August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2567-1: important: Security update for libX11
by opensuse-security＠opensuse.org 31 Aug '18

31 Aug '18

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2567-1 Rating: important References: #1102062 #1102068 #1102073 Cross-References: CVE-2018-14598 CVE-2018-14599 CVE-2018-14600 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libX11 fixes the following issues: Security issues fixed: - CVE-2018-14598: Fixed a crash on invalid reply in XListExtensions (boo#1102073) - CVE-2018-14599: Fixed an off-by-one write in XListExtensions (boo#1102062) - CVE-2018-14600: Fixed an out of boundary write in XListExtensions (boo#1102068) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-945=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libX11-6-1.6.3-10.3.1 libX11-6-debuginfo-1.6.3-10.3.1 libX11-debugsource-1.6.3-10.3.1 libX11-devel-1.6.3-10.3.1 libX11-xcb1-1.6.3-10.3.1 libX11-xcb1-debuginfo-1.6.3-10.3.1 - openSUSE Leap 42.3 (noarch): libX11-data-1.6.3-10.3.1 - openSUSE Leap 42.3 (x86_64): libX11-6-32bit-1.6.3-10.3.1 libX11-6-debuginfo-32bit-1.6.3-10.3.1 libX11-devel-32bit-1.6.3-10.3.1 libX11-xcb1-32bit-1.6.3-10.3.1 libX11-xcb1-debuginfo-32bit-1.6.3-10.3.1 References: https://www.suse.com/security/cve/CVE-2018-14598.html https://www.suse.com/security/cve/CVE-2018-14599.html https://www.suse.com/security/cve/CVE-2018-14600.html https://bugzilla.suse.com/1102062 https://bugzilla.suse.com/1102068 https://bugzilla.suse.com/1102073 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2533-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 28 Aug '18

28 Aug '18

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2533-1 Rating: moderate References: #1050305 #1088262 #1091606 #1091772 #1092699 #1094359 #1096673 Cross-References: CVE-2018-10583 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for libreoffice to 6.0.5.2 fixes the following issues: Security issues fixed: - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606) Non security issues fixed: - Bugfix: Table borders appear black in LibreOffice (while white in PowerPoint) (bsc#1088262) - Bugfix: LibreOffice extension 'Language Tool' fails after Tumbleweed update (bsc#1050305) - Bugfix: libreoffice-gnome can no longer be installed in parallel to libreoffice-gtk3 as there is a potential file conflict (bsc#1096673) - Bugfix: LibreOffice Writer: Text in boxes were not visible (bsc#1094359) - Use libreoffice-gtk3 if xfce is present (bsc#1092699) - Various other bug fixes This update was imported fromm the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-942=1 Package List: - openSUSE Leap 15.0 (noarch): libreoffice-branding-upstream-6.0.5.2-lp150.2.3.1 libreoffice-gdb-pretty-printers-6.0.5.2-lp150.2.3.1 libreoffice-glade-6.0.5.2-lp150.2.3.1 libreoffice-icon-themes-6.0.5.2-lp150.2.3.1 libreoffice-l10n-af-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ar-6.0.5.2-lp150.2.3.1 libreoffice-l10n-as-6.0.5.2-lp150.2.3.1 libreoffice-l10n-bg-6.0.5.2-lp150.2.3.1 libreoffice-l10n-bn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-br-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ca-6.0.5.2-lp150.2.3.1 libreoffice-l10n-cs-6.0.5.2-lp150.2.3.1 libreoffice-l10n-cy-6.0.5.2-lp150.2.3.1 libreoffice-l10n-da-6.0.5.2-lp150.2.3.1 libreoffice-l10n-de-6.0.5.2-lp150.2.3.1 libreoffice-l10n-dz-6.0.5.2-lp150.2.3.1 libreoffice-l10n-el-6.0.5.2-lp150.2.3.1 libreoffice-l10n-en-6.0.5.2-lp150.2.3.1 libreoffice-l10n-eo-6.0.5.2-lp150.2.3.1 libreoffice-l10n-es-6.0.5.2-lp150.2.3.1 libreoffice-l10n-et-6.0.5.2-lp150.2.3.1 libreoffice-l10n-eu-6.0.5.2-lp150.2.3.1 libreoffice-l10n-fa-6.0.5.2-lp150.2.3.1 libreoffice-l10n-fi-6.0.5.2-lp150.2.3.1 libreoffice-l10n-fr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ga-6.0.5.2-lp150.2.3.1 libreoffice-l10n-gl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-gu-6.0.5.2-lp150.2.3.1 libreoffice-l10n-he-6.0.5.2-lp150.2.3.1 libreoffice-l10n-hi-6.0.5.2-lp150.2.3.1 libreoffice-l10n-hr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-hu-6.0.5.2-lp150.2.3.1 libreoffice-l10n-it-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ja-6.0.5.2-lp150.2.3.1 libreoffice-l10n-kk-6.0.5.2-lp150.2.3.1 libreoffice-l10n-kn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ko-6.0.5.2-lp150.2.3.1 libreoffice-l10n-lt-6.0.5.2-lp150.2.3.1 libreoffice-l10n-lv-6.0.5.2-lp150.2.3.1 libreoffice-l10n-mai-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ml-6.0.5.2-lp150.2.3.1 libreoffice-l10n-mr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nb-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-nso-6.0.5.2-lp150.2.3.1 libreoffice-l10n-or-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pa-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pt_BR-6.0.5.2-lp150.2.3.1 libreoffice-l10n-pt_PT-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ro-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ru-6.0.5.2-lp150.2.3.1 libreoffice-l10n-si-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sk-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sl-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ss-6.0.5.2-lp150.2.3.1 libreoffice-l10n-st-6.0.5.2-lp150.2.3.1 libreoffice-l10n-sv-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ta-6.0.5.2-lp150.2.3.1 libreoffice-l10n-te-6.0.5.2-lp150.2.3.1 libreoffice-l10n-th-6.0.5.2-lp150.2.3.1 libreoffice-l10n-tn-6.0.5.2-lp150.2.3.1 libreoffice-l10n-tr-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ts-6.0.5.2-lp150.2.3.1 libreoffice-l10n-uk-6.0.5.2-lp150.2.3.1 libreoffice-l10n-ve-6.0.5.2-lp150.2.3.1 libreoffice-l10n-xh-6.0.5.2-lp150.2.3.1 libreoffice-l10n-zh_CN-6.0.5.2-lp150.2.3.1 libreoffice-l10n-zh_TW-6.0.5.2-lp150.2.3.1 libreoffice-l10n-zu-6.0.5.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libreoffice-6.0.5.2-lp150.2.3.1 libreoffice-base-6.0.5.2-lp150.2.3.1 libreoffice-base-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-firebird-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-firebird-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-mysql-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-mysql-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-postgresql-6.0.5.2-lp150.2.3.1 libreoffice-base-drivers-postgresql-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-calc-6.0.5.2-lp150.2.3.1 libreoffice-calc-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-calc-extensions-6.0.5.2-lp150.2.3.1 libreoffice-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-debugsource-6.0.5.2-lp150.2.3.1 libreoffice-draw-6.0.5.2-lp150.2.3.1 libreoffice-draw-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-filters-optional-6.0.5.2-lp150.2.3.1 libreoffice-gnome-6.0.5.2-lp150.2.3.1 libreoffice-gnome-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-gtk2-6.0.5.2-lp150.2.3.1 libreoffice-gtk2-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-gtk3-6.0.5.2-lp150.2.3.1 libreoffice-gtk3-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-impress-6.0.5.2-lp150.2.3.1 libreoffice-impress-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-kde4-6.0.5.2-lp150.2.3.1 libreoffice-kde4-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-mailmerge-6.0.5.2-lp150.2.3.1 libreoffice-math-6.0.5.2-lp150.2.3.1 libreoffice-math-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-officebean-6.0.5.2-lp150.2.3.1 libreoffice-officebean-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-pyuno-6.0.5.2-lp150.2.3.1 libreoffice-pyuno-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-sdk-6.0.5.2-lp150.2.3.1 libreoffice-sdk-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-sdk-doc-6.0.5.2-lp150.2.3.1 libreoffice-writer-6.0.5.2-lp150.2.3.1 libreoffice-writer-debuginfo-6.0.5.2-lp150.2.3.1 libreoffice-writer-extensions-6.0.5.2-lp150.2.3.1 libreofficekit-6.0.5.2-lp150.2.3.1 libreofficekit-devel-6.0.5.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10583.html https://bugzilla.suse.com/1050305 https://bugzilla.suse.com/1088262 https://bugzilla.suse.com/1091606 https://bugzilla.suse.com/1091772 https://bugzilla.suse.com/1092699 https://bugzilla.suse.com/1094359 https://bugzilla.suse.com/1096673 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2532-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 28 Aug '18

28 Aug '18

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2532-1 Rating: moderate References: #1050305 #1088262 #1088263 #1091606 #1091772 #1092699 #1094359 #1095601 #1095639 #1096673 #1098891 Cross-References: CVE-2018-10583 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 10 fixes is now available. Description: This update for libreoffice to 6.0.5.2 fixes the following issues: Security issues fixed: - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606) Non security issues fixed: - Bugfix: Table borders appear black in LibreOffice (while white in PowerPoint) (bsc#1088262) - Bugfix: LibreOffice extension 'Language Tool' fails after Tumbleweed update (bsc#1050305) - Bugfix: libreoffice-gnome can no longer be installed in parallel to libreoffice-gtk3 as there is a potential file conflict (bsc#1096673) - Bugfix: LibreOffice Writer: Text in boxes were not visible (bsc#1094359) - Use libreoffice-gtk3 if xfce is present (bsc#1092699) - Various other bug fixes - Exporting to PPTX results in vertical labels being shown horizontally (bsc#1095639) - Table in PPTX misplaced and partly blue (bsc#1098891) - Labels in chart change (from white and other colors) to black when saving as PPTX (bsc#1088263) - Exporting to PPTX shifts arrow shapes quite a bit bsc#1095601 This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-941=1 Package List: - openSUSE Leap 42.3 (x86_64): libreoffice-6.0.5.2-24.2 libreoffice-base-6.0.5.2-24.2 libreoffice-base-debuginfo-6.0.5.2-24.2 libreoffice-base-drivers-mysql-6.0.5.2-24.2 libreoffice-base-drivers-mysql-debuginfo-6.0.5.2-24.2 libreoffice-base-drivers-postgresql-6.0.5.2-24.2 libreoffice-base-drivers-postgresql-debuginfo-6.0.5.2-24.2 libreoffice-calc-6.0.5.2-24.2 libreoffice-calc-debuginfo-6.0.5.2-24.2 libreoffice-calc-extensions-6.0.5.2-24.2 libreoffice-debuginfo-6.0.5.2-24.2 libreoffice-debugsource-6.0.5.2-24.2 libreoffice-draw-6.0.5.2-24.2 libreoffice-draw-debuginfo-6.0.5.2-24.2 libreoffice-filters-optional-6.0.5.2-24.2 libreoffice-gnome-6.0.5.2-24.2 libreoffice-gnome-debuginfo-6.0.5.2-24.2 libreoffice-gtk2-6.0.5.2-24.2 libreoffice-gtk2-debuginfo-6.0.5.2-24.2 libreoffice-gtk3-6.0.5.2-24.2 libreoffice-gtk3-debuginfo-6.0.5.2-24.2 libreoffice-impress-6.0.5.2-24.2 libreoffice-impress-debuginfo-6.0.5.2-24.2 libreoffice-kde4-6.0.5.2-24.2 libreoffice-kde4-debuginfo-6.0.5.2-24.2 libreoffice-mailmerge-6.0.5.2-24.2 libreoffice-math-6.0.5.2-24.2 libreoffice-math-debuginfo-6.0.5.2-24.2 libreoffice-officebean-6.0.5.2-24.2 libreoffice-officebean-debuginfo-6.0.5.2-24.2 libreoffice-pyuno-6.0.5.2-24.2 libreoffice-pyuno-debuginfo-6.0.5.2-24.2 libreoffice-sdk-6.0.5.2-24.2 libreoffice-sdk-debuginfo-6.0.5.2-24.2 libreoffice-sdk-doc-6.0.5.2-24.2 libreoffice-writer-6.0.5.2-24.2 libreoffice-writer-debuginfo-6.0.5.2-24.2 libreoffice-writer-extensions-6.0.5.2-24.2 libreofficekit-6.0.5.2-24.2 libreofficekit-devel-6.0.5.2-24.2 - openSUSE Leap 42.3 (noarch): libreoffice-branding-upstream-6.0.5.2-24.2 libreoffice-gdb-pretty-printers-6.0.5.2-24.2 libreoffice-glade-6.0.5.2-24.2 libreoffice-icon-themes-6.0.5.2-24.2 libreoffice-l10n-af-6.0.5.2-24.2 libreoffice-l10n-ar-6.0.5.2-24.2 libreoffice-l10n-as-6.0.5.2-24.2 libreoffice-l10n-bg-6.0.5.2-24.2 libreoffice-l10n-bn-6.0.5.2-24.2 libreoffice-l10n-br-6.0.5.2-24.2 libreoffice-l10n-ca-6.0.5.2-24.2 libreoffice-l10n-cs-6.0.5.2-24.2 libreoffice-l10n-cy-6.0.5.2-24.2 libreoffice-l10n-da-6.0.5.2-24.2 libreoffice-l10n-de-6.0.5.2-24.2 libreoffice-l10n-dz-6.0.5.2-24.2 libreoffice-l10n-el-6.0.5.2-24.2 libreoffice-l10n-en-6.0.5.2-24.2 libreoffice-l10n-eo-6.0.5.2-24.2 libreoffice-l10n-es-6.0.5.2-24.2 libreoffice-l10n-et-6.0.5.2-24.2 libreoffice-l10n-eu-6.0.5.2-24.2 libreoffice-l10n-fa-6.0.5.2-24.2 libreoffice-l10n-fi-6.0.5.2-24.2 libreoffice-l10n-fr-6.0.5.2-24.2 libreoffice-l10n-ga-6.0.5.2-24.2 libreoffice-l10n-gl-6.0.5.2-24.2 libreoffice-l10n-gu-6.0.5.2-24.2 libreoffice-l10n-he-6.0.5.2-24.2 libreoffice-l10n-hi-6.0.5.2-24.2 libreoffice-l10n-hr-6.0.5.2-24.2 libreoffice-l10n-hu-6.0.5.2-24.2 libreoffice-l10n-it-6.0.5.2-24.2 libreoffice-l10n-ja-6.0.5.2-24.2 libreoffice-l10n-kk-6.0.5.2-24.2 libreoffice-l10n-kn-6.0.5.2-24.2 libreoffice-l10n-ko-6.0.5.2-24.2 libreoffice-l10n-lt-6.0.5.2-24.2 libreoffice-l10n-lv-6.0.5.2-24.2 libreoffice-l10n-mai-6.0.5.2-24.2 libreoffice-l10n-ml-6.0.5.2-24.2 libreoffice-l10n-mr-6.0.5.2-24.2 libreoffice-l10n-nb-6.0.5.2-24.2 libreoffice-l10n-nl-6.0.5.2-24.2 libreoffice-l10n-nn-6.0.5.2-24.2 libreoffice-l10n-nr-6.0.5.2-24.2 libreoffice-l10n-nso-6.0.5.2-24.2 libreoffice-l10n-or-6.0.5.2-24.2 libreoffice-l10n-pa-6.0.5.2-24.2 libreoffice-l10n-pl-6.0.5.2-24.2 libreoffice-l10n-pt_BR-6.0.5.2-24.2 libreoffice-l10n-pt_PT-6.0.5.2-24.2 libreoffice-l10n-ro-6.0.5.2-24.2 libreoffice-l10n-ru-6.0.5.2-24.2 libreoffice-l10n-si-6.0.5.2-24.2 libreoffice-l10n-sk-6.0.5.2-24.2 libreoffice-l10n-sl-6.0.5.2-24.2 libreoffice-l10n-sr-6.0.5.2-24.2 libreoffice-l10n-ss-6.0.5.2-24.2 libreoffice-l10n-st-6.0.5.2-24.2 libreoffice-l10n-sv-6.0.5.2-24.2 libreoffice-l10n-ta-6.0.5.2-24.2 libreoffice-l10n-te-6.0.5.2-24.2 libreoffice-l10n-th-6.0.5.2-24.2 libreoffice-l10n-tn-6.0.5.2-24.2 libreoffice-l10n-tr-6.0.5.2-24.2 libreoffice-l10n-ts-6.0.5.2-24.2 libreoffice-l10n-uk-6.0.5.2-24.2 libreoffice-l10n-ve-6.0.5.2-24.2 libreoffice-l10n-xh-6.0.5.2-24.2 libreoffice-l10n-zh_CN-6.0.5.2-24.2 libreoffice-l10n-zh_TW-6.0.5.2-24.2 libreoffice-l10n-zu-6.0.5.2-24.2 References: https://www.suse.com/security/cve/CVE-2018-10583.html https://bugzilla.suse.com/1050305 https://bugzilla.suse.com/1088262 https://bugzilla.suse.com/1088263 https://bugzilla.suse.com/1091606 https://bugzilla.suse.com/1091772 https://bugzilla.suse.com/1092699 https://bugzilla.suse.com/1094359 https://bugzilla.suse.com/1095601 https://bugzilla.suse.com/1095639 https://bugzilla.suse.com/1096673 https://bugzilla.suse.com/1098891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2525-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2525-1 Rating: moderate References: #1105726 Cross-References: CVE-2018-15605 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.3 addresses multiple issues. Security issues fixed: - CVE-2018-15605: vulnerability in the file import feature allowed cross-site scripting via importing a specially-crafted file (PMASA-2018-5, boo#1105726) This update also contains a number of upstream bug fixes in the UI and behavior. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-939=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-939=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.8.3-21.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.8.3-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-15605.html https://bugzilla.suse.com/1105726 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2524-1: important: Security update for kbuild, virtualbox
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for kbuild, virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2524-1 Rating: important References: #1039375 #1076372 #1079838 #1093731 #1097248 #1098050 #1101667 Cross-References: CVE-2017-5715 CVE-2018-0739 CVE-2018-2676 CVE-2018-2685 CVE-2018-2686 CVE-2018-2687 CVE-2018-2688 CVE-2018-2689 CVE-2018-2690 CVE-2018-2693 CVE-2018-2694 CVE-2018-2698 CVE-2018-2830 CVE-2018-2831 CVE-2018-2835 CVE-2018-2836 CVE-2018-2837 CVE-2018-2842 CVE-2018-2843 CVE-2018-2844 CVE-2018-2845 CVE-2018-2860 CVE-2018-3005 CVE-2018-3055 CVE-2018-3085 CVE-2018-3086 CVE-2018-3087 CVE-2018-3088 CVE-2018-3089 CVE-2018-3090 CVE-2018-3091 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. Description: This update for kbuild, virtualbox fixes the following issues: kbuild changes: - Update to version 0.1.9998svn3110 - Do not assume glibc glob internals - Support GLIBC glob interface version 2 - Fix build failure (boo#1079838) - Fix build with GCC7 (boo#1039375) - Fix build by disabling vboxvideo_drv.so virtualbox security fixes (boo#1101667, boo#1076372): - CVE-2018-3005 - CVE-2018-3055 - CVE-2018-3085 - CVE-2018-3086 - CVE-2018-3087 - CVE-2018-3088 - CVE-2018-3089 - CVE-2018-3090 - CVE-2018-3091 - CVE-2018-2694 - CVE-2018-2698 - CVE-2018-2685 - CVE-2018-2686 - CVE-2018-2687 - CVE-2018-2688 - CVE-2018-2689 - CVE-2018-2690 - CVE-2018-2676 - CVE-2018-2693 - CVE-2017-5715 virtualbox other changes: - Version bump to 5.2.16 - Use %{?linux_make_arch} when building kernel modules (boo#1098050) - Fixed vboxguestconfig.sh script - Update warning regarding the security hole in USB passthrough. (boo#1097248) - Fixed include for build with Qt 5.11 (boo#1093731) - You can find a detailed list of changes [here](https://www.virtualbox.org/wiki/Changelog#v16) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-938=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kbuild-0.1.9998svn3110-4.3.1 kbuild-debuginfo-0.1.9998svn3110-4.3.1 kbuild-debugsource-0.1.9998svn3110-4.3.1 - openSUSE Leap 42.3 (x86_64): python-virtualbox-5.2.18-56.1 python-virtualbox-debuginfo-5.2.18-56.1 virtualbox-5.2.18-56.1 virtualbox-debuginfo-5.2.18-56.1 virtualbox-debugsource-5.2.18-56.1 virtualbox-devel-5.2.18-56.1 virtualbox-guest-kmp-default-5.2.18_k4.4.143_65-56.1 virtualbox-guest-kmp-default-debuginfo-5.2.18_k4.4.143_65-56.1 virtualbox-guest-tools-5.2.18-56.1 virtualbox-guest-tools-debuginfo-5.2.18-56.1 virtualbox-guest-x11-5.2.18-56.1 virtualbox-guest-x11-debuginfo-5.2.18-56.1 virtualbox-host-kmp-default-5.2.18_k4.4.143_65-56.1 virtualbox-host-kmp-default-debuginfo-5.2.18_k4.4.143_65-56.1 virtualbox-qt-5.2.18-56.1 virtualbox-qt-debuginfo-5.2.18-56.1 virtualbox-vnc-5.2.18-56.1 virtualbox-websrv-5.2.18-56.1 virtualbox-websrv-debuginfo-5.2.18-56.1 - openSUSE Leap 42.3 (noarch): virtualbox-guest-desktop-icons-5.2.18-56.1 virtualbox-guest-source-5.2.18-56.1 virtualbox-host-source-5.2.18-56.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-0739.html https://www.suse.com/security/cve/CVE-2018-2676.html https://www.suse.com/security/cve/CVE-2018-2685.html https://www.suse.com/security/cve/CVE-2018-2686.html https://www.suse.com/security/cve/CVE-2018-2687.html https://www.suse.com/security/cve/CVE-2018-2688.html https://www.suse.com/security/cve/CVE-2018-2689.html https://www.suse.com/security/cve/CVE-2018-2690.html https://www.suse.com/security/cve/CVE-2018-2693.html https://www.suse.com/security/cve/CVE-2018-2694.html https://www.suse.com/security/cve/CVE-2018-2698.html https://www.suse.com/security/cve/CVE-2018-2830.html https://www.suse.com/security/cve/CVE-2018-2831.html https://www.suse.com/security/cve/CVE-2018-2835.html https://www.suse.com/security/cve/CVE-2018-2836.html https://www.suse.com/security/cve/CVE-2018-2837.html https://www.suse.com/security/cve/CVE-2018-2842.html https://www.suse.com/security/cve/CVE-2018-2843.html https://www.suse.com/security/cve/CVE-2018-2844.html https://www.suse.com/security/cve/CVE-2018-2845.html https://www.suse.com/security/cve/CVE-2018-2860.html https://www.suse.com/security/cve/CVE-2018-3005.html https://www.suse.com/security/cve/CVE-2018-3055.html https://www.suse.com/security/cve/CVE-2018-3085.html https://www.suse.com/security/cve/CVE-2018-3086.html https://www.suse.com/security/cve/CVE-2018-3087.html https://www.suse.com/security/cve/CVE-2018-3088.html https://www.suse.com/security/cve/CVE-2018-3089.html https://www.suse.com/security/cve/CVE-2018-3090.html https://www.suse.com/security/cve/CVE-2018-3091.html https://bugzilla.suse.com/1039375 https://bugzilla.suse.com/1076372 https://bugzilla.suse.com/1079838 https://bugzilla.suse.com/1093731 https://bugzilla.suse.com/1097248 https://bugzilla.suse.com/1098050 https://bugzilla.suse.com/1101667 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2523-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2523-1 Rating: moderate References: #1105726 Cross-References: CVE-2018-15605 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.3 addresses multiple issues. Security issues fixed: - CVE-2018-15605: vulnerability in the file import feature allowed cross-site scripting via importing a specially-crafted file (PMASA-2018-5, boo#1105726) This update also contains a number of upstream bug fixes in the UI and behavior. