph-argparse-12.2.7+git.1531910353.c0ef85b854-12.1 python3-cephfs-12.2.7+git.1531910353.c0ef85b854-12.1 python3-cephfs-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python3-rados-12.2.7+git.1531910353.c0ef85b854-12.1 python3-rados-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python3-rbd-12.2.7+git.1531910353.c0ef85b854-12.1 python3-rbd-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 python3-rgw-12.2.7+git.1531910353.c0ef85b854-12.1 python3-rgw-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 rados-objclass-devel-12.2.7+git.1531910353.c0ef85b854-12.1 rbd-fuse-12.2.7+git.1531910353.c0ef85b854-12.1 rbd-fuse-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 rbd-mirror-12.2.7+git.1531910353.c0ef85b854-12.1 rbd-mirror-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 rbd-nbd-12.2.7+git.1531910353.c0ef85b854-12.1 rbd-nbd-debuginfo-12.2.7+git.1531910353.c0ef85b854-12.1 References: https://www.suse.com/security/cve/CVE-2018-10861.html https://www.suse.com/security/cve/CVE-2018-1128.html https://www.suse.com/security/cve/CVE-2018-1129.html https://bugzilla.suse.com/1092874 https://bugzilla.suse.com/1094932 https://bugzilla.suse.com/1096748 https://bugzilla.suse.com/1099162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2265-1: moderate: Recommended update for enigmail
by opensuse-security＠opensuse.org 08 Aug '18

08 Aug '18

openSUSE Security Update: Recommended update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2265-1 Rating: moderate References: #1104036 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for enigmail to 2.0.8 fixes the following issues: The enigmail 2.0.8 release addresses a security issue and solves a few regression bugs. * A security issue has been fixed that allows an attacker to prepare a plain, unauthenticated HTML message in a way that it looks like it's signed and/or encrypted (boo#1104036) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-833=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.8-21.1 References: https://bugzilla.suse.com/1104036 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2259-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 08 Aug '18

08 Aug '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2259-1 Rating: moderate References: #1101410 #1101412 #1101654 #1103040 Cross-References: CVE-2018-0360 CVE-2018-0361 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410) - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412) - Buffer over-read in unRAR code due to missing max value checks in table initialization - Libmspack heap buffer over-read in CHM parser (bsc#1103040) - PDF parser bugs The following other changes were made: - Disable YARA support for licensing reasons (bsc#1101654). - Add HTTPS support for clamsubmit - Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-838=1 Package List: - openSUSE Leap 15.0 (x86_64): clamav-0.100.1-lp150.2.3.1 clamav-debuginfo-0.100.1-lp150.2.3.1 clamav-debugsource-0.100.1-lp150.2.3.1 clamav-devel-0.100.1-lp150.2.3.1 libclamav7-0.100.1-lp150.2.3.1 libclamav7-debuginfo-0.100.1-lp150.2.3.1 libclammspack0-0.100.1-lp150.2.3.1 libclammspack0-debuginfo-0.100.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0360.html https://www.suse.com/security/cve/CVE-2018-0361.html https://bugzilla.suse.com/1101410 https://bugzilla.suse.com/1101412 https://bugzilla.suse.com/1101654 https://bugzilla.suse.com/1103040 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2251-1: moderate: Recommended update for enigmail
by opensuse-security＠opensuse.org 08 Aug '18

08 Aug '18

openSUSE Security Update: Recommended update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2251-1 Rating: moderate References: #1104036 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for enigmail to 2.0.8 fixes the following issues: The enigmail 2.0.8 release addresses a security issue and solves a few regression bugs. * A security issue has been fixed that allows an attacker to prepare a plain, unauthenticated HTML message in a way that it looks like it's signed and/or encrypted (boo#1104036) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-833=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-833=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): enigmail-2.0.8-24.1 - openSUSE Leap 15.0 (x86_64): enigmail-2.0.8-lp150.2.15.1 References: https://bugzilla.suse.com/1104036 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2247-1: moderate: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 08 Aug '18

08 Aug '18

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2247-1 Rating: moderate References: #1101645 #1101651 #1101655 #1101656 Cross-References: CVE-2018-2940 CVE-2018-2952 CVE-2018-2972 CVE-2018-2973 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This java-11-openjdk update to version jdk-11+24 fixes the following issues: Security issues fixed: - CVE-2018-2940: Fix unspecified vulnerability in subcomponent Libraries (bsc#1101645). - CVE-2018-2952: Fix unspecified vulnerability in subcomponent Concurrency (bsc#1101651). - CVE-2018-2972: Fix unspecified vulnerability in subcomponent Security (bsc#1101655). - CVE-2018-2973: Fix unspecified vulnerability in subcomponent JSSE (bsc#1101656). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-830=1 Package List: - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-accessibility-debuginfo-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-debuginfo-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-debugsource-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-2940.html https://www.suse.com/security/cve/CVE-2018-2952.html https://www.suse.com/security/cve/CVE-2018-2972.html https://www.suse.com/security/cve/CVE-2018-2973.html https://bugzilla.suse.com/1101645 https://bugzilla.suse.com/1101651 https://bugzilla.suse.com/1101655 https://bugzilla.suse.com/1101656 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0