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-939=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.3-29.1 References: https://www.suse.com/security/cve/CVE-2018-15605.html https://bugzilla.suse.com/1105726 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2521-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2521-1 Rating: moderate References: #1105598 Cross-References: CVE-2018-3780 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. (boo#1105598) Other bugs fixed: - Fix highlighting of the upload drop zone - Apply ldapUserFilter on members of group - Make the DELETION of groups match greedy on the groupID - Add parent index to share table - Log full exception in cron instead of only the message - Properly lock the target file on dav upload when not using part files - LDAP backup server should not be queried when auth fails - Fix filenames in sharing integration tests - Lower log level for quota manipulation cases - Let user set avatar in nextcloud if LDAP provides invalid image data - Improved logging of smb connection errors - Allow admin to disable fetching of avatars as well as a specific attribute - Allow to disable encryption - Update message shown when unsharing a file - Fixed English grammatical error on Settings page. - Request a valid property for DAV opendir - Allow updating the token on session regeneration - Prevent lock values from going negative with memcache backend - Correctly handle users with numeric user ids - Correctly parse the subject parameters for link (un)shares of calendars - Fix "parsing" of email-addresses in comments and chat messages - Sanitize parameters in createSessionToken() while logging - Also retry rename operation on InvalidArgumentException - Improve url detection in comments - Only bind to ldap if configuration for the first server is set - Use download manager from PDF.js to download the file - Fix trying to load removed scripts - Only pull for new messages if the session is allowed to be kept alive - Always push object data - Add prioritization for Talk Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-936=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-936=1 Package List: - openSUSE Leap 42.3 (noarch): nextcloud-13.0.5-12.1 - openSUSE Leap 15.0 (noarch): nextcloud-13.0.5-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1105598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2516-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2516-1 Rating: important References: #1105592 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - Disable PS, PS2, PS3 and PDF coders by default, remove gs calls from delegates.mgk (boo#1105592) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-937=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-937=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-99.1 GraphicsMagick-debuginfo-1.3.25-99.1 GraphicsMagick-debugsource-1.3.25-99.1 GraphicsMagick-devel-1.3.25-99.1 libGraphicsMagick++-Q16-12-1.3.25-99.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-99.1 libGraphicsMagick++-devel-1.3.25-99.1 libGraphicsMagick-Q16-3-1.3.25-99.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-99.1 libGraphicsMagick3-config-1.3.25-99.1 libGraphicsMagickWand-Q16-2-1.3.25-99.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-99.1 perl-GraphicsMagick-1.3.25-99.1 perl-GraphicsMagick-debuginfo-1.3.25-99.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.9.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.9.1 GraphicsMagick-debugsource-1.3.29-lp150.3.9.1 GraphicsMagick-devel-1.3.29-lp150.3.9.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.9.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.9.1 libGraphicsMagick++-devel-1.3.29-lp150.3.9.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.9.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.9.1 libGraphicsMagick3-config-1.3.29-lp150.3.9.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.9.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.9.1 perl-GraphicsMagick-1.3.29-lp150.3.9.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.9.1 References: https://bugzilla.suse.com/1105592 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2510-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 26 Aug '18

26 Aug '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2510-1 Rating: moderate References: #1105598 Cross-References: CVE-2018-3780 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. (boo#1105598) Other bugs fixed: - Fix highlighting of the upload drop zone - Apply ldapUserFilter on members of group - Make the DELETION of groups match greedy on the groupID - Add parent index to share table - Log full exception in cron instead of only the message - Properly lock the target file on dav upload when not using part files - LDAP backup server should not be queried when auth fails - Fix filenames in sharing integration tests - Lower log level for quota manipulation cases - Let user set avatar in nextcloud if LDAP provides invalid image data - Improved logging of smb connection errors - Allow admin to disable fetching of avatars as well as a specific attribute - Allow to disable encryption - Update message shown when unsharing a file - Fixed English grammatical error on Settings page. - Request a valid property for DAV opendir - Allow updating the token on session regeneration - Prevent lock values from going negative with memcache backend - Correctly handle users with numeric user ids - Correctly parse the subject parameters for link (un)shares of calendars - Fix "parsing" of email-addresses in comments and chat messages - Sanitize parameters in createSessionToken() while logging - Also retry rename operation on InvalidArgumentException - Improve url detection in comments - Only bind to ldap if configuration for the first server is set - Use download manager from PDF.js to download the file - Fix trying to load removed scripts - Only pull for new messages if the session is allowed to be kept alive - Always push object data - Add prioritization for Talk Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-936=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-13.0.5-5.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1105598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2503-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2503-1 Rating: moderate References: #1094741 #1102003 #1102004 #1102005 #1102007 Cross-References: CVE-2018-14434 CVE-2018-14435 CVE-2018-14436 CVE-2018-14437 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: * CVE-2018-14434: A memory leak for a colormap in WriteMPCImage incoders/mpc.c was fixed. (bsc#1102003) * CVE-2018-14435: A memory leak in DecodeImage in coders/pcd.c was fixed. (bsc#1102007) * CVE-2018-14436: A memory leak in ReadMIFFImage in coders/miff.c was fixed. (bsc#1102005) * CVE-2018-14437: A memory leak in parse8BIM in coders/meta.c was fixed. (bsc#1102004) Bug fix: - bsc#1094741: Fix unexpected result with `convert -compose`. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-925=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.9.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.9.1 ImageMagick-debugsource-7.0.7.34-lp150.2.9.1 ImageMagick-devel-7.0.7.34-lp150.2.9.1 ImageMagick-extra-7.0.7.34-lp150.2.9.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.9.1 libMagick++-devel-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.9.1 perl-PerlMagick-7.0.7.34-lp150.2.9.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.9.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.9.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.9.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.9.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-14434.html https://www.suse.com/security/cve/CVE-2018-14435.html https://www.suse.com/security/cve/CVE-2018-14436.html https://www.suse.com/security/cve/CVE-2018-14437.html https://bugzilla.suse.com/1094741 https://bugzilla.suse.com/1102003 https://bugzilla.suse.com/1102004 https://bugzilla.suse.com/1102005 https://bugzilla.suse.com/1102007 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2502-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2502-1 Rating: important References: #1095219 #1100612 #1100613 #1104641 Cross-References: CVE-2018-10887 CVE-2018-10888 CVE-2018-11235 CVE-2018-15501 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libgit2 to version 0.26.5 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10887: Fixed an integer overflow which in turn leads to an out of bound read, allowing to read the base object, which could be exploited by an attacker to cause denial of service (DoS) (bsc#1100613). - CVE-2018-10888: Fixed an out-of-bound read while reading a binary delta file, which could be exploited by an attacker t ocause a denial of service (DoS) (bsc#1100612). - CVE-2018-11235: Fixed a remote code execution, which could occur with a crafted .gitmodules file (bsc#1095219) - CVE-2018-15501: Prevent out-of-bounds reads when processing smart-protocol "ng" packets (bsc#1104641) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-922=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgit2-26-0.26.6-lp150.2.3.1 libgit2-26-debuginfo-0.26.6-lp150.2.3.1 libgit2-debugsource-0.26.6-lp150.2.3.1 libgit2-devel-0.26.6-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libgit2-26-32bit-0.26.6-lp150.2.3.1 libgit2-26-32bit-debuginfo-0.26.6-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10887.html https://www.suse.com/security/cve/CVE-2018-10888.html https://www.suse.com/security/cve/CVE-2018-11235.html https://www.suse.com/security/cve/CVE-2018-15501.html https://bugzilla.suse.com/1095219 https://bugzilla.suse.com/1100612 https://bugzilla.suse.com/1100613 https://bugzilla.suse.com/1104641 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2488-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2488-1 Rating: moderate References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB - Fixed a regression where django.template.Template crashed if the template_string argument is lazy - Fixed __regex and __iregex lookups with MySQL - Fixed admin check crash when using a query expression in ModelAdmin.ordering - Fixed admin changelist crash when using a query expression without asc() or desc() in the page’s ordering - Fixed a regression that broke custom template filters that use decorators - Fixed detection of custom URL converters in included pattern - Fixed a regression that added an unnecessary subquery to the GROUP BY clause on MySQL when using a RawSQL annotation - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable - Corrected the import paths that inspectdb generates for django.contrib.postgres fields - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-914=1 Package List: - openSUSE Leap 15.0 (noarch): python3-Django-2.0.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2487-1: Security update for libXcursor
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for libXcursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2487-1 Rating: low References: #1103511 Cross-References: CVE-2015-9262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libXcursor fixes the following issues: - CVE-2015-9262: _XcursorThemeInherits allowed remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow (bsc#1103511) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-915=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libXcursor-debugsource-1.1.14-10.6.1 libXcursor-devel-1.1.14-10.6.1 libXcursor1-1.1.14-10.6.1 libXcursor1-debuginfo-1.1.14-10.6.1 - openSUSE Leap 42.3 (x86_64): libXcursor-devel-32bit-1.1.14-10.6.1 libXcursor1-32bit-1.1.14-10.6.1 libXcursor1-debuginfo-32bit-1.1.14-10.6.1 References: https://www.suse.com/security/cve/CVE-2015-9262.html https://bugzilla.suse.com/1103511 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2479-1: important: Security update for ceph
by opensuse-security＠opensuse.org 22 Aug '18

22 Aug '18

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2479-1 Rating: important References: #1051598 #1054061 #1056125 #1056967 #1059458 #1060904 #1061461 #1063014 #1066182 #1066502 #1067088 #1067119 #1067705 #1070357 #1071386 #1074301 #1079076 #1080788 #1081379 #1081600 #1086340 #1087269 #1087493 Cross-References: CVE-2017-16818 CVE-2018-7262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 21 fixes is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379). - CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014). Bug fixes: - bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster. - bsc#1079076: RGW openssl fixes. - bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start. - bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool. - bsc#1087269: allow_ec_overwrites option not in command options list. - bsc#1051598: Fix mountpoint check for systemctl enable --runtime. - bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR. - bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster. - bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs. - bsc#1060904: Loglevel misleading during keystone authentication. - bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs. - bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2. - bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw. - bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy. - bsc#1066182: Container synchronization between two Ceph clusters failed. - bsc#1081600: Crash in civetweb/RGW. - bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client. - bsc#1074301: OSDs keep aborting: SnapMapper failed asserts. - bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled. - bsc#1080788: fsid mismatch when creating additional OSDs. - bsc#1071386: Metadata spill onto block.slow. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-541=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 References: https://www.suse.com/security/cve/CVE-2017-16818.html https://www.suse.com/security/cve/CVE-2018-7262.html https://bugzilla.suse.com/1051598 https://bugzilla.suse.com/1054061 https://bugzilla.suse.com/1056125 https://bugzilla.suse.com/1056967 https://bugzilla.suse.com/1059458 https://bugzilla.suse.com/1060904 https://bugzilla.suse.com/1061461 https://bugzilla.suse.com/1063014 https://bugzilla.suse.com/1066182 https://bugzilla.suse.com/1066502 https://bugzilla.suse.com/1067088 https://bugzilla.suse.com/1067119 https://bugzilla.suse.com/1067705 https://bugzilla.suse.com/1070357 https://bugzilla.suse.com/1071386 https://bugzilla.suse.com/1074301 https://bugzilla.suse.com/1079076 https://bugzilla.suse.com/1080788 https://bugzilla.suse.com/1081379 https://bugzilla.suse.com/1081600 https://bugzilla.suse.com/1086340 https://bugzilla.suse.com/1087269 https://bugzilla.suse.com/1087493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2439-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2439-1 Rating: low References: #1102007 Cross-References: CVE-2018-14435 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: The following security issue was fixed: - CVE-2018-14435: Fixed a memory leak in DecodeImage in coders/pcd.c (boo#1102007) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-906=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-96.2 GraphicsMagick-debuginfo-1.3.25-96.2 GraphicsMagick-debugsource-1.3.25-96.2 GraphicsMagick-devel-1.3.25-96.2 libGraphicsMagick++-Q16-12-1.3.25-96.2 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-96.2 libGraphicsMagick++-devel-1.3.25-96.2 libGraphicsMagick-Q16-3-1.3.25-96.2 libGraphicsMagick-Q16-3-debuginfo-1.3.25-96.2 libGraphicsMagick3-config-1.3.25-96.2 libGraphicsMagickWand-Q16-2-1.3.25-96.2 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-96.2 perl-GraphicsMagick-1.3.25-96.2 perl-GraphicsMagick-debuginfo-1.3.25-96.2 References: https://www.suse.com/security/cve/CVE-2018-14435.html https://bugzilla.suse.com/1102007 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2438-1: moderate: Security update for perl-Archive-Zip
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for perl-Archive-Zip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2438-1 Rating: moderate References: #1099497 Cross-References: CVE-2018-10860 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-Archive-Zip fixes the following security issue: - CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-904=1 Package List: - openSUSE Leap 15.0 (noarch): perl-Archive-Zip-1.60-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10860.html https://bugzilla.suse.com/1099497 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2436-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2436-1 Rating: important References: #1027519 #1091107 #1103276 Cross-References: CVE-2018-3646 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-911=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xen-debugsource-4.10.1_08-lp150.2.9.1 xen-devel-4.10.1_08-lp150.2.9.1 xen-libs-4.10.1_08-lp150.2.9.1 xen-libs-debuginfo-4.10.1_08-lp150.2.9.1 xen-tools-domU-4.10.1_08-lp150.2.9.1 xen-tools-domU-debuginfo-4.10.1_08-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): xen-4.10.1_08-lp150.2.9.1 xen-doc-html-4.10.1_08-lp150.2.9.1 xen-libs-32bit-4.10.1_08-lp150.2.9.1 xen-libs-32bit-debuginfo-4.10.1_08-lp150.2.9.1 xen-tools-4.10.1_08-lp150.2.9.1 xen-tools-debuginfo-4.10.1_08-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1103276 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2434-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2434-1 Rating: important References: #1027519 #1091107 #1103276 Cross-References: CVE-2018-3646 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-910=1 Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.2_10-28.1 xen-debugsource-4.9.2_10-28.1 xen-devel-4.9.2_10-28.1 xen-doc-html-4.9.2_10-28.1 xen-libs-4.9.2_10-28.1 xen-libs-debuginfo-4.9.2_10-28.1 xen-tools-4.9.2_10-28.1 xen-tools-debuginfo-4.9.2_10-28.1 xen-tools-domU-4.9.2_10-28.1 xen-tools-domU-debuginfo-4.9.2_10-28.1 References: https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1103276 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2433-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2433-1 Rating: moderate References: #1101688 #1101689 Cross-References: CVE-2018-1333 CVE-2018-8011 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache2 fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-1333: Fixed a worker exhaustion that could have lead to a denial of service via specially crafted HTTP/2 requests (bsc#1101689). - CVE-2018-8011: Fixed a null pointer dereference in mod_md, which could have lead to a denial of service via specially crafted HTTP requests (bsc#1101688). Note: We are currently not shipping this modules, since it is still considered experimental, but we might start to ship it with future releases. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-907=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.3.1 apache2-debuginfo-2.4.33-lp150.2.3.1 apache2-debugsource-2.4.33-lp150.2.3.1 apache2-devel-2.4.33-lp150.2.3.1 apache2-event-2.4.33-lp150.2.3.1 apache2-event-debuginfo-2.4.33-lp150.2.3.1 apache2-example-pages-2.4.33-lp150.2.3.1 apache2-prefork-2.4.33-lp150.2.3.1 apache2-prefork-debuginfo-2.4.33-lp150.2.3.1 apache2-utils-2.4.33-lp150.2.3.1 apache2-utils-debuginfo-2.4.33-lp150.2.3.1 apache2-worker-2.4.33-lp150.2.3.1 apache2-worker-debuginfo-2.4.33-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1333.html https://www.suse.com/security/cve/CVE-2018-8011.html https://bugzilla.suse.com/1101688 https://bugzilla.suse.com/1101689 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2431-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2431-1 Rating: moderate References: #1099793 Cross-References: CVE-2018-0500 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2018-0500: Fix a SMTP send heap buffer overflow (bsc#1099793). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-908=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.9.1 curl-debuginfo-7.60.0-lp150.2.9.1 curl-debugsource-7.60.0-lp150.2.9.1 curl-mini-7.60.0-lp150.2.9.1 curl-mini-debuginfo-7.60.0-lp150.2.9.1 curl-mini-debugsource-7.60.0-lp150.2.9.1 libcurl-devel-7.60.0-lp150.2.9.1 libcurl-mini-devel-7.60.0-lp150.2.9.1 libcurl4-7.60.0-lp150.2.9.1 libcurl4-debuginfo-7.60.0-lp150.2.9.1 libcurl4-mini-7.60.0-lp150.2.9.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.9.1 libcurl4-32bit-7.60.0-lp150.2.9.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-0500.html https://bugzilla.suse.com/1099793 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2407-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2407-1 Rating: important References: #1065600 #1081917 #1083647 #1086288 #1086314 #1086315 #1086317 #1086327 #1086331 #1086906 #1087081 #1087092 #1089343 #1090888 #1097104 #1097577 #1097808 #1099811 #1099813 #1099844 #1099845 #1099846 #1099849 #1099863 #1099864 #1100132 #1101116 #1101828 #1101832 #1101833 #1101837 #1101839 #1101841 #1101843 #1101844 #1101845 #1101847 #1101852 #1101853 #1101867 #1101872 #1101874 #1101875 #1101882 #1101883 #1101885 #1101887 #1101890 #1101891 #1101893 #1101895 #1101896 #1101900 #1101902 #1101903 #1102340 #1103097 #1103269 #1103277 #1103363 #1103445 #1103886 #1104066 #1104211 #1104319 #1104353 #1104365 #1104427 #1104494 #1104495 #1104708 #1104777 Cross-References: CVE-2018-10853 CVE-2018-10876 CVE-2018-10877 CVE-2018-10878 CVE-2018-10879 CVE-2018-10880 CVE-2018-10881 CVE-2018-10882 CVE-2018-10883 CVE-2018-3620 CVE-2018-3646 CVE-2018-5391 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 60 fixes is now available. Description: The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-10853: A flaw was found in KVM in which certain instructions such as sgdt/sidt call segmented_write_std doesn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic (bnc#1097104). - CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811) - CVE-2018-10877: Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846) - CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813) - CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844) - CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845) - CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864) - CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849) - CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863) - CVE-2018-3620: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis (bnc#1087081). - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bnc#1089343 bnc#1104365). - CVE-2018-5391 aka "FragmentSmack": A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097). The following non-security bugs were fixed: - afs: Fix directory permissions check (bsc#1101828). - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue (bsc#1101867). - be2net: gather debug info and reset adapter (only for Lancer) on a tx-timeout (bsc#1086288). - be2net: Update the driver version to 12.0.0.0 (bsc#1086288 ). - befs_lookup(): use d_splice_alias() (bsc#1101844). - block: Fix transfer when chunk sectors exceeds max (bsc#1101874). - bpf, ppc64: fix unexpected r0=0 exit path inside bpf_xadd (bsc#1083647). - branch-check: fix long->int truncation when profiling branches (bsc#1101116,). - cdrom: do not call check_disk_change() inside cdrom_open() (bsc#1101872). - compiler.h: enable builtin overflow checkers and add fallback code (bsc#1101116,). - cpu/hotplug: Make bringup/teardown of smp threads symmetric (bsc#1089343). - cpu/hotplug: Provide knobs to control SMT (bsc#1089343). - cpu/hotplug: Split do_cpu_down() (bsc#1089343). - delayacct: fix crash in delayacct_blkio_end() after delayacct init failure (bsc#1104066). - dm: add writecache target (bsc#1101116,). - dm writecache: support optional offset for start of device (bsc#1101116,). - dm writecache: use 2-factor allocator arguments (bsc#1101116,). - EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[] (bsc#1103886). - EDAC: Drop duplicated array of strings for memory type names (bsc#1103886). - ext2: fix a block leak (bsc#1101875). - ext4: add more mount time checks of the superblock (bsc#1101900). - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget() (bsc#1101896). - ext4: check for allocation block validity with block group locked (bsc#1104495). - ext4: check superblock mapped prior to committing (bsc#1101902). - ext4: do not update s_last_mounted of a frozen fs (bsc#1101841). - ext4: factor out helper ext4_sample_last_mounted() (bsc#1101841). - ext4: fix check to prevent initializing reserved inodes (bsc#1104319). - ext4: fix false negatives *and* false positives in ext4_check_descriptors() (bsc#1103445). - ext4: fix fencepost error in check for inode count overflow during resize (bsc#1101853). - ext4: fix inline data updates with checksums enabled (bsc#1104494). - ext4: include the illegal physical block in the bad map ext4_error msg (bsc#1101903). - ext4: report delalloc reserve as non-free in statfs for project quota (bsc#1101843). - ext4: update mtime in ext4_punch_hole even if no blocks are released (bsc#1101895). - f2fs: call unlock_new_inode() before d_instantiate() (bsc#1101837). - fix io_destroy()/aio_complete() race (bsc#1101852). - Force log to disk before reading the AGF during a fstrim (bsc#1101893). - fscache: Fix hanging wait on page discarded by writeback (bsc#1101885). - fs: clear writeback errors in inode_init_always (bsc#1101882). - fs: do not scan the inode cache before SB_BORN is set (bsc#1101883). - hns3: fix unused function warning (bsc#1104353). - hns3pf: do not check handle during mqprio offload (bsc#1104353 ). - hns3pf: fix hns3_del_tunnel_port() (bsc#1104353). - hns3pf: Fix some harmless copy and paste bugs (bsc#1104353 ). - hv_netvsc: Fix napi reschedule while receive completion is busy (). - hv/netvsc: Fix NULL dereference at single queue mode fallback (bsc#1104708). - hwmon: (asus_atk0110) Replace deprecated device register call (bsc#1103363). - IB/hns: Annotate iomem pointers correctly (bsc#1104427 ). - IB/hns: Avoid compile test under non 64bit environments (bsc#1104427). - IB/hns: Declare local functions 'static' (bsc#1104427 ). - IB/hns: fix boolreturn.cocci warnings (bsc#1104427). - IB/hns: Fix for checkpatch.pl comment style warnings (bsc#1104427). - IB/hns: fix memory leak on ah on error return path (bsc#1104427 ). - IB/hns: fix returnvar.cocci warnings (bsc#1104427). - IB/hns: fix semicolon.cocci warnings (bsc#1104427). - IB/hns: Fix the bug of polling cq failed for loopback Qps (bsc#1104427). Refresh patches.suse/0001-IB-hns-checking-for-IS_ERR-instead-of-NULL.patch. - IB/hns: Fix the bug with modifying the MAC address without removing the driver (bsc#1104427). - IB/hns: Fix the bug with rdma operation (bsc#1104427 ). - IB/hns: Fix the bug with wild pointer when destroy rc qp (bsc#1104427). - IB/hns: include linux/interrupt.h (bsc#1104427). - IB/hns: Support compile test for hns RoCE driver (bsc#1104427 ). - IB/hns: Use zeroing memory allocator instead of allocator/memset (bsc#1104427). - isofs: fix potential memory leak in mount option parsing (bsc#1101887). - jump_label: Fix concurrent static_key_enable/disable() (bsc#1089343). - jump_label: Provide hotplug context variants (bsc#1089343). - jump_label: Reorder hotplug lock and jump_label_lock (bsc#1089343). - kabi/severities: Allow kABI changes for kvm/x86 (except for kvm_x86_ops) - kabi/severities: ignore qla2xxx as all symbols are internal - kabi/severities: ignore x86_kvm_ops; lttng-modules would have to be adjusted in case they depend on this particular change - kabi/severities: Relax kvm_vcpu_* kABI breakage - media: rc: oops in ir_timer_keyup after device unplug (bsc#1090888). - mm: fix __gup_device_huge vs unmap (bsc#1101839). - net: hns3: Add a check for client instance init state (bsc#1104353). - net: hns3: add a mask initialization for mac_vlan table (bsc#1104353). - net: hns3: Add *Asserting Reset* mailbox message & handling in VF (bsc#1104353). - net: hns3: add Asym Pause support to phy default features (bsc#1104353). - net: hns3: Add dcb netlink interface for the support of DCB feature (bsc#1104353). - net: hns3: Add DCB support when interacting with network stack (bsc#1104353). - net: hns3: Add ethtool interface for vlan filter (bsc#1104353 ). - net: hns3: add ethtool_ops.get_channels support for VF (bsc#1104353). - net: hns3: add ethtool_ops.get_coalesce support to PF (bsc#1104353). - net: hns3: add ethtool_ops.set_coalesce support to PF (bsc#1104353). - net: hns3: add ethtool -p support for fiber port (bsc#1104353 ). - net: hns3: add ethtool related offload command (bsc#1104353 ). - net: hns3: Add Ethtool support to HNS3 driver (bsc#1104353 ). - net: hns3: add existence checking before adding unicast mac address (bsc#1104353). - net: hns3: add existence check when remove old uc mac address (bsc#1104353). - net: hns3: add feature check when feature changed (bsc#1104353 ). - net: hns3: add get_link support to VF (bsc#1104353). - net: hns3: add get/set_coalesce support to VF (bsc#1104353 ). - net: hns3: add handling vlan tag offload in bd (bsc#1104353 ). - net: hns3: Add hclge_dcb module for the support of DCB feature (bsc#1104353). - net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support (bsc#1104353). - net: hns3: Add HNS3 driver to kernel build framework & MAINTAINERS (bsc#1104353). - net: hns3: Add hns3_get_handle macro in hns3 driver (bsc#1104353 ). - net: hns3: Add HNS3 IMP(Integrated Mgmt Proc) Cmd Interface Support (bsc#1104353). - net: hns3: Add HNS3 VF driver to kernel build framework (bsc#1104353). - net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support (bsc#1104353). - net: hns3: Add HNS3 VF IMP(Integrated Management Proc) cmd interface (bsc#1104353). - net: hns3: add int_gl_idx setup for TX and RX queues (bsc#1104353). - net: hns3: add int_gl_idx setup for VF (bsc#1104353 ). - net: hns3: Add mac loopback selftest support in hns3 driver (bsc#1104353). - net: hns3: Add mailbox interrupt handling to PF driver (bsc#1104353). - net: hns3: Add mailbox support to PF driver (bsc#1104353 ). - net: hns3: Add mailbox support to VF driver (bsc#1104353 ). - net: hns3: add manager table initialization for hardware (bsc#1104353). - net: hns3: Add MDIO support to HNS3 Ethernet driver for hip08 SoC (bsc#1104353). - net: hns3: Add missing break in misc_irq_handle (bsc#1104353 ). - net: hns3: Add more packet size statisctics (bsc#1104353 ). - net: hns3: add MTU initialization for hardware (bsc#1104353 ). - net: hns3: add net status led support for fiber port (bsc#1104353). - net: hns3: add nic_client check when initialize roce base information (bsc#1104353). - net: hns3: add querying speed and duplex support to VF (bsc#1104353). - net: hns3: Add repeat address checking for setting mac address (bsc#1104353). - net: hns3: Add reset interface implementation in client (bsc#1104353). - net: hns3: Add reset process in hclge_main (bsc#1104353 ). - net: hns3: Add reset service task for handling reset requests (bsc#1104353). - net: hns3: add result checking for VF when modify unicast mac address (bsc#1104353). - net: hns3: Add some interface for the support of DCB feature (bsc#1104353). - net: hns3: Adds support for led locate command for copper port (bsc#1104353). - net: hns3: Add STRP_TAGP field support for hardware revision 0x21 (bsc#1104353). - net: hns3: Add support for dynamically buffer reallocation (bsc#1104353). - net: hns3: add support for ETHTOOL_GRXFH (bsc#1104353 ). - net: hns3: add support for get_regs (bsc#1104353). - net: hns3: Add support for IFF_ALLMULTI flag (bsc#1104353 ). - net: hns3: Add support for misc interrupt (bsc#1104353 ). - net: hns3: add support for nway_reset (bsc#1104353). - net: hns3: Add support for PFC setting in TM module (bsc#1104353 ). - net: hns3: Add support for port shaper setting in TM module (bsc#1104353). - net: hns3: add support for querying advertised pause frame by ethtool ethx (bsc#1104353). - net: hns3: add support for querying pfc puase packets statistic (bsc#1104353). - net: hns3: add support for set_link_ksettings (bsc#1104353 ). - net: hns3: add support for set_pauseparam (bsc#1104353 ). - net: hns3: add support for set_ringparam (bsc#1104353 ). - net: hns3: add support for set_rxnfc (bsc#1104353). - net: hns3: Add support for tx_accept_tag2 and tx_accept_untag2 config (bsc#1104353). - net: hns3: add support for VF driver inner interface hclgevf_ops.get_tqps_and_rss_info (bsc#1104353). - net: hns3: Add support of hardware rx-vlan-offload to HNS3 VF driver (bsc#1104353). - net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC (bsc#1104353). - net: hns3: Add support of .sriov_configure in HNS3 driver (bsc#1104353). - net: hns3: Add support of the HNAE3 framework (bsc#1104353 ). - net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver (bsc#1104353). - net: hns3: Add support to change MTU in HNS3 hardware (bsc#1104353). - net: hns3: Add support to enable TX/RX promisc mode for H/W rev(0x21) (bsc#1104353). - net: hns3: add support to modify tqps number (bsc#1104353 ). - net: hns3: add support to query tqps number (bsc#1104353 ). - net: hns3: Add support to re-initialize the hclge device (bsc#1104353). - net: hns3: Add support to request VF Reset to PF (bsc#1104353 ). - net: hns3: Add support to reset the enet/ring mgmt layer (bsc#1104353). - net: hns3: add support to update flow control settings after autoneg (bsc#1104353). - net: hns3: Add tc-based TM support for sriov enabled port (bsc#1104353). - net: hns3: Add timeout process in hns3_enet (bsc#1104353 ). - net: hns3: Add VF Reset device state and its handling (bsc#1104353). - net: hns3: Add VF Reset Service Task to support event handling (bsc#1104353). - net: hns3: add vlan offload config command (bsc#1104353 ). - net: hns3: change GL update rate (bsc#1104353). - net: hns3: Change PF to add ring-vect binding & resetQ to mailbox (bsc#1104353). - net: hns3: Change return type of hnae3_register_ae_algo (bsc#1104353). - net: hns3: Change return type of hnae3_register_ae_dev (bsc#1104353). - net: hns3: Change return value in hnae3_register_client (bsc#1104353). - net: hns3: Changes required in PF mailbox to support VF reset (bsc#1104353). - net: hns3: Changes to make enet watchdog timeout func common for PF/VF (bsc#1104353). - net: hns3: Changes to support ARQ(Asynchronous Receive Queue) (bsc#1104353). - net: hns3: change the returned tqp number by ethtool -x (bsc#1104353). - net: hns3: change the time interval of int_gl calculating (bsc#1104353). - net: hns3: change the unit of GL value macro (bsc#1104353 ). - net: hns3: change TM sched mode to TC-based mode when SRIOV enabled (bsc#1104353). - net: hns3: check for NULL function pointer in hns3_nic_set_features (bsc#1104353). - net: hns3: Cleanup for endian issue in hns3 driver (bsc#1104353 ). - net: hns3: Cleanup for non-static function in hns3 driver (bsc#1104353). - net: hns3: Cleanup for ROCE capability flag in ae_dev (bsc#1104353). - net: hns3: Cleanup for shifting true in hns3 driver (bsc#1104353 ). - net: hns3: Cleanup for struct that used to send cmd to firmware (bsc#1104353). - net: hns3: Cleanup indentation for Kconfig in the the hisilicon folder (bsc#1104353). - net: hns3: cleanup mac auto-negotiation state query (bsc#1104353 ). - net: hns3: cleanup mac auto-negotiation state query in hclge_update_speed_duplex (bsc#1104353). - net: hns3: cleanup of return values in hclge_init_client_instance() (bsc#1104353). - net: hns3: Clear TX/RX rings when stopping port & un-initializing client (bsc#1104353). - net: hns3: Consistently using GENMASK in hns3 driver (bsc#1104353). - net: hns3: converting spaces into tabs to avoid checkpatch.pl warning (bsc#1104353). - net: hns3: Disable VFs change rxvlan offload status (bsc#1104353 ). - net: hns3: Disable vf vlan filter when vf vlan table is full (bsc#1104353). - net: hns3: ensure media_type is unitialized (bsc#1104353 ). - net: hns3: export pci table of hclge and hclgevf to userspace (bsc#1104353). - net: hns3: fix a bug about hns3_clean_tx_ring (bsc#1104353 ). - net: hns3: fix a bug for phy supported feature initialization (bsc#1104353). - net: hns3: fix a bug in hclge_uninit_client_instance (bsc#1104353). - net: hns3: fix a bug in hns3_driv_to_eth_caps (bsc#1104353 ). - net: hns3: fix a bug when alloc new buffer (bsc#1104353 ). - net: hns3: fix a bug when getting phy address from NCL_config file (bsc#1104353). - net: hns3: fix a dead loop in hclge_cmd_csq_clean (bsc#1104353 ). - net: hns3: fix a handful of spelling mistakes (bsc#1104353 ). - net: hns3: Fix a loop index error of tqp statistics query (bsc#1104353). - net: hns3: Fix a misuse to devm_free_irq (bsc#1104353 ). - net: hns3: Fix an error handling path in 'hclge_rss_init_hw()' (bsc#1104353). - net: hns3: Fix an error macro definition of HNS3_TQP_STAT (bsc#1104353). - net: hns3: Fix an error of total drop packet statistics (bsc#1104353). - net: hns3: Fix a response data read error of tqp statistics query (bsc#1104353). - net: hns3: fix endian issue when PF get mbx message flag (bsc#1104353). - net: hns3: fix error type definition of return value (bsc#1104353). - net: hns3: Fixes API to fetch ethernet header length with kernel default (bsc#1104353). - net: hns3: Fixes error reported by Kbuild and internal review (bsc#1104353). - net: hns3: Fixes initalization of RoCE handle and makes it conditional (bsc#1104353). - net: hns3: Fixes initialization of phy address from firmware (bsc#1104353). - net: hns3: Fixes kernel panic issue during rmmod hns3 driver (bsc#1104353). - net: hns3: Fixes ring-to-vector map-and-unmap command (bsc#1104353). - net: hns3: Fixes the back pressure setting when sriov is enabled (bsc#1104353). - net: hns3: Fixes the command used to unmap ring from vector (bsc#1104353). - net: hns3: Fixes the default VLAN-id of PF (bsc#1104353 ). - net: hns3: Fixes the error legs in hclge_init_ae_dev function (bsc#1104353). - net: hns3: Fixes the ether address copy with appropriate API (bsc#1104353). - net: hns3: Fixes the initialization of MAC address in hardware (bsc#1104353). - net: hns3: Fixes the init of the VALID BD info in the descriptor (bsc#1104353). - net: hns3: Fixes the missing PCI iounmap for various legs (bsc#1104353). - net: hns3: Fixes the missing u64_stats_fetch_begin_irq in 64-bit stats fetch (bsc#1104353). - net: hns3: Fixes the out of bounds access in hclge_map_tqp (bsc#1104353). - net: hns3: Fixes the premature exit of loop when matching clients (bsc#1104353). - net: hns3: fixes the ring index in hns3_fini_ring (bsc#1104353 ). - net: hns3: Fixes the state to indicate client-type initialization (bsc#1104353). - net: hns3: Fixes the static checker error warning in hns3_get_link_ksettings() (bsc#1104353). - net: hns3: Fixes the static check warning due to missing unsupp L3 proto check (bsc#1104353). - net: hns3: Fixes the wrong IS_ERR check on the returned phydev value (bsc#1104353). - net: hns3: fix for buffer overflow smatch warning (bsc#1104353 ). - net: hns3: fix for changing MTU (bsc#1104353). - net: hns3: fix for cleaning ring problem (bsc#1104353 ). - net: hns3: Fix for CMDQ and Misc. interrupt init order problem (bsc#1104353). - net: hns3: fix for coal configuation lost when setting the channel (bsc#1104353). - net: hns3: fix for coalesce configuration lost during reset (bsc#1104353). - net: hns3: Fix for deadlock problem occurring when unregistering ae_algo (bsc#1104353). - net: hns3: Fix for DEFAULT_DV when dev does not support DCB (bsc#1104353). - net: hns3: Fix for fiber link up problem (bsc#1104353 ). - net: hns3: fix for getting advertised_caps in hns3_get_link_ksettings (bsc#1104353). - net: hns3: fix for getting autoneg in hns3_get_link_ksettings (bsc#1104353). - net: hns3: fix for getting auto-negotiation state in hclge_get_autoneg (bsc#1104353). - net: hns3: fix for getting wrong link mode problem (bsc#1104353 ). - net: hns3: Fix for hclge_reset running repeatly problem (bsc#1104353). - net: hns3: Fix for hns3 module is loaded multiple times problem (bsc#1104353). - net: hns3: fix for ipv6 address loss problem after setting channels (bsc#1104353). - net: hns3: fix for loopback failure when vlan filter is enable (bsc#1104353). - net: hns3: fix for netdev not running problem after calling net_stop and net_open (bsc#1104353). - net: hns3: Fix for netdev not running problem after calling net_stop and net_open (bsc#1104353). - net: hns3: fix for not initializing VF rss_hash_key problem (bsc#1104353). - net: hns3: fix for not returning problem in get_link_ksettings when phy exists (bsc#1104353). - net: hns3: fix for not setting pause parameters (bsc#1104353 ). - net: hns3: Fix for not setting rx private buffer size to zero (bsc#1104353). - net: hns3: Fix for packet loss due wrong filter config in VLAN tbls (bsc#1104353). - net: hns3: fix for pause configuration lost during reset (bsc#1104353). - net: hns3: Fix for PF mailbox receving unknown message (bsc#1104353). - net: hns3: fix for phy_addr error in hclge_mac_mdio_config (bsc#1104353). - net: hns3: Fix for phy not link up problem after resetting (bsc#1104353). - net: hns3: Fix for pri to tc mapping in TM (bsc#1104353 ). - net: hns3: fix for returning wrong value problem in hns3_get_rss_indir_size (bsc#1104353). - net: hns3: fix for returning wrong value problem in hns3_get_rss_key_size (bsc#1104353). - net: hns3: fix for RSS configuration loss problem during reset (bsc#1104353). - net: hns3: Fix for rx priv buf allocation when DCB is not supported (bsc#1104353). - net: hns3: Fix for rx_priv_buf_alloc not setting rx shared buffer (bsc#1104353). - net: hns3: Fix for service_task not running problem after resetting (bsc#1104353). - net: hns3: Fix for setting mac address when resetting (bsc#1104353). - net: hns3: fix for setting MTU (bsc#1104353). - net: hns3: Fix for setting rss_size incorrectly (bsc#1104353 ). - net: hns3: Fix for the null pointer problem occurring when initializing ae_dev failed (bsc#1104353). - net: hns3: fix for the wrong shift problem in hns3_set_txbd_baseinfo (bsc#1104353). - net: hns3: fix for updating fc_mode_last_time (bsc#1104353 ). - net: hns3: fix for use-after-free when setting ring parameter (bsc#1104353). - net: hns3: Fix for VF mailbox cannot receiving PF response (bsc#1104353). - net: hns3: Fix for VF mailbox receiving unknown message (bsc#1104353). - net: hns3: fix for vlan table lost problem when resetting (bsc#1104353). - net: hns3: Fix for vxlan tx checksum bug (bsc#1104353 ). - net: hns3: Fix initialization when cmd is not supported (bsc#1104353). - net: hns3: fix length overflow when CONFIG_ARM64_64K_PAGES (bsc#1104353). - net: hns3: fix null pointer dereference before null check (bsc#1104353). - net: hns3: fix return value error of hclge_get_mac_vlan_cmd_status() (bsc#1104353). - net: hns3: fix rx path skb->truesize reporting bug (bsc#1104353 ). - net: hns3: Fix setting mac address error (bsc#1104353 ). - net: hns3: Fix spelling errors (bsc#1104353). - net: hns3: fix spelling mistake: "capabilty" -> "capability" (bsc#1104353). - net: hns3: fix the bug of hns3_set_txbd_baseinfo (bsc#1104353 ). - net: hns3: fix the bug when map buffer fail (bsc#1104353 ). - net: hns3: fix the bug when reuse command description in hclge_add_mac_vlan_tbl (bsc#1104353). - net: hns3: Fix the missing client list node initialization (bsc#1104353). - net: hns3: fix the ops check in hns3_get_rxnfc (bsc#1104353 ). - net: hns3: fix the queue id for tqp enable&&reset (bsc#1104353 ). - net: hns3: fix the ring count for ETHTOOL_GRXRINGS (bsc#1104353 ). - net: hns3: fix the TX/RX ring.queue_index in hns3_ring_get_cfg (bsc#1104353). - net: hns3: fix the VF queue reset flow error (bsc#1104353 ). - net: hns3: fix to correctly fetch l4 protocol outer header (bsc#1104353). - net: hns3: Fix to support autoneg only for port attached with phy (bsc#1104353). - net: hns3: Fix typo error for feild in hclge_tm (bsc#1104353 ). - net: hns3: free the ring_data structrue when change tqps (bsc#1104353). - net: hns3: get rss_size_max from configuration but not hardcode (bsc#1104353). - net: hns3: get vf count by pci_sriov_get_totalvfs (bsc#1104353 ). - net: hns3: hclge_inform_reset_assert_to_vf() can be static (bsc#1104353). - net: hns3: hns3:fix a bug about statistic counter in reset process (bsc#1104353). - net: hns3: hns3_get_channels() can be static (bsc#1104353 ). - net: hns3: Increase the default depth of bucket for TM shaper (bsc#1104353). - net: hns3: increase the max time for IMP handle command (bsc#1104353). - net: hns3: make local functions static (bsc#1104353 ). - net: hns3: Mask the packet statistics query when NIC is down (bsc#1104353). - net: hns3: Modify the update period of packet statistics (bsc#1104353). - net: hns3: never send command queue message to IMP when reset (bsc#1104353). - net: hns3: Optimize PF CMDQ interrupt switching process (bsc#1104353). - net: hns3: Optimize the PF's process of updating multicast MAC (bsc#1104353). - net: hns3: Optimize the VF's process of updating multicast MAC (bsc#1104353). - net: hns3: reallocate tx/rx buffer after changing mtu (bsc#1104353). - net: hns3: refactor GL update function (bsc#1104353 ). - net: hns3: refactor interrupt coalescing init function (bsc#1104353). - net: hns3: Refactor mac_init function (bsc#1104353). - net: hns3: Refactor of the reset interrupt handling logic (bsc#1104353). - net: hns3: Refactors the requested reset & pending reset handling code (bsc#1104353). - net: hns3: refactor the coalesce related struct (bsc#1104353 ). - net: hns3: refactor the get/put_vector function (bsc#1104353 ). - net: hns3: refactor the hclge_get/set_rss function (bsc#1104353 ). - net: hns3: refactor the hclge_get/set_rss_tuple function (bsc#1104353). - net: hns3: Refactor the initialization of command queue (bsc#1104353). - net: hns3: refactor the loopback related function (bsc#1104353 ). - net: hns3: Refactor the mapping of tqp to vport (bsc#1104353 ). - net: hns3: Refactor the skb receiving and transmitting function (bsc#1104353). - net: hns3: remove a couple of redundant assignments (bsc#1104353 ). - net: hns3: remove add/del_tunnel_udp in hns3_enet module (bsc#1104353). - net: hns3: Remove a useless member of struct hns3_stats (bsc#1104353). - net: hns3: Remove error log when getting pfc stats fails (bsc#1104353). - net: hns3: Remove packet statistics in the range of 8192~12287 (bsc#1104353). - net: hns3: remove redundant memset when alloc buffer (bsc#1104353). - net: hns3: remove redundant semicolon (bsc#1104353). - net: hns3: Remove repeat statistic of rx_errors (bsc#1104353 ). - net: hns3: Removes unnecessary check when clearing TX/RX rings (bsc#1104353). - net: hns3: remove TSO config command from VF driver (bsc#1104353 ). - net: hns3: remove unnecessary pci_set_drvdata() and devm_kfree() (bsc#1104353). - net: hns3: remove unused GL setup function (bsc#1104353 ). - net: hns3: remove unused hclgevf_cfg_func_mta_filter (bsc#1104353). - net: hns3: Remove unused led control code (bsc#1104353 ). - net: hns3: report the function type the same line with hns3_nic_get_stats64 (bsc#1104353). - net: hns3: set the cmdq out_vld bit to 0 after used (bsc#1104353 ). - net: hns3: set the max ring num when alloc netdev (bsc#1104353 ). - net: hns3: Setting for fc_mode and dcb enable flag in TM module (bsc#1104353). - net: hns3: Support for dynamically assigning tx buffer to TC (bsc#1104353). - net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC (bsc#1104353). - net: hns3: unify the pause params setup function (bsc#1104353 ). - net: hns3: Unify the strings display of packet statistics (bsc#1104353). - net: hns3: Updates MSI/MSI-X alloc/free APIs(depricated) to new APIs (bsc#1104353). - net: hns3: Updates RX packet info fetch in case of multi BD (bsc#1104353). - net: hns3: Use enums instead of magic number in hclge_is_special_opcode (bsc#1104353). - net: hns3: VF should get the real rss_size instead of rss_size_max (bsc#1104353). - net: lan78xx: Fix race in tx pending skb size calculation (bsc#1100132). - net: lan78xx: fix rx handling before first packet is send (bsc#1100132). - net: qmi_wwan: add BroadMobi BM806U 2020:2033 (bsc#1087092). - net: qmi_wwan: Add Netgear Aircard 779S (bsc#1090888). - net-usb: add qmi_wwan if on lte modem wistron neweb d18q1 (bsc#1087092). - net: usb: asix: replace mii_nway_restart in resume path (bsc#1100132). - orangefs: report attributes_mask and attributes for statx (bsc#1101832). - orangefs: set i_size on new symlink (bsc#1101845). - overflow.h: Add allocation size calculation helpers (bsc#1101116,). - powerpc/64: Add GENERIC_CPU support for little endian (). - powerpc/fadump: handle crash memory ranges array index overflow (bsc#1103269). - powerpc/fadump: merge adjacent memory ranges to reduce PT_LOAD segements (bsc#1103269). - powerpc/pkeys: Deny read/write/execute by default (bsc#1097577). - powerpc/pkeys: Fix calculation of total pkeys (bsc#1097577). - powerpc/pkeys: Give all threads control of their key permissions (bsc#1097577). - powerpc/pkeys: key allocation/deallocation must not change pkey registers (bsc#1097577). - powerpc/pkeys: make protection key 0 less special (bsc#1097577). - powerpc/pkeys: Preallocate execute-only key (bsc#1097577). - powerpc/pkeys: Save the pkey registers before fork (bsc#1097577). - qed*: Add link change count value to ethtool statistics display (bsc#1086314). - qed: Add qed APIs for PHY module query (bsc#1086314 ). - qed: Add srq core support for RoCE and iWARP (bsc#1086314 ). - qede: Add driver callbacks for eeprom module query (bsc#1086314 ). - qedf: Add get_generic_tlv_data handler (bsc#1086317). - qedf: Add support for populating ethernet TLVs (bsc#1086317). - qed: fix spelling mistake "successffuly" -> "successfully" (bsc#1086314). - qedi: Add get_generic_tlv_data handler (bsc#1086315). - qedi: Add support for populating ethernet TLVs (bsc#1086315). - qed: Make some functions static (bsc#1086314). - qed: remove redundant functions qed_get_cm_pq_idx_rl (bsc#1086314). - qed: remove redundant functions qed_set_gft_event_id_cm_hdr (bsc#1086314). - qed: remove redundant pointer 'name' (bsc#1086314). - qed: use dma_zalloc_coherent instead of allocator/memset (bsc#1086314). - qed*: Utilize FW 8.37.2.0 (bsc#1086314). - rdma/hns: Add 64KB page size support for hip08 (bsc#1104427 ). - rdma/hns: Add command queue support for hip08 RoCE driver (bsc#1104427). - rdma/hns: Add CQ operations support for hip08 RoCE driver (bsc#1104427). - rdma/hns: Add detailed comments for mb() call (bsc#1104427 ). - rdma/hns: Add eq support of hip08 (bsc#1104427). - rdma/hns: Add gsi qp support for modifying qp in hip08 (bsc#1104427). - rdma/hns: Add mailbox's implementation for hip08 RoCE driver (bsc#1104427). - rdma/hns: Add modify CQ support for hip08 (bsc#1104427 ). - rdma/hns: Add names to function arguments in function pointers (bsc#1104427). - rdma/hns: Add profile support for hip08 driver (bsc#1104427 ). - rdma/hns: Add QP operations support for hip08 SoC (bsc#1104427 ). - rdma/hns: Add releasing resource operation in error branch (bsc#1104427). - rdma/hns: Add rereg mr support for hip08 (bsc#1104427 ). - rdma/hns: Add reset process for RoCE in hip08 (bsc#1104427 ). - rdma/hns: Add return operation when configured global param fail (bsc#1104427). - rdma/hns: Add rq inline data support for hip08 RoCE (bsc#1104427 ). - rdma/hns: Add rq inline flags judgement (bsc#1104427 ). - rdma/hns: Add sq_invld_flg field in QP context (bsc#1104427 ). - rdma/hns: Add support for processing send wr and receive wr (bsc#1104427). - rdma/hns: Add the interfaces to support multi hop addressing for the contexts in hip08 (bsc#1104427). - rdma/hns: Adjust the order of cleanup hem table (bsc#1104427 ). - rdma/hns: Assign dest_qp when deregistering mr (bsc#1104427 ). - rdma/hns: Assign the correct value for tx_cqn (bsc#1104427 ). - rdma/hns: Assign zero for pkey_index of wc in hip08 (bsc#1104427 ). - rdma/hns: Avoid NULL pointer exception (bsc#1104427 ). - rdma/hns: Bugfix for cq record db for kernel (bsc#1104427 ). - rdma/hns: Bugfix for init hem table (bsc#1104427). - rdma/hns: Bugfix for rq record db for kernel (bsc#1104427 ). - rdma/hns: Check return value of kzalloc (bsc#1104427 ). - rdma/hns: Configure BT BA and BT attribute for the contexts in hip08 (bsc#1104427). - rdma/hns: Configure fence attribute in hip08 RoCE (bsc#1104427 ). - rdma/hns: Configure mac&gid and user access region for hip08 RoCE driver (bsc#1104427). - rdma/hns: Configure sgid type for hip08 RoCE (bsc#1104427 ). - rdma/hns: Configure the MTPT in hip08 (bsc#1104427). - rdma/hns: Configure TRRL field in hip08 RoCE device (bsc#1104427 ). - rdma/hns: Create gsi qp in hip08 (bsc#1104427). - rdma/hns: Delete the unnecessary initializing enum to zero (bsc#1104427). - rdma/hns: Do not unregister a callback we didn't register (bsc#1104427). - rdma/hns: Drop local zgid in favor of core defined variable (bsc#1104427). - rdma/hns: Enable inner_pa_vld filed of mpt (bsc#1104427 ). - rdma/hns: Enable the cqe field of sqwqe of RC (bsc#1104427 ). - rdma/hns: ensure for-loop actually iterates and free's buffers (bsc#1104427). - rdma/hns: Fill sq wqe context of ud type in hip08 (bsc#1104427 ). - rdma/hns: Filter for zero length of sge in hip08 kernel mode (bsc#1104427). - rdma/hns: Fix a bug with modifying mac address (bsc#1104427 ). - rdma/hns: Fix a couple misspellings (bsc#1104427). - rdma/hns: Fix calltrace for sleeping in atomic (bsc#1104427 ). - rdma/hns: Fix cqn type and init resp (bsc#1104427). - rdma/hns: Fix cq record doorbell enable in kernel (bsc#1104427 ). - rdma/hns: Fix endian problems around imm_data and rkey (bsc#1104427). - rdma/hns: Fix inconsistent warning (bsc#1104427). - rdma/hns: Fix init resp when alloc ucontext (bsc#1104427 ). - rdma/hns: Fix misplaced call to hns_roce_cleanup_hem_table (bsc#1104427). - rdma/hns: Fix QP state judgement before receiving work requests (bsc#1104427). - rdma/hns: Fix QP state judgement before sending work requests (bsc#1104427). - rdma/hns: fix spelling mistake: "Reseved" -> "Reserved" (bsc#1104427). - rdma/hns: Fix the bug with NULL pointer (bsc#1104427 ). - rdma/hns: Fix the bug with rq sge (bsc#1104427). - rdma/hns: Fix the endian problem for hns (bsc#1104427 ). - rdma/hns: Fix the illegal memory operation when cross page (bsc#1104427). - rdma/hns: Fix the issue of IOVA not page continuous in hip08 (bsc#1104427). - rdma/hns: Fix the qp context state diagram (bsc#1104427 ). - rdma/hns: Generate gid type of RoCEv2 (bsc#1104427). - rdma/hns: Get rid of page operation after dma_alloc_coherent (bsc#1104427). - rdma/hns: Get rid of virt_to_page and vmap calls after dma_alloc_coherent (bsc#1104427). - rdma/hns: Implement the disassociate_ucontext API (bsc#1104427 ). - rdma/hns: Increase checking CMQ status timeout value (bsc#1104427). - rdma/hns: Initialize the PCI device for hip08 RoCE (bsc#1104427 ). - rdma/hns: Intercept illegal RDMA operation when use inline data (bsc#1104427). - rdma/hns: Load the RoCE dirver automatically (bsc#1104427 ). - rdma/hns: make various function static, fixes warnings (bsc#1104427). - rdma/hns: Modify assignment device variable to support both PCI device and platform device (bsc#1104427). - rdma/hns: Modify the usage of cmd_sn in hip08 (bsc#1104427 ). - rdma/hns: Modify the value with rd&dest_rd of qp_attr (bsc#1104427). - rdma/hns: Modify uar allocation algorithm to avoid bitmap exhaust (bsc#1104427). - rdma/hns: Move priv in order to add multiple hns_roce support (bsc#1104427). - rdma/hns: Move the location for initializing tmp_len (bsc#1104427). - rdma/hns: Not support qp transition from reset to reset for hip06 (bsc#1104427). - rdma/hns: Only assign dest_qp if IB_QP_DEST_QPN bit is set (bsc#1104427). - rdma/hns: Only assign dqpn if IB_QP_PATH_DEST_QPN bit is set (bsc#1104427). - rdma/hns: Only assign mtu if IB_QP_PATH_MTU bit is set (bsc#1104427). - rdma/hns: Refactor code for readability (bsc#1104427 ). - rdma/hns: Refactor eq code for hip06 (bsc#1104427). - rdma/hns: remove redundant assignment to variable j (bsc#1104427 ). - rdma/hns: Remove some unnecessary attr_mask judgement (bsc#1104427). - rdma/hns: Remove unnecessary operator (bsc#1104427). - rdma/hns: Remove unnecessary platform_get_resource() error check (bsc#1104427). - rdma/hns: Rename the idx field of db (bsc#1104427). - rdma/hns: Replace condition statement using hardware version information (bsc#1104427). - rdma/hns: Replace __raw_write*(cpu_to_le*()) with LE write*() (bsc#1104427). - rdma/hns: return 0 rather than return a garbage status value (bsc#1104427). - rdma/hns_roce: Do not check return value of zap_vma_ptes() (bsc#1104427). - rdma/hns: Set access flags of hip08 RoCE (bsc#1104427 ). - rdma/hns: Set desc_dma_addr for zero when free cmq desc (bsc#1104427). - rdma/hns: Set NULL for __internal_mr (bsc#1104427). - rdma/hns: Set rdma_ah_attr type for querying qp (bsc#1104427 ). - rdma/hns: Set se attribute of sqwqe in hip08 (bsc#1104427 ). - rdma/hns: Set sq_cur_sge_blk_addr field in QPC in hip08 (bsc#1104427). - rdma/hns: Set the guid for hip08 RoCE device (bsc#1104427 ). - rdma/hns: Set the owner field of SQWQE in hip08 RoCE (bsc#1104427). - rdma/hns: Split CQE from MTT in hip08 (bsc#1104427). - rdma/hns: Split hw v1 driver from hns roce driver (bsc#1104427 ). - rdma/hns: Submit bad wr (bsc#1104427). - rdma/hns: Support cq record doorbell for kernel space (bsc#1104427). - rdma/hns: Support cq record doorbell for the user space (bsc#1104427). - rdma/hns: Support multi hop addressing for PBL in hip08 (bsc#1104427). - rdma/hns: Support rq record doorbell for kernel space (bsc#1104427). - rdma/hns: Support rq record doorbell for the user space (bsc#1104427). - rdma/hns: Support WQE/CQE/PBL page size configurable feature in hip08 (bsc#1104427). - rdma/hns: Unify the calculation for hem index in hip08 (bsc#1104427). - rdma/hns: Update assignment method for owner field of send wqe (bsc#1104427). - rdma/hns: Update calculation of irrl_ba field for hip08 (bsc#1104427). - rdma/hns: Update convert function of endian format (bsc#1104427 ). - rdma/hns: Update the interfaces for MTT/CQE multi hop addressing in hip08 (bsc#1104427). - rdma/hns: Update the IRRL table chunk size in hip08 (bsc#1104427 ). - rdma/hns: Update the PD&CQE&MTT specification in hip08 (bsc#1104427). - rdma/hns: Update the usage of ack timeout in hip08 (bsc#1104427 ). - rdma/hns: Update the usage of sr_max and rr_max field (bsc#1104427). - rdma/hns: Update the verbs of polling for completion (bsc#1104427). - rdma/hns: Use free_pages function instead of free_page (bsc#1104427). - rdma/hns: Use structs to describe the uABI instead of opencoding (bsc#1104427). - rdma/qedr: Fix NULL pointer dereference when running over iWARP without RDMA-CM (bsc#1086314). - rdma/qedr: fix spelling mistake: "adrresses" -> "addresses" (bsc#1086314). - rdma/qedr: fix spelling mistake: "failes" -> "fails" (bsc#1086314). - reiserfs: fix buffer overflow with long warning messages (bsc#1101847). - reiserfs-fix-buffer-overflow-with-long-warning-messa.patch: Silence bogus compiler warning about unused result of strscpy(). - s390/dasd: configurable IFCC handling (bsc#1097808). - sched/smt: Update sched_smt_present at runtime (bsc#1089343). - scsi: mpt3sas: Add an I/O barrier (bsc#1086906,). - scsi: mpt3sas: Added support for SAS Device Discovery Error Event (bsc#1086906,). - scsi: mpt3sas: Add PCI device ID for Andromeda (bsc#1086906,). - scsi: mpt3sas: Allow processing of events during driver unload (bsc#1086906,). - scsi: mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5 controllers when HBA supports more than 16 MSI-x vectors (bsc#1086906,). - scsi: mpt3sas: Bug fix for big endian systems (bsc#1086906,). - scsi: mpt3sas: Cache enclosure pages during enclosure add (bsc#1086906,). - scsi: mpt3sas: clarify mmio pointer types (bsc#1086906,). - scsi: mpt3sas: Configure reply post queue depth, DMA and sgl tablesize (bsc#1086906,). - scsi: mpt3sas: Do not abort I/Os issued to NVMe drives while processing Async Broadcast primitive event (bsc#1086906,). - scsi: mpt3sas: Do not access the structure after decrementing it's instance reference count (bsc#1086906,). - scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM (bsc#1086906,). - scsi: mpt3sas: Enhanced handling of Sense Buffer (bsc#1086906,). - scsi: mpt3sas: Fix, False timeout prints for ioctl and other internal commands during controller reset (bsc#1086906,). - scsi: mpt3sas: fix possible memory leak (bsc#1086906,). - scsi: mpt3sas: fix spelling mistake: "disbale" -> "disable" (bsc#1086906,). - scsi: mpt3sas: For NVME device, issue a protocol level reset (bsc#1086906,). - scsi: mpt3sas: Incorrect command status was set/marked as not used (bsc#1086906,). - scsi: mpt3sas: Increase event log buffer to support 24 port HBA's (bsc#1086906,). - scsi: mpt3sas: Introduce API to get BAR0 mapped buffer address (bsc#1086906,). - scsi: mpt3sas: Introduce Base function for cloning (bsc#1086906,). - scsi: mpt3sas: Introduce function to clone mpi reply (bsc#1086906,). - scsi: mpt3sas: Introduce function to clone mpi request (bsc#1086906,). - scsi: mpt3sas: Lockless access for chain buffers (bsc#1086906,). - scsi: mpt3sas: Optimize I/O memory consumption in driver (bsc#1086906,). - scsi: mpt3sas: Pre-allocate RDPQ Array at driver boot time (bsc#1086906,). - scsi: mpt3sas: Replace PCI pool old API (bsc#1081917). - Refresh patches.drivers/scsi-mpt3sas-SGL-to-PRP-Translation-for-I-Os-to-NVMe.patch. - scsi: mpt3sas: Report Firmware Package Version from HBA Driver (bsc#1086906,). - scsi: mpt3sas: Update driver version "25.100.00.00" (bsc#1086906,). - scsi: mpt3sas: Update driver version "26.100.00.00" (bsc#1086906,). - scsi: mpt3sas: Update MPI Headers (bsc#1086906,). - scsi: qedf: Add additional checks when restarting an rport due to ABTS timeout (bsc#1086317). - scsi: qedf: Add check for offload before flushing I/Os for target (bsc#1086317). - scsi: qedf: Add dcbx_not_wait module parameter so we won't wait for DCBX convergence to start discovery (bsc#1086317). - scsi: qedf: Add missing skb frees in error path (bsc#1086317). - scsi: qedf: Add more defensive checks for concurrent error conditions (bsc#1086317). - scsi: qedf: Add task id to kref_get_unless_zero() debug messages when flushing requests (bsc#1086317). - scsi: qedf: Check if link is already up when receiving a link up event from qed (bsc#1086317). - scsi: qedf: fix LTO-enabled build (bsc#1086317). - scsi: qedf: Fix VLAN display when printing sent FIP frames (bsc#1086317). - scsi: qedf: Honor default_prio module parameter even if DCBX does not converge (bsc#1086317). - scsi: qedf: Honor priority from DCBX FCoE App tag (bsc#1086317). - scsi: qedf: If qed fails to enable MSI-X fail PCI probe (bsc#1086317). - scsi: qedf: Improve firmware debug dump handling (bsc#1086317). - scsi: qedf: Increase the number of default FIP VLAN request retries to 60 (bsc#1086317). - scsi: qedf: Release RRQ reference correctly when RRQ command times out (bsc#1086317). - scsi: qedf: remove redundant initialization of 'fcport' (bsc#1086317). - scsi: qedf: Remove setting DCBX pending during soft context reset (bsc#1086317). - scsi: qedf: Return request as DID_NO_CONNECT if MSI-X is not enabled (bsc#1086317). - scsi: qedf: Sanity check FCoE/FIP priority value to make sure it's between 0 and 7 (bsc#1086317). - scsi: qedf: Send the driver state to MFW (bsc#1086317). - scsi: qedf: Set the UNLOADING flag when removing a vport (bsc#1086317). - scsi: qedf: Synchronize rport restarts when multiple ELS commands time out (bsc#1086317). - scsi: qedf: Update copyright for 2018 (bsc#1086317). - scsi: qedf: Update version number to 8.33.16.20 (bsc#1086317). - scsi: qedf: use correct strncpy() size (bsc#1086317). - scsi: qedi: fix building with LTO (bsc#1086315). - scsi: qedi: fix build regression (bsc#1086315). - scsi: qedi: Fix kernel crash during port toggle (bsc#1086315). - scsi: qedi: Send driver state to MFW (bsc#1086315). - scsi: qla2xxx: correctly shift host byte (bsc#1086327,). - scsi: qla2xxx: Correct setting of SAM_STAT_CHECK_CONDITION (bsc#1086327,). - scsi: qla2xxx: Fix crash on qla2x00_mailbox_command (bsc#1086327,). - scsi: qla2xxx: Fix Inquiry command being dropped in Target mode (bsc#1086327,). - scsi: qla2xxx: Fix race condition between iocb timeout and initialisation (bsc#1086327,). - scsi: qla2xxx: Fix Rport and session state getting out of sync (bsc#1086327,). - scsi: qla2xxx: Fix sending ADISC command for login (bsc#1086327,). - scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails (bsc#1086327,). - scsi: qla2xxx: Fix TMF and Multi-Queue config (bsc#1086327,). - scsi: qla2xxx: Move GPSC and GFPNID out of session management (bsc#1086327,). - scsi: qla2xxx: Prevent relogin loop by removing stale code (bsc#1086327,). - scsi: qla2xxx: Reduce redundant ADISC command for RSCNs (bsc#1086327,). - scsi: qla2xxx: remove irq save in qla2x00_poll() (bsc#1086327,). - scsi: qla2xxx: Remove stale debug value for login_retry flag (bsc#1086327,). - scsi: qla2xxx: Update driver version to 10.00.00.07-k (bsc#1086327,). - scsi: qla2xxx: Use predefined get_datalen_for_atio() inline function (bsc#1086327,). - scsi: qla4xxx: Move an array from a .h into a .c file (bsc#1086331). - scsi: qla4xxx: Remove unused symbols (bsc#1086331). - scsi: qla4xxx: skip error recovery in case of register disconnect (bsc#1086331). - scsi: qla4xxx: Use dma_pool_zalloc() (bsc#1086331). - scsi: qla4xxx: Use zeroing allocator rather than allocator/memset (bsc#1086331). - selftests/powerpc: Fix core-pkey for default execute permission change (bsc#1097577). - selftests/powerpc: Fix ptrace-pkey for default execute permission change (bsc#1097577). - supported.conf: add drivers/md/dm-writecache - supported.conf: added hns3 modules - supported.conf: added hns-roce-hw-v1 and hns-roce-hw-v2 - supported.conf: Enable HiSi v3 SAS adapter () - tcp_rbd depends on BLK_DEV_RBD (). - typec: tcpm: fusb302: Resolve out of order messaging events (bsc#1087092). - udf: Detect incorrect directory size (bsc#1101891). - udf: Provide saner default for invalid uid / gid (bsc#1101890). - vfs: add the sb_start_intwrite_trylock() helper (bsc#1101841). - x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343). - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343). - x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343). - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (bsc#1089343). - x86/cpu/AMD: Remove the pointless detect_ht() call (bsc#1089343). - x86/cpu/common: Provide detect_ht_early() (bsc#1089343). - x86/cpu/intel: Evaluate smp_num_siblings early (bsc#1089343). - x86/cpu: Remove the pointless CPU printout (bsc#1089343). - x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343). - x86/KVM/VMX: Add module argument for L1TF mitigation. - x86/smp: Provide topology_is_primary_thread() (bsc#1089343). - x86/topology: Provide topology_smt_supported() (bsc#1089343). - x86/xen: init %gs very early to avoid page faults with stack protector (bnc#1104777). - xen-netback: fix input validation in xenvif_set_hash_mapping() (bnc#1103277). - xen/netfront: do not cache skb_shinfo() (bnc#1065600). - xfs: catch inode allocation state mismatch corruption (bsc#1104211). - xfs: prevent creating negative-sized file via INSERT_RANGE (bsc#1101833). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-886=1 Package List: - openSUSE Leap 15.0 (x86_64): kernel-debug-4.12.14-lp150.12.16.1 kernel-debug-base-4.12.14-lp150.12.16.1 kernel-debug-base-debuginfo-4.12.14-lp150.12.16.1 kernel-debug-debuginfo-4.12.14-lp150.12.16.1 kernel-debug-debugsource-4.12.14-lp150.12.16.1 kernel-debug-devel-4.12.14-lp150.12.16.1 kernel-debug-devel-debuginfo-4.12.14-lp150.12.16.1 kernel-default-4.12.14-lp150.12.16.1 kernel-default-base-4.12.14-lp150.12.16.1 kernel-default-base-debuginfo-4.12.14-lp150.12.16.1 kernel-default-debuginfo-4.12.14-lp150.12.16.1 kernel-default-debugsource-4.12.14-lp150.12.16.1 kernel-default-devel-4.12.14-lp150.12.16.1 kernel-default-devel-debuginfo-4.12.14-lp150.12.16.1 kernel-kvmsmall-4.12.14-lp150.12.16.1 kernel-kvmsmall-base-4.12.14-lp150.12.16.1 kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.16.1 kernel-kvmsmall-debuginfo-4.12.14-lp150.12.16.1 kernel-kvmsmall-debugsource-4.12.14-lp150.12.16.1 kernel-kvmsmall-devel-4.12.14-lp150.12.16.1 kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.16.1 kernel-obs-build-4.12.14-lp150.12.16.1 kernel-obs-build-debugsource-4.12.14-lp150.12.16.1 kernel-obs-qa-4.12.14-lp150.12.16.1 kernel-syms-4.12.14-lp150.12.16.1 kernel-vanilla-4.12.14-lp150.12.16.1 kernel-vanilla-base-4.12.14-lp150.12.16.1 kernel-vanilla-base-debuginfo-4.12.14-lp150.12.16.1 kernel-vanilla-debuginfo-4.12.14-lp150.12.16.1 kernel-vanilla-debugsource-4.12.14-lp150.12.16.1 kernel-vanilla-devel-4.12.14-lp150.12.16.1 kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.16.1 - openSUSE Leap 15.0 (noarch): kernel-devel-4.12.14-lp150.12.16.1 kernel-docs-4.12.14-lp150.12.16.1 kernel-docs-html-4.12.14-lp150.12.16.1 kernel-macros-4.12.14-lp150.12.16.1 kernel-source-4.12.14-lp150.12.16.1 kernel-source-vanilla-4.12.14-lp150.12.16.1 References: https://www.suse.com/security/cve/CVE-2018-10853.html https://www.suse.com/security/cve/CVE-2018-10876.html https://www.suse.com/security/cve/CVE-2018-10877.html https://www.suse.com/security/cve/CVE-2018-10878.html https://www.suse.com/security/cve/CVE-2018-10879.html https://www.suse.com/security/cve/CVE-2018-10880.html https://www.suse.com/security/cve/CVE-2018-10881.html https://www.suse.com/security/cve/CVE-2018-10882.html https://www.suse.com/security/cve/CVE-2018-10883.html https://www.suse.com/security/cve/CVE-2018-3620.html https://www.suse.com/security/cve/CVE-2018-3646.html https://www.suse.com/security/cve/CVE-2018-5391.html https://bugzilla.suse.com/1065600 https://bugzilla.suse.com/1081917 https://bugzilla.suse.com/1083647 https://bugzilla.suse.com/1086288 https://bugzilla.suse.com/1086314 https://bugzilla.suse.com/1086315 https://bugzilla.suse.com/1086317 https://bugzilla.suse.com/1086327 https://bugzilla.suse.com/1086331 https://bugzilla.suse.com/1086906 https://bugzilla.suse.com/1087081 https://bugzilla.suse.com/1087092 https://bugzilla.suse.com/1089343 https://bugzilla.suse.com/1090888 https://bugzilla.suse.com/1097104 https://bugzilla.suse.com/1097577 https://bugzilla.suse.com/1097808 https://bugzilla.suse.com/1099811 https://bugzilla.suse.com/1099813 https://bugzilla.suse.com/1099844 https://bugzilla.suse.com/1099845 https://bugzilla.suse.com/1099846 https://bugzilla.suse.com/1099849 https://bugzilla.suse.com/1099863 https://bugzilla.suse.com/1099864 https://bugzilla.suse.com/1100132 https://bugzilla.suse.com/1101116 https://bugzilla.suse.com/1101828 https://bugzilla.suse.com/1101832 https://bugzilla.suse.com/1101833 https://bugzilla.suse.com/1101837 https://bugzilla.suse.com/1101839 https://bugzilla.suse.com/1101841 https://bugzilla.suse.com/1101843 https://bugzilla.suse.com/1101844 https://bugzilla.suse.com/1101845 https://bugzilla.suse.com/1101847 https://bugzilla.suse.com/1101852 https://bugzilla.suse.com/1101853 https://bugzilla.suse.com/1101867 https://bugzilla.suse.com/1101872 https://bugzilla.suse.com/1101874 https://bugzilla.suse.com/1101875 https://bugzilla.suse.com/1101882 https://bugzilla.suse.com/1101883 https://bugzilla.suse.com/1101885 https://bugzilla.suse.com/1101887 https://bugzilla.suse.com/1101890 https://bugzilla.suse.com/1101891 https://bugzilla.suse.com/1101893 https://bugzilla.suse.com/1101895 https://bugzilla.suse.com/1101896 https://bugzilla.suse.com/1101900 https://bugzilla.suse.com/1101902 https://bugzilla.suse.com/1101903 https://bugzilla.suse.com/1102340 https://bugzilla.suse.com/1103097 https://bugzilla.suse.com/1103269 https://bugzilla.suse.com/1103277 https://bugzilla.suse.com/1103363 https://bugzilla.suse.com/1103445 https://bugzilla.suse.com/1103886 https://bugzilla.suse.com/1104066 https://bugzilla.suse.com/1104211 https://bugzilla.suse.com/1104319 https://bugzilla.suse.com/1104353 https://bugzilla.suse.com/1104365 https://bugzilla.suse.com/1104427 https://bugzilla.suse.com/1104494 https://bugzilla.suse.com/1104495 https://bugzilla.suse.com/1104708 https://bugzilla.suse.com/1104777 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2406-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2406-1 Rating: moderate References: #1082858 #1101410 #1101412 #1101654 #1103040 Cross-References: CVE-2018-0360 CVE-2018-0361 CVE-2018-1000085 CVE-2018-14679 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410) - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412) - CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858) - CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040) - Buffer over-read in unRAR code due to missing max value checks in table initialization - PDF parser bugs The following other changes were made: - Disable YARA support for licensing reasons (bsc#1101654). - Add HTTPS support for clamsubmit - Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-889=1 Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.100.1-29.1 clamav-debuginfo-0.100.1-29.1 clamav-debugsource-0.100.1-29.1 References: https://www.suse.com/security/cve/CVE-2018-0360.html https://www.suse.com/security/cve/CVE-2018-0361.html https://www.suse.com/security/cve/CVE-2018-1000085.html https://www.suse.com/security/cve/CVE-2018-14679.html https://bugzilla.suse.com/1082858 https://bugzilla.suse.com/1101410 https://bugzilla.suse.com/1101412 https://bugzilla.suse.com/1101654 https://bugzilla.suse.com/1103040 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2405-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2405-1 Rating: moderate References: #1103659 #1103661 Cross-References: CVE-2017-9120 CVE-2018-14851 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php7 fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. (bsc#1103659) - CVE-2017-9120: Fixed an buffer overflow in mysqli_real_escape_string, which could be exploited via along string and could result in an application crash or have other unspecified impacts. (bsc#1103661) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-892=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-892=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-43.1 apache2-mod_php7-debuginfo-7.0.7-43.1 php7-7.0.7-43.1 php7-bcmath-7.0.7-43.1 php7-bcmath-debuginfo-7.0.7-43.1 php7-bz2-7.0.7-43.1 php7-bz2-debuginfo-7.0.7-43.1 php7-calendar-7.0.7-43.1 php7-calendar-debuginfo-7.0.7-43.1 php7-ctype-7.0.7-43.1 php7-ctype-debuginfo-7.0.7-43.1 php7-curl-7.0.7-43.1 php7-curl-debuginfo-7.0.7-43.1 php7-dba-7.0.7-43.1 php7-dba-debuginfo-7.0.7-43.1 php7-debuginfo-7.0.7-43.1 php7-debugsource-7.0.7-43.1 php7-devel-7.0.7-43.1 php7-dom-7.0.7-43.1 php7-dom-debuginfo-7.0.7-43.1 php7-enchant-7.0.7-43.1 php7-enchant-debuginfo-7.0.7-43.1 php7-exif-7.0.7-43.1 php7-exif-debuginfo-7.0.7-43.1 php7-fastcgi-7.0.7-43.1 php7-fastcgi-debuginfo-7.0.7-43.1 php7-fileinfo-7.0.7-43.1 php7-fileinfo-debuginfo-7.0.7-43.1 php7-firebird-7.0.7-43.1 php7-firebird-debuginfo-7.0.7-43.1 php7-fpm-7.0.7-43.1 php7-fpm-debuginfo-7.0.7-43.1 php7-ftp-7.0.7-43.1 php7-ftp-debuginfo-7.0.7-43.1 php7-gd-7.0.7-43.1 php7-gd-debuginfo-7.0.7-43.1 php7-gettext-7.0.7-43.1 php7-gettext-debuginfo-7.0.7-43.1 php7-gmp-7.0.7-43.1 php7-gmp-debuginfo-7.0.7-43.1 php7-iconv-7.0.7-43.1 php7-iconv-debuginfo-7.0.7-43.1 php7-imap-7.0.7-43.1 php7-imap-debuginfo-7.0.7-43.1 php7-intl-7.0.7-43.1 php7-intl-debuginfo-7.0.7-43.1 php7-json-7.0.7-43.1 php7-json-debuginfo-7.0.7-43.1 php7-ldap-7.0.7-43.1 php7-ldap-debuginfo-7.0.7-43.1 php7-mbstring-7.0.7-43.1 php7-mbstring-debuginfo-7.0.7-43.1 php7-mcrypt-7.0.7-43.1 php7-mcrypt-debuginfo-7.0.7-43.1 php7-mysql-7.0.7-43.1 php7-mysql-debuginfo-7.0.7-43.1 php7-odbc-7.0.7-43.1 php7-odbc-debuginfo-7.0.7-43.1 php7-opcache-7.0.7-43.1 php7-opcache-debuginfo-7.0.7-43.1 php7-openssl-7.0.7-43.1 php7-openssl-debuginfo-7.0.7-43.1 php7-pcntl-7.0.7-43.1 php7-pcntl-debuginfo-7.0.7-43.1 php7-pdo-7.0.7-43.1 php7-pdo-debuginfo-7.0.7-43.1 php7-pgsql-7.0.7-43.1 php7-pgsql-debuginfo-7.0.7-43.1 php7-phar-7.0.7-43.1 php7-phar-debuginfo-7.0.7-43.1 php7-posix-7.0.7-43.1 php7-posix-debuginfo-7.0.7-43.1 php7-pspell-7.0.7-43.1 php7-pspell-debuginfo-7.0.7-43.1 php7-readline-7.0.7-43.1 php7-readline-debuginfo-7.0.7-43.1 php7-shmop-7.0.7-43.1 php7-shmop-debuginfo-7.0.7-43.1 php7-snmp-7.0.7-43.1 php7-snmp-debuginfo-7.0.7-43.1 php7-soap-7.0.7-43.1 php7-soap-debuginfo-7.0.7-43.1 php7-sockets-7.0.7-43.1 php7-sockets-debuginfo-7.0.7-43.1 php7-sqlite-7.0.7-43.1 php7-sqlite-debuginfo-7.0.7-43.1 php7-sysvmsg-7.0.7-43.1 php7-sysvmsg-debuginfo-7.0.7-43.1 php7-sysvsem-7.0.7-43.1 php7-sysvsem-debuginfo-7.0.7-43.1 php7-sysvshm-7.0.7-43.1 php7-sysvshm-debuginfo-7.0.7-43.1 php7-tidy-7.0.7-43.1 php7-tidy-debuginfo-7.0.7-43.1 php7-tokenizer-7.0.7-43.1 php7-tokenizer-debuginfo-7.0.7-43.1 php7-wddx-7.0.7-43.1 php7-wddx-debuginfo-7.0.7-43.1 php7-xmlreader-7.0.7-43.1 php7-xmlreader-debuginfo-7.0.7-43.1 php7-xmlrpc-7.0.7-43.1 php7-xmlrpc-debuginfo-7.0.7-43.1 php7-xmlwriter-7.0.7-43.1 php7-xmlwriter-debuginfo-7.0.7-43.1 php7-xsl-7.0.7-43.1 php7-xsl-debuginfo-7.0.7-43.1 php7-zip-7.0.7-43.1 php7-zip-debuginfo-7.0.7-43.1 php7-zlib-7.0.7-43.1 php7-zlib-debuginfo-7.0.7-43.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-43.1 php7-pear-Archive_Tar-7.0.7-43.1 - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.9.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.9.1 php7-7.2.5-lp150.2.9.1 php7-bcmath-7.2.5-lp150.2.9.1 php7-bcmath-debuginfo-7.2.5-lp150.2.9.1 php7-bz2-7.2.5-lp150.2.9.1 php7-bz2-debuginfo-7.2.5-lp150.2.9.1 php7-calendar-7.2.5-lp150.2.9.1 php7-calendar-debuginfo-7.2.5-lp150.2.9.1 php7-ctype-7.2.5-lp150.2.9.1 php7-ctype-debuginfo-7.2.5-lp150.2.9.1 php7-curl-7.2.5-lp150.2.9.1 php7-curl-debuginfo-7.2.5-lp150.2.9.1 php7-dba-7.2.5-lp150.2.9.1 php7-dba-debuginfo-7.2.5-lp150.2.9.1 php7-debuginfo-7.2.5-lp150.2.9.1 php7-debugsource-7.2.5-lp150.2.9.1 php7-devel-7.2.5-lp150.2.9.1 php7-dom-7.2.5-lp150.2.9.1 php7-dom-debuginfo-7.2.5-lp150.2.9.1 php7-embed-7.2.5-lp150.2.9.1 php7-embed-debuginfo-7.2.5-lp150.2.9.1 php7-enchant-7.2.5-lp150.2.9.1 php7-enchant-debuginfo-7.2.5-lp150.2.9.1 php7-exif-7.2.5-lp150.2.9.1 php7-exif-debuginfo-7.2.5-lp150.2.9.1 php7-fastcgi-7.2.5-lp150.2.9.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.9.1 php7-fileinfo-7.2.5-lp150.2.9.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.9.1 php7-firebird-7.2.5-lp150.2.9.1 php7-firebird-debuginfo-7.2.5-lp150.2.9.1 php7-fpm-7.2.5-lp150.2.9.1 php7-fpm-debuginfo-7.2.5-lp150.2.9.1 php7-ftp-7.2.5-lp150.2.9.1 php7-ftp-debuginfo-7.2.5-lp150.2.9.1 php7-gd-7.2.5-lp150.2.9.1 php7-gd-debuginfo-7.2.5-lp150.2.9.1 php7-gettext-7.2.5-lp150.2.9.1 php7-gettext-debuginfo-7.2.5-lp150.2.9.1 php7-gmp-7.2.5-lp150.2.9.1 php7-gmp-debuginfo-7.2.5-lp150.2.9.1 php7-iconv-7.2.5-lp150.2.9.1 php7-iconv-debuginfo-7.2.5-lp150.2.9.1 php7-intl-7.2.5-lp150.2.9.1 php7-intl-debuginfo-7.2.5-lp150.2.9.1 php7-json-7.2.5-lp150.2.9.1 php7-json-debuginfo-7.2.5-lp150.2.9.1 php7-ldap-7.2.5-lp150.2.9.1 php7-ldap-debuginfo-7.2.5-lp150.2.9.1 php7-mbstring-7.2.5-lp150.2.9.1 php7-mbstring-debuginfo-7.2.5-lp150.2.9.1 php7-mysql-7.2.5-lp150.2.9.1 php7-mysql-debuginfo-7.2.5-lp150.2.9.1 php7-odbc-7.2.5-lp150.2.9.1 php7-odbc-debuginfo-7.2.5-lp150.2.9.1 php7-opcache-7.2.5-lp150.2.9.1 php7-opcache-debuginfo-7.2.5-lp150.2.9.1 php7-openssl-7.2.5-lp150.2.9.1 php7-openssl-debuginfo-7.2.5-lp150.2.9.1 php7-pcntl-7.2.5-lp150.2.9.1 php7-pcntl-debuginfo-7.2.5-lp150.2.9.1 php7-pdo-7.2.5-lp150.2.9.1 php7-pdo-debuginfo-7.2.5-lp150.2.9.1 php7-pgsql-7.2.5-lp150.2.9.1 php7-pgsql-debuginfo-7.2.5-lp150.2.9.1 php7-phar-7.2.5-lp150.2.9.1 php7-phar-debuginfo-7.2.5-lp150.2.9.1 php7-posix-7.2.5-lp150.2.9.1 php7-posix-debuginfo-7.2.5-lp150.2.9.1 php7-readline-7.2.5-lp150.2.9.1 php7-readline-debuginfo-7.2.5-lp150.2.9.1 php7-shmop-7.2.5-lp150.2.9.1 php7-shmop-debuginfo-7.2.5-lp150.2.9.1 php7-snmp-7.2.5-lp150.2.9.1 php7-snmp-debuginfo-7.2.5-lp150.2.9.1 php7-soap-7.2.5-lp150.2.9.1 php7-soap-debuginfo-7.2.5-lp150.2.9.1 php7-sockets-7.2.5-lp150.2.9.1 php7-sockets-debuginfo-7.2.5-lp150.2.9.1 php7-sodium-7.2.5-lp150.2.9.1 php7-sodium-debuginfo-7.2.5-lp150.2.9.1 php7-sqlite-7.2.5-lp150.2.9.1 php7-sqlite-debuginfo-7.2.5-lp150.2.9.1 php7-sysvmsg-7.2.5-lp150.2.9.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.9.1 php7-sysvsem-7.2.5-lp150.2.9.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.9.1 php7-sysvshm-7.2.5-lp150.2.9.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.9.1 php7-tidy-7.2.5-lp150.2.9.1 php7-tidy-debuginfo-7.2.5-lp150.2.9.1 php7-tokenizer-7.2.5-lp150.2.9.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.9.1 php7-wddx-7.2.5-lp150.2.9.1 php7-wddx-debuginfo-7.2.5-lp150.2.9.1 php7-xmlreader-7.2.5-lp150.2.9.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.9.1 php7-xmlrpc-7.2.5-lp150.2.9.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.9.1 php7-xmlwriter-7.2.5-lp150.2.9.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.9.1 php7-xsl-7.2.5-lp150.2.9.1 php7-xsl-debuginfo-7.2.5-lp150.2.9.1 php7-zip-7.2.5-lp150.2.9.1 php7-zip-debuginfo-7.2.5-lp150.2.9.1 php7-zlib-7.2.5-lp150.2.9.1 php7-zlib-debuginfo-7.2.5-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.9.1 php7-pear-Archive_Tar-7.2.5-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2017-9120.html https://www.suse.com/security/cve/CVE-2018-14851.html https://bugzilla.suse.com/1103659 https://bugzilla.suse.com/1103661 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2404-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2404-1 Rating: important References: #1012382 #1082653 #1082979 #1085042 #1085536 #1086457 #1087081 #1089343 #1090123 #1090435 #1092001 #1094244 #1095643 #1096978 #1097771 #1099811 #1099813 #1099844 #1099845 #1099846 #1099849 #1099858 #1099863 #1099864 #1100132 #1100930 #1101331 #1101658 #1101789 #1101841 #1102188 #1102197 #1102203 #1102205 #1102207 #1102211 #1102214 #1102215 #1102340 #1102394 #1102683 #1102851 #1103097 #1103119 #1103269 #1103445 #1103580 #1103717 #1103745 #1103884 #1104174 #1104319 #1104365 #1104494 #1104495 Cross-References: CVE-2017-18344 CVE-2018-10876 CVE-2018-10877 CVE-2018-10878 CVE-2018-10879 CVE-2018-10880 CVE-2018-10881 CVE-2018-10882 CVE-2018-10883 CVE-2018-14734 CVE-2018-3620 CVE-2018-3646 CVE-2018-5390 CVE-2018-5391 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has 41 fixes is now available. Description: The openSUSE Leap 42.3 kernel was updated to 4.4.143 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580). - CVE-2018-10876: A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811) - CVE-2018-10877: Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846) - CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813) - CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844) - CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845) - CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864) - CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849) - CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863) - CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119). - CVE-2018-3620: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis (bnc#1087081 1089343 ). - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bnc#1089343 1104365). - CVE-2018-5390 aka "SegmentSmack": The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340). - CVE-2018-5391 aka "FragmentSmack": A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097). The following non-security bugs were fixed: - Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978) - ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382). - arm64: do not open code page table entry creation (bsc#1102197). - arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188). - arm64: Make sure permission updates happen for pmd/pud (bsc#1102197). - atm: zatm: Fix potential Spectre v1 (bnc#1012382). - bcm63xx_enet: correct clock usage (bnc#1012382). - bcm63xx_enet: do not write to random DMA channel on BCM6345 (bnc#1012382). - blkcg: simplify statistic accumulation code (bsc#1082979). - block: copy ioprio in __bio_clone_fast() (bsc#1082653). - block/swim: Fix array bounds check (bsc#1082979). - bpf: fix loading of BPF_MAXINSNS sized programs (bsc#1012382). - bpf, x64: fix memleak when not converging after image (bsc#1012382). - btrfs: Do not remove block group still has pinned down bytes (bsc#1086457). - cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag (bsc#1099858). - cachefiles: Fix refcounting bug in backing-file read monitoring (bsc#1099858). - cachefiles: Wait rather than BUG'ing on "Unexpected object collision" (bsc#1099858). - cifs: fix bad/NULL ptr dereferencing in SMB2_sess_setup() (bsc#1090123). - compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled (bnc#1012382). - compiler, clang: properly override 'inline' for clang (bnc#1012382). - compiler, clang: suppress warning for unused static inline functions (bnc#1012382). - compiler-gcc.h: Add __attribute__((gnu_inline)) to all inline declarations (bnc#1012382). - cpu/hotplug: Add sysfs state interface (bsc#1089343). - cpu/hotplug: Provide knobs to control SMT (bsc#1089343). - cpu/hotplug: Split do_cpu_down() (bsc#1089343). - crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak (bnc#1012382). - crypto: crypto4xx - remove bad list_del (bnc#1012382). - dm thin metadata: remove needless work from __commit_transaction (bsc#1082979). - drm/msm: Fix possible null dereference on failure of get_pages() (bsc#1102394). - drm: re-enable error handling (bsc#1103884). - esp6: fix memleak on error path in esp6_input (git-fixes). - ext4: check for allocation block validity with block group locked (bsc#1104495). - ext4: do not update s_last_mounted of a frozen fs (bsc#1101841). - ext4: factor out helper ext4_sample_last_mounted() (bsc#1101841). - ext4: fix check to prevent initializing reserved inodes (bsc#1104319). - ext4: fix false negatives *and* false positives in ext4_check_descriptors() (bsc#1103445). - ext4: fix inline data updates with checksums enabled (bsc#1104494). - fscache: Allow cancelled operations to be enqueued (bsc#1099858). - fscache: Fix reference overput in fscache_attach_object() error handling (bsc#1099858). - genirq: Make force irq threading setup more robust (bsc#1082979). - hid: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter (bnc#1012382). - ib/isert: fix T10-pi check mask setting (bsc#1082979). - ibmasm: do not write out of bounds in read handler (bnc#1012382). - ibmvnic: Fix error recovery on login failure (bsc#1101789). - ibmvnic: Remove code to request error information (bsc#1104174). - ibmvnic: Revise RX/TX queue error messages (bsc#1101331). - ibmvnic: Update firmware error reporting with cause string (bsc#1104174). - iw_cxgb4: correctly enforce the max reg_mr depth (bnc#1012382). - kabi protect includes in include/linux/inet.h (bsc#1095643). - kabi protect net/core/utils.c includes (bsc#1095643). - kABI: protect struct loop_device (kabi). - kABI: reintroduce __static_cpu_has_safe (kabi). - Kbuild: fix # escaping in .cmd files for future Make (bnc#1012382). - keys: DNS: fix parsing multiple options (bnc#1012382). - kvm: arm/arm64: Drop resource size check for GICV window (bsc#1102215). - kvm: arm/arm64: Set dist->spis to NULL after kfree (bsc#1102214). - libata: do not try to pass through NCQ commands to non-NCQ devices (bsc#1082979). - loop: add recursion validation to LOOP_CHANGE_FD (bnc#1012382). - loop: remember whether sysfs_create_group() was done (bnc#1012382). - mmc: dw_mmc: fix card threshold control configuration (bsc#1102203). - mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing (bsc#1097771). - net: cxgb3_main: fix potential Spectre v1 (bnc#1012382). - net: dccp: avoid crash in ccid3_hc_rx_send_feedback() (bnc#1012382). - net: dccp: switch rx_tstamp_last_feedback to monotonic clock (bnc#1012382). - netfilter: ebtables: reject non-bridge targets (bnc#1012382). - netfilter: nf_queue: augment nfqa_cfg_policy (bnc#1012382). - netfilter: x_tables: initialise match/target check parameter struct (bnc#1012382). - net/mlx5: Fix command interface race in polling mode (bnc#1012382). - net/mlx5: Fix incorrect raw command length parsing (bnc#1012382). - net: mvneta: fix the Rx desc DMA address in the Rx path (bsc#1102207). - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL (bnc#1012382). - net: off by one in inet6_pton() (bsc#1095643). - net: phy: marvell: Use strlcpy() for ethtool::get_strings (bsc#1102205). - net_sched: blackhole: tell upper qdisc about dropped packets (bnc#1012382). - net: sungem: fix rx checksum support (bnc#1012382). - net/utils: generic inet_pton_with_scope helper (bsc#1095643). - null_blk: use sector_div instead of do_div (bsc#1082979). - nvme-rdma: Check remotely invalidated rkey matches our expected rkey (bsc#1092001). - nvme-rdma: default MR page size to 4k (bsc#1092001). - nvme-rdma: do not complete requests before a send work request has completed (bsc#1092001). - nvme-rdma: do not suppress send completions (bsc#1092001). - nvme-rdma: Fix command completion race at error recovery (bsc#1090435). - nvme-rdma: make nvme_rdma_[create|destroy]_queue_ib symmetrical (bsc#1092001). - nvme-rdma: use inet_pton_with_scope helper (bsc#1095643). - nvme-rdma: Use mr pool (bsc#1092001). - nvme-rdma: wait for local invalidation before completing a request (bsc#1092001). - ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent (bnc#1012382). - pci: ibmphp: Fix use-before-set in get_max_bus_speed() (bsc#1100132). - perf tools: Move syscall number fallbacks from perf-sys.h to tools/arch/x86/include/asm/ (bnc#1012382). - pm / hibernate: Fix oops at snapshot_write() (bnc#1012382). - powerpc/64: Initialise thread_info for emergency stacks (bsc#1094244, bsc#1100930, bsc#1102683). - powerpc/fadump: handle crash memory ranges array index overflow (bsc#1103269). - powerpc/fadump: merge adjacent memory ranges to reduce PT_LOAD segements (bsc#1103269). - qed: Limit msix vectors in kdump kernel to the minimum required count (bnc#1012382). - r8152: napi hangup fix after disconnect (bnc#1012382). - rdma/ocrdma: Fix an error code in ocrdma_alloc_pd() (bsc#1082979). - rdma/ocrdma: Fix error codes in ocrdma_create_srq() (bsc#1082979). - rdma/ucm: Mark UCM interface as BROKEN (bnc#1012382). - rds: avoid unenecessary cong_update in loop transport (bnc#1012382). - Revert 'block-cancel-workqueue-entries-on-blk_mq_freeze_queue' (bsc#1103717) - Revert "sit: reload iphdr in ipip6_rcv" (bnc#1012382). - Revert "x86/cpufeature: Move some of the scattered feature bits to x86_capability" (kabi). - Revert "x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6" (kabi). - rtlwifi: rtl8821ae: fix firmware is not ready to run (bnc#1012382). - s390/qeth: fix error handling in adapter command callbacks (bnc#1103745, LTC#169699). - sched/smt: Update sched_smt_present at runtime (bsc#1089343). - scsi: qlogicpti: Fix an error handling path in 'qpti_sbus_probe()' (bsc#1082979). - scsi: sg: fix minor memory leak in error path (bsc#1082979). - scsi: target: fix crash with iscsi target and dvd (bsc#1082979). - smsc75xx: Add workaround for gigabit link up hardware errata (bsc#1100132). - smsc95xx: Configure pause time to 0xffff when tx flow control enabled (bsc#1085536). - supported.conf: Do not build KMP for openSUSE kernels The merge of kselftest-kmp was overseen, and bad for openSUSE-42.3 - tcp: fix Fast Open key endianness (bnc#1012382). - tcp: prevent bogus FRTO undos with non-SACK flows (bnc#1012382). - tools build: fix # escaping in .cmd files for future Make (bnc#1012382). - uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() (bnc#1012382). - usb: core: handle hub C_PORT_OVER_CURRENT condition (bsc#1100132). - usb: quirks: add delay quirks for Corsair Strafe (bnc#1012382). - usb: serial: ch341: fix type promotion bug in ch341_control_in() (bnc#1012382). - usb: serial: cp210x: add another USB ID for Qivicon ZigBee stick (bnc#1012382). - usb: serial: keyspan_pda: fix modem-status error handling (bnc#1012382). - usb: serial: mos7840: fix status-register error handling (bnc#1012382). - usb: yurex: fix out-of-bounds uaccess in read handler (bnc#1012382). - vfio: platform: Fix reset module leak in error path (bsc#1102211). - vfs: add the sb_start_intwrite_trylock() helper (bsc#1101841). - vhost_net: validate sock before trying to put its fd (bnc#1012382). - vmw_balloon: fix inflation with batching (bnc#1012382). - x86/alternatives: Add an auxilary section (bnc#1012382). - x86/alternatives: Discard dynamic check after init (bnc#1012382). - x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343). - x86/asm: Add _ASM_ARG* constants for argument registers to <asm/asm.h> (bnc#1012382). - x86/boot: Simplify kernel load address alignment check (bnc#1012382). - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343). - x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343). - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (bsc#1089343). Update config files. - x86/cpu/AMD: Remove the pointless detect_ht() call (bsc#1089343). - x86/cpu/common: Provide detect_ht_early() (bsc#1089343). - x86/cpufeature: Add helper macro for mask check macros (bnc#1012382). - x86/cpufeature: Carve out X86_FEATURE_* (bnc#1012382). - x86/cpufeature: Get rid of the non-asm goto variant (bnc#1012382). - x86/cpufeature: Make sure DISABLED/REQUIRED macros are updated (bnc#1012382). - x86/cpufeature: Move some of the scattered feature bits to x86_capability (bnc#1012382). - x86/cpufeature: Replace the old static_cpu_has() with safe variant (bnc#1012382). - x86/cpufeature: Speed up cpu_feature_enabled() (bnc#1012382). - x86/cpufeature: Update cpufeaure macros (bnc#1012382). - x86/cpu/intel: Evaluate smp_num_siblings early (bsc#1089343). - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (bnc#1012382). - x86/cpu: Provide a config option to disable static_cpu_has (bnc#1012382). - x86/cpu: Remove the pointless CPU printout (bsc#1089343). - x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343). - x86/fpu: Add an XSTATE_OP() macro (bnc#1012382). - x86/fpu: Get rid of xstate_fault() (bnc#1012382). - x86/headers: Do not include asm/processor.h in asm/atomic.h (bnc#1012382). - x86/mm/pkeys: Fix mismerge of protection keys CPUID bits (bnc#1012382). - x86/mm: Simplify p[g4um]d_page() macros (1087081). - x86/smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (bsc#1089343). - x86/smp: Provide topology_is_primary_thread() (bsc#1089343). - x86/topology: Add topology_max_smt_threads() (bsc#1089343). - x86/topology: Provide topology_smt_supported() (bsc#1089343). - x86/vdso: Use static_cpu_has() (bnc#1012382). - xen/grant-table: log the lack of grants (bnc#1085042). - xen-netfront: Fix mismatched rtnl_unlock (bnc#1101658). - xen-netfront: Update features after registering netdev (bnc#1101658). - xhci: xhci-mem: off by one in xhci_stream_id_to_ring() (bnc#1012382). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-885=1 Package List: - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.143-65.1 kernel-debug-base-4.4.143-65.1 kernel-debug-base-debuginfo-4.4.143-65.1 kernel-debug-debuginfo-4.4.143-65.1 kernel-debug-debugsource-4.4.143-65.1 kernel-debug-devel-4.4.143-65.1 kernel-debug-devel-debuginfo-4.4.143-65.1 kernel-default-4.4.143-65.1 kernel-default-base-4.4.143-65.1 kernel-default-base-debuginfo-4.4.143-65.1 kernel-default-debuginfo-4.4.143-65.1 kernel-default-debugsource-4.4.143-65.1 kernel-default-devel-4.4.143-65.1 kernel-obs-build-4.4.143-65.1 kernel-obs-build-debugsource-4.4.143-65.1 kernel-obs-qa-4.4.143-65.1 kernel-syms-4.4.143-65.1 kernel-vanilla-4.4.143-65.1 kernel-vanilla-base-4.4.143-65.1 kernel-vanilla-base-debuginfo-4.4.143-65.1 kernel-vanilla-debuginfo-4.4.143-65.1 kernel-vanilla-debugsource-4.4.143-65.1 kernel-vanilla-devel-4.4.143-65.1 - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.143-65.1 kernel-docs-4.4.143-65.1 kernel-docs-html-4.4.143-65.1 kernel-docs-pdf-4.4.143-65.1 kernel-macros-4.4.143-65.1 kernel-source-4.4.143-65.1 kernel-source-vanilla-4.4.143-65.1 References: https://www.suse.com/security/cve/CVE-2017-18344.html https://www.suse.com/security/cve/CVE-2018-10876.html https://www.suse.com/security/cve/CVE-2018-10877.html https://www.suse.com/security/cve/CVE-2018-10878.html https://www.suse.com/security/cve/CVE-2018-10879.html https://www.suse.com/security/cve/CVE-2018-10880.html https://www.suse.com/security/cve/CVE-2018-10881.html https://www.suse.com/security/cve/CVE-2018-10882.html https://www.suse.com/security/cve/CVE-2018-10883.html https://www.suse.com/security/cve/CVE-2018-14734.html https://www.suse.com/security/cve/CVE-2018-3620.html https://www.suse.com/security/cve/CVE-2018-3646.html https://www.suse.com/security/cve/CVE-2018-5390.html https://www.suse.com/security/cve/CVE-2018-5391.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1082653 https://bugzilla.suse.com/1082979 https://bugzilla.suse.com/1085042 https://bugzilla.suse.com/1085536 https://bugzilla.suse.com/1086457 https://bugzilla.suse.com/1087081 https://bugzilla.suse.com/1089343 https://bugzilla.suse.com/1090123 https://bugzilla.suse.com/1090435 https://bugzilla.suse.com/1092001 https://bugzilla.suse.com/1094244 https://bugzilla.suse.com/1095643 https://bugzilla.suse.com/1096978 https://bugzilla.suse.com/1097771 https://bugzilla.suse.com/1099811 https://bugzilla.suse.com/1099813 https://bugzilla.suse.com/1099844 https://bugzilla.suse.com/1099845 https://bugzilla.suse.com/1099846 https://bugzilla.suse.com/1099849 https://bugzilla.suse.com/1099858 https://bugzilla.suse.com/1099863 https://bugzilla.suse.com/1099864 https://bugzilla.suse.com/1100132 https://bugzilla.suse.com/1100930 https://bugzilla.suse.com/1101331 https://bugzilla.suse.com/1101658 https://bugzilla.suse.com/1101789 https://bugzilla.suse.com/1101841 https://bugzilla.suse.com/1102188 https://bugzilla.suse.com/1102197 https://bugzilla.suse.com/1102203 https://bugzilla.suse.com/1102205 https://bugzilla.suse.com/1102207 https://bugzilla.suse.com/1102211 https://bugzilla.suse.com/1102214 https://bugzilla.suse.com/1102215 https://bugzilla.suse.com/1102340 https://bugzilla.suse.com/1102394 https://bugzilla.suse.com/1102683 https://bugzilla.suse.com/1102851 https://bugzilla.suse.com/1103097 https://bugzilla.suse.com/1103119 https://bugzilla.suse.com/1103269 https://bugzilla.suse.com/1103445 https://bugzilla.suse.com/1103580 https://bugzilla.suse.com/1103717 https://bugzilla.suse.com/1103745 https://bugzilla.suse.com/1103884 https://bugzilla.suse.com/1104174 https://bugzilla.suse.com/1104319 https://bugzilla.suse.com/1104365 https://bugzilla.suse.com/1104494 https://bugzilla.suse.com/1104495 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2402-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2402-1 Rating: moderate References: #1083291 #1087082 #1091695 #1094725 #1094898 #1094913 #1096223 Cross-References: CVE-2018-11806 CVE-2018-3639 CVE-2018-7550 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This update for qemu to version 2.11.2 fixes the following issues: Security issue fixed: - CVE-2018-11806: Fix heap buffer overflow issue that can happen while reassembling fragmented datagrams (bsc#1096223). - CVE-2018-3639: Mitigation functionality for Speculative Store Bypass issue in x86 (bsc#1087082). - CVE-2018-7550: Fix out of bounds read and write memory access, potentially leading to code execution (bsc#1083291) Bug fixes: - bsc#1091695: SEV guest will not lauchh with qemu-system-x86_64 version 2.11.1. - bsc#1094898: qemu-guest-agent service doesn't work in version Leap 15.0. - bsc#1094725: `virsh blockresize` does not work with Xen qdisks. - bsc#1094913: QEMU crashes when starting a guest with more than 7.999TB. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-894=1 Package List: - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0-lp150.7.6.1 qemu-seabios-1.11.0-lp150.7.6.1 qemu-sgabios-8-lp150.7.6.1 qemu-vgabios-1.11.0-lp150.7.6.1 - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.6.1 qemu-arm-2.11.2-lp150.7.6.1 qemu-arm-debuginfo-2.11.2-lp150.7.6.1 qemu-block-curl-2.11.2-lp150.7.6.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.6.1 qemu-block-dmg-2.11.2-lp150.7.6.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.6.1 qemu-block-gluster-2.11.2-lp150.7.6.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.6.1 qemu-block-iscsi-2.11.2-lp150.7.6.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.6.1 qemu-block-rbd-2.11.2-lp150.7.6.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.6.1 qemu-block-ssh-2.11.2-lp150.7.6.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.6.1 qemu-debuginfo-2.11.2-lp150.7.6.1 qemu-debugsource-2.11.2-lp150.7.6.1 qemu-extra-2.11.2-lp150.7.6.1 qemu-extra-debuginfo-2.11.2-lp150.7.6.1 qemu-guest-agent-2.11.2-lp150.7.6.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.6.1 qemu-ksm-2.11.2-lp150.7.6.1 qemu-kvm-2.11.2-lp150.7.6.1 qemu-lang-2.11.2-lp150.7.6.1 qemu-linux-user-2.11.2-lp150.7.6.1 qemu-linux-user-debuginfo-2.11.2-lp150.7.6.1 qemu-linux-user-debugsource-2.11.2-lp150.7.6.1 qemu-ppc-2.11.2-lp150.7.6.1 qemu-ppc-debuginfo-2.11.2-lp150.7.6.1 qemu-s390-2.11.2-lp150.7.6.1 qemu-s390-debuginfo-2.11.2-lp150.7.6.1 qemu-testsuite-2.11.2-lp150.7.6.1 qemu-tools-2.11.2-lp150.7.6.1 qemu-tools-debuginfo-2.11.2-lp150.7.6.1 qemu-x86-2.11.2-lp150.7.6.1 qemu-x86-debuginfo-2.11.2-lp150.7.6.1 References: https://www.suse.com/security/cve/CVE-2018-11806.html https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2018-7550.html https://bugzilla.suse.com/1083291 https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1091695 https://bugzilla.suse.com/1094725 https://bugzilla.suse.com/1094898 https://bugzilla.suse.com/1094913 https://bugzilla.suse.com/1096223 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2400-1: important: Security update for samba
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2400-1 Rating: important References: #1095048 #1095056 #1095057 #1103411 #1103414 Cross-References: CVE-2018-10858 CVE-2018-10918 CVE-2018-10919 CVE-2018-1139 CVE-2018-1140 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for samba fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't allow it; (bsc#1095048) - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes; (bsc#1095056) - CVE-2018-10919: Confidential attribute disclosure via substring search; (bsc#1095057) - CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow; (bsc#1103411) - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames on a user without a SPN; (bsc#1103414) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-891=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ctdb-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 ctdb-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 ctdb-pcp-pmda-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 ctdb-pcp-pmda-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 ctdb-tests-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 ctdb-tests-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-binding0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-binding0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-samr-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-samr0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-samr0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-krb5pac-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-krb5pac0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-krb5pac0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-nbt-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-nbt0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-nbt0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-standard-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-standard0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-standard0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libnetapi-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libnetapi0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libnetapi0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-credentials-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-credentials0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-credentials0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-errors-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-errors0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-errors0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-hostconfig-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-hostconfig0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-hostconfig0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-passdb-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-passdb0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-passdb0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-policy-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-policy0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-policy0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-util-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-util0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-util0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamdb-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamdb0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamdb0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbclient-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbclient0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbclient0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbconf-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbconf0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbconf0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbldap-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbldap2-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbldap2-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libtevent-util-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libtevent-util0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libtevent-util0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libwbclient-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libwbclient0-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libwbclient0-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-client-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-client-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-core-devel-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-debugsource-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-dsdb-modules-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-dsdb-modules-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-kdc-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-kdc-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-libs-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-libs-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-pidl-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-python-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-python-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-test-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-test-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-winbind-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-winbind-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libdcerpc-binding0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-binding0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-samr0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc-samr0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libdcerpc0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-krb5pac0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-krb5pac0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-nbt0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-nbt0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-standard0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr-standard0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libndr0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libnetapi0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libnetapi0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-credentials0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-credentials0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-errors0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-errors0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-hostconfig0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-hostconfig0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-passdb0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-passdb0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-policy0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-policy0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-util0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamba-util0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamdb0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsamdb0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbclient0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbclient0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbconf0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbconf0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbldap2-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libsmbldap2-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libtevent-util0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libtevent-util0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libwbclient0-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 libwbclient0-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-ceph-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-ceph-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-client-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-client-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-kdc-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-kdc-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-libs-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-libs-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-winbind-32bit-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 samba-winbind-32bit-debuginfo-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): samba-doc-4.7.8+git.86.94b6d10f7dd-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-10858.html https://www.suse.com/security/cve/CVE-2018-10918.html https://www.suse.com/security/cve/CVE-2018-10919.html https://www.suse.com/security/cve/CVE-2018-1139.html https://www.suse.com/security/cve/CVE-2018-1140.html https://bugzilla.suse.com/1095048 https://bugzilla.suse.com/1095056 https://bugzilla.suse.com/1095057 https://bugzilla.suse.com/1103411 https://bugzilla.suse.com/1103414 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2399-1: important: Security update to ucode-intel
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update to ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2399-1 Rating: important References: #1087082 #1087083 #1089343 #1104134 Cross-References: CVE-2018-3639 CVE-2018-3640 CVE-2018-3646 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: ucode-intel was updated to the 20180807 release. For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and is part of the mitigations for CVE-2018-3639 (Spectre v4) and CVE-2018-3646 (L1 Terminal fault). (bsc#1104134 bsc#1087082 bsc#1087083 bsc#1089343) Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New ---- new platforms ---------------------------------------- WSM-EP/WS U1 6-2c-2/03 0000001f Xeon E/L/X56xx, W36xx NHM-EX D0 6-2e-6/04 0000000d Xeon E/L/X65xx/75xx BXT C0 6-5c-2/01 00000014 Atom T5500/5700 APL E0 6-5c-a/03 0000000c Atom x5-E39xx DVN B0 6-5f-1/01 00000024 Atom C3xxx ---- updated platforms ------------------------------------ NHM-EP/WS D0 6-1a-5/03 00000019->0000001d Xeon E/L/X/W55xx NHM B1 6-1e-5/13 00000007->0000000a Core i7-8xx, i5-7xx; Xeon L3426, X24xx WSM B1 6-25-2/12 0000000e->00000011 Core i7-6xx, i5-6xx/4xxM, i3-5xx/3xxM, Pentium G69xx, Celeon P45xx; Xeon L3406 WSM K0 6-25-5/92 00000004->00000007 Core i7-6xx, i5-6xx/5xx/4xx, i3-5xx/3xx, Pentium G69xx/P6xxx/U5xxx, Celeron P4xxx/U3xxx SNB D2 6-2a-7/12 0000002d->0000002e Core Gen2; Xeon E3 WSM-EX A2 6-2f-2/05 00000037->0000003b Xeon E7 IVB E2 6-3a-9/12 0000001f->00000020 Core Gen3 Mobile HSW-H/S/E3 Cx/Dx 6-3c-3/32 00000024->00000025 Core Gen4 Desktop; Xeon E3 v3 BDW-U/Y E/F 6-3d-4/c0 0000002a->0000002b Core Gen5 Mobile HSW-ULT Cx/Dx 6-45-1/72 00000023->00000024 Core Gen4 Mobile and derived Pentium/Celeron HSW-H Cx 6-46-1/32 00000019->0000001a Core Extreme i7-5xxxX BDW-H/E3 E/G 6-47-1/22 0000001d->0000001e Core i5-5xxxR/C, i7-5xxxHQ/EQ; Xeon E3 v4 SKL-U/Y D0 6-4e-3/c0 000000c2->000000c6 Core Gen6 Mobile BDX-DE V1 6-56-2/10 00000015->00000017 Xeon D-1520/40 BDX-DE V2/3 6-56-3/10 07000012->07000013 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 BDX-DE Y0 6-56-4/10 0f000011->0f000012 Xeon D-1557/59/67/71/77/81/87 APL D0 6-5c-9/03 0000002c->00000032 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx SKL-H/S/E3 R0 6-5e-3/36 000000c2->000000c6 Core Gen6; Xeon E3 v5 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-887=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-887=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ucode-intel-20180807-28.1 ucode-intel-blob-20180807-28.1 ucode-intel-debuginfo-20180807-28.1 ucode-intel-debugsource-20180807-28.1 - openSUSE Leap 15.0 (x86_64): ucode-intel-20180807-lp150.2.7.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2018-3640.html https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1087083 https://bugzilla.suse.com/1089343 https://bugzilla.suse.com/1104134 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2397-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2397-1 Rating: moderate References: #1101689 Cross-References: CVE-2018-1333 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2 fixes the following issues: The following security vulnerability were fixed: - CVE-2018-1333: Fixed a worker exhaustion that could have lead to a denial of service via specially crafted HTTP/2 requests (bsc#1101689). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-893=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-25.1 apache2-debuginfo-2.4.23-25.1 apache2-debugsource-2.4.23-25.1 apache2-devel-2.4.23-25.1 apache2-event-2.4.23-25.1 apache2-event-debuginfo-2.4.23-25.1 apache2-example-pages-2.4.23-25.1 apache2-prefork-2.4.23-25.1 apache2-prefork-debuginfo-2.4.23-25.1 apache2-utils-2.4.23-25.1 apache2-utils-debuginfo-2.4.23-25.1 apache2-worker-2.4.23-25.1 apache2-worker-debuginfo-2.4.23-25.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-25.1 References: https://www.suse.com/security/cve/CVE-2018-1333.html https://bugzilla.suse.com/1101689 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2396-1: important: Security update for samba
by opensuse-security＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2396-1 Rating: important References: #1067700 #1068059 #1087303 #1103411 Cross-References: CVE-2018-10858 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for samba fixes the following issues: The following security vulnerability was fixed: - CVE-2018-10858: Fixed insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); The following other change was made: - s3: winbind: Fix 'winbind normalize names' in wb_getpwsid(); - winbind: honor "winbind use default domain" with empty domain (bsc#1087303) - winbind: do not modify credentials in NTLM passthru (bsc#1068059) - net: fix net ads keytab handling (bsc#1067700) - fix vfs_ceph flock stub This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-890=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ctdb-4.6.14+git.157.c2d53c2b191-18.1 ctdb-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 ctdb-tests-4.6.14+git.157.c2d53c2b191-18.1 ctdb-tests-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-binding0-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-binding0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-devel-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-samr-devel-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-samr0-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-samr0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc0-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libndr-devel-4.6.14+git.157.c2d53c2b191-18.1 libndr-krb5pac-devel-4.6.14+git.157.c2d53c2b191-18.1 libndr-krb5pac0-4.6.14+git.157.c2d53c2b191-18.1 libndr-krb5pac0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libndr-nbt-devel-4.6.14+git.157.c2d53c2b191-18.1 libndr-nbt0-4.6.14+git.157.c2d53c2b191-18.1 libndr-nbt0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libndr-standard-devel-4.6.14+git.157.c2d53c2b191-18.1 libndr-standard0-4.6.14+git.157.c2d53c2b191-18.1 libndr-standard0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libndr0-4.6.14+git.157.c2d53c2b191-18.1 libndr0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libnetapi-devel-4.6.14+git.157.c2d53c2b191-18.1 libnetapi0-4.6.14+git.157.c2d53c2b191-18.1 libnetapi0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamba-credentials-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamba-credentials0-4.6.14+git.157.c2d53c2b191-18.1 libsamba-credentials0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamba-errors-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamba-errors0-4.6.14+git.157.c2d53c2b191-18.1 libsamba-errors0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamba-hostconfig-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamba-hostconfig0-4.6.14+git.157.c2d53c2b191-18.1 libsamba-hostconfig0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamba-passdb-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamba-passdb0-4.6.14+git.157.c2d53c2b191-18.1 libsamba-passdb0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamba-policy-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamba-policy0-4.6.14+git.157.c2d53c2b191-18.1 libsamba-policy0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamba-util-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamba-util0-4.6.14+git.157.c2d53c2b191-18.1 libsamba-util0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsamdb-devel-4.6.14+git.157.c2d53c2b191-18.1 libsamdb0-4.6.14+git.157.c2d53c2b191-18.1 libsamdb0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsmbclient-devel-4.6.14+git.157.c2d53c2b191-18.1 libsmbclient0-4.6.14+git.157.c2d53c2b191-18.1 libsmbclient0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsmbconf-devel-4.6.14+git.157.c2d53c2b191-18.1 libsmbconf0-4.6.14+git.157.c2d53c2b191-18.1 libsmbconf0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libsmbldap-devel-4.6.14+git.157.c2d53c2b191-18.1 libsmbldap0-4.6.14+git.157.c2d53c2b191-18.1 libsmbldap0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libtevent-util-devel-4.6.14+git.157.c2d53c2b191-18.1 libtevent-util0-4.6.14+git.157.c2d53c2b191-18.1 libtevent-util0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 libwbclient-devel-4.6.14+git.157.c2d53c2b191-18.1 libwbclient0-4.6.14+git.157.c2d53c2b191-18.1 libwbclient0-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-4.6.14+git.157.c2d53c2b191-18.1 samba-client-4.6.14+git.157.c2d53c2b191-18.1 samba-client-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-core-devel-4.6.14+git.157.c2d53c2b191-18.1 samba-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-debugsource-4.6.14+git.157.c2d53c2b191-18.1 samba-libs-4.6.14+git.157.c2d53c2b191-18.1 samba-libs-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-pidl-4.6.14+git.157.c2d53c2b191-18.1 samba-python-4.6.14+git.157.c2d53c2b191-18.1 samba-python-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-test-4.6.14+git.157.c2d53c2b191-18.1 samba-test-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-winbind-4.6.14+git.157.c2d53c2b191-18.1 samba-winbind-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 - openSUSE Leap 42.3 (x86_64): libdcerpc-binding0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-binding0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-samr0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc-samr0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libdcerpc0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr-krb5pac0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr-krb5pac0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr-nbt0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr-nbt0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr-standard0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr-standard0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libndr0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libnetapi0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libnetapi0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-credentials0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-credentials0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-errors0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-errors0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-hostconfig0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-hostconfig0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-passdb0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-passdb0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-policy0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-policy0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-util0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamba-util0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamdb0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsamdb0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsmbclient0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsmbclient0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsmbconf0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsmbconf0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsmbldap0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libsmbldap0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libtevent-util0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libtevent-util0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 libwbclient0-32bit-4.6.14+git.157.c2d53c2b191-18.1 libwbclient0-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 samba-ceph-4.6.14+git.157.c2d53c2b191-18.1 samba-ceph-debuginfo-4.6.14+git.157.c2d53c2b191-18.1 samba-client-32bit-4.6.14+git.157.c2d53c2b191-18.1 samba-client-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 samba-libs-32bit-4.6.14+git.157.c2d53c2b191-18.1 samba-libs-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 samba-winbind-32bit-4.6.14+git.157.c2d53c2b191-18.1 samba-winbind-debuginfo-32bit-4.6.14+git.157.c2d53c2b191-18.1 - openSUSE Leap 42.3 (noarch): samba-doc-4.6.14+git.157.c2d53c2b191-18.1 References: https://www.suse.com/security/cve/CVE-2018-10858.html https://bugzilla.suse.com/1067700 https://bugzilla.suse.com/1068059 https://bugzilla.suse.com/1087303 https://bugzilla.suse.com/1103411 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2376-1: important: Security update for libheimdal
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2376-1 Rating: important References: #1047218 #1071675 #1084909 Cross-References: CVE-2017-17439 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libheimdal to version 7.5.0 fixes the following issues: The following security vulnerability was fixed: - CVE-2017-17439: Fixed a remote denial of service vulnerability through which remote unauthenticated attackers were able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm (boo#1071675) The following other bugs were fixed: - Override the build date (boo#1047218) - Use constant hostname (boo#1084909) - Handle long input lines when reloading database dumps - In pre-forked mode, correctly clear the process ids of exited children, allowing new child processes to replace the old. - Fixed incorrect KDC response when no-cross realm TGT exists, allowing client requests to fail quickly rather than time out after trying to get a correct answer from each KDC. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-876=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libheimdal-7.5.0-9.1 libheimdal-debuginfo-7.5.0-9.1 libheimdal-debugsource-7.5.0-9.1 libheimdal-devel-7.5.0-9.1 References: https://www.suse.com/security/cve/CVE-2017-17439.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1071675 https://bugzilla.suse.com/1084909 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2375-1: important: Security update for python-Django1
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for python-Django1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2375-1 Rating: important References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django1 to version 1.11.15 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-875=1 Package List: - openSUSE Leap 15.0 (noarch): python2-Django1-1.11.15-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2373-1: important: Security update for nemo-extensions
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for nemo-extensions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2373-1 Rating: important References: #1084703 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for nemo-extensions fixes the following issues: The following security vulnerability was fixed: - Prevent unprivileged users from adding other users to sambashare (boo#1084703) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-874=1 Package List: - openSUSE Leap 15.0 (x86_64): nemo-extension-dropbox-3.6.0-lp150.2.3.1 nemo-extension-dropbox-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-fileroller-3.6.0-lp150.2.3.1 nemo-extension-fileroller-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-gtkhash-3.6.0-lp150.2.3.1 nemo-extension-gtkhash-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-image-converter-3.6.0-lp150.2.3.1 nemo-extension-image-converter-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-preview-3.6.0-lp150.2.3.1 nemo-extension-preview-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-repairer-3.6.0-lp150.2.3.1 nemo-extension-repairer-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-seahorse-3.6.0-lp150.2.3.1 nemo-extension-seahorse-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-share-3.6.0-lp150.2.3.1 nemo-extension-share-debuginfo-3.6.0-lp150.2.3.1 nemo-extensions-debuginfo-3.6.0-lp150.2.3.1 nemo-extensions-debugsource-3.6.0-lp150.2.3.1 python-nemo-3.6.0-lp150.2.3.1 python-nemo-debuginfo-3.6.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): nemo-extension-audio-tab-3.6.0-lp150.2.3.1 nemo-extension-compare-3.6.0-lp150.2.3.1 nemo-extension-emblems-3.6.0-lp150.2.3.1 nemo-extension-pastebin-3.6.0-lp150.2.3.1 nemo-extension-rabbitvcs-3.6.0-lp150.2.3.1 nemo-extension-terminal-3.6.0-lp150.2.3.1 References: https://bugzilla.suse.com/1084703 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2343-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2343-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-868=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-868=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aubio-debugsource-0.4.1-9.9.1 aubio-tools-0.4.1-9.9.1 aubio-tools-debuginfo-0.4.1-9.9.1 libaubio-devel-0.4.1-9.9.1 libaubio4-0.4.1-9.9.1 libaubio4-debuginfo-0.4.1-9.9.1 - openSUSE Leap 42.3 (x86_64): libaubio4-32bit-0.4.1-9.9.1 libaubio4-debuginfo-32bit-0.4.1-9.9.1 - openSUSE Leap 15.0 (i586 x86_64): aubio-debugsource-0.4.6-lp150.3.6.1 aubio-tools-0.4.6-lp150.3.6.1 aubio-tools-debuginfo-0.4.6-lp150.3.6.1 libaubio-devel-0.4.6-lp150.3.6.1 libaubio5-0.4.6-lp150.3.6.1 libaubio5-debuginfo-0.4.6-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libaubio5-32bit-0.4.6-lp150.3.6.1 libaubio5-32bit-debuginfo-0.4.6-lp150.3.6.1 python-aubio-debugsource-0.4.6-lp150.3.6.1 python2-aubio-0.4.6-lp150.3.6.1 python2-aubio-debuginfo-0.4.6-lp150.3.6.1 python3-aubio-0.4.6-lp150.3.6.1 python3-aubio-debuginfo-0.4.6-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2330-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 15 Aug '18

15 Aug '18

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2330-1 Rating: important References: #1020631 #1062195 #1076907 #1077291 #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-5156 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr (boo#1098998). Security issues fixed with MFSA 2018-16 (boo#1098998): * CVE-2018-12359: Buffer overflow using computed size of canvas element * CVE-2018-12360: Use-after-free when using focus() * CVE-2018-12362: Integer overflow in SSSE3 scaler * CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture * CVE-2018-12363: Use-after-free when appending DOM nodes * CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins * CVE-2018-12365: Compromised IPC child process can list local filenames * CVE-2018-12366: Invalid data handling during QCMS transformations * CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Localizations finally included again (boo#1062195) Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with Update to Seamonkey 2.49.2 * Gecko 52.6esr (including security relevant fixes) (boo#1077291) * fix issue in Composer * With some themes, the menulist- and history-dropmarker didn't show * Scrollbars didn't show the buttons * WebRTC has been disabled by default. It needs an add-on to enable it per site * The active title bar was not visually emphasized Correct requires and provides handling (boo#1076907) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-867=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-867=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): seamonkey-2.49.4-13.3.2 seamonkey-debuginfo-2.49.4-13.3.2 seamonkey-debugsource-2.49.4-13.3.2 seamonkey-translations-common-2.49.4-13.3.2 seamonkey-translations-other-2.49.4-13.3.2 - openSUSE Leap 15.0 (x86_64): seamonkey-2.49.4-lp150.2.3.2 seamonkey-debuginfo-2.49.4-lp150.2.3.2 seamonkey-debugsource-2.49.4-lp150.2.3.2 seamonkey-translations-common-2.49.4-lp150.2.3.2 seamonkey-translations-other-2.49.4-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1020631 https://bugzilla.suse.com/1062195 https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1077291 https://bugzilla.suse.com/1098998 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2327-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 14 Aug '18

14 Aug '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2327-1 Rating: moderate References: #1102680 Cross-References: CVE-2018-14574 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django to 1.11.15 fixes the following issues: This security issue was fixed: - CVE-2018-14574: Prevent open redirect in django.middleware.common.CommonMiddleware (bsc#1102680). These non-security issues were fixed: - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression that could result in large memory usage when making edits using ModelAdmin.list_editable - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary - Fixed a regression where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns - Fixed a regression where an empty choice could be initially selected for the SelectMultiple and CheckboxSelectMultiple widgets Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-866=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Django-1.11.15-11.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2316-1: moderate: Security update for lxc
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2316-1 Rating: moderate References: #988348 Cross-References: CVE-2018-6556 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lxc fixes the following issues: The following security vulnerability was fixed: - CVE-2018-6556: Fixed an information leak and possible open() side effects to regular users via lxc-user-nic (boo#988348) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-865=1 Package List: - openSUSE Leap 15.0 (x86_64): liblxc-devel-2.0.9-lp150.2.6.1 liblxc1-2.0.9-lp150.2.6.1 liblxc1-debuginfo-2.0.9-lp150.2.6.1 lxc-2.0.9-lp150.2.6.1 lxc-debuginfo-2.0.9-lp150.2.6.1 lxc-debugsource-2.0.9-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-6556.html https://bugzilla.suse.com/988348 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2313-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2313-1 Rating: moderate References: #1103799 Cross-References: CVE-2018-14912 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cgit to version 1.2.1 fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off (boo#1103799) The following other changes were made: - Update to upstream release 1.2.1: - syntax-highlighting: replace invalid unicode with '?' - ui-repolist: properly sort by age - ui-patch: fix crash when using path limit - Update bundled git to 2.11.1 - Update to upstream release 1.0: * Add repo.homepage/gitweb.homepage setting and homepage tab. * Show reverse paths in title bar so that browser tab shows filename. * Allow redirects even when caching is turned on. * More gracefully deal with unparsable commits. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-864=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cgit-1.2.1-13.3.1 cgit-debuginfo-1.2.1-13.3.1 cgit-debugsource-1.2.1-13.3.1 References: https://www.suse.com/security/cve/CVE-2018-14912.html https://bugzilla.suse.com/1103799 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2310-1: moderate: Security update for sddm
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2310-1 Rating: moderate References: #1099908 #1101450 Cross-References: CVE-2018-14345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sddm fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14345: Fixed the authentication, which did not check the password for users with an already existing session and allowed any user with access to the system bus to unlock any graphical session. (boo#1101450) The following other bugs were addressed: - Fallback to embedded theme, if none is set - Corrected section name for Wayland - Removed patch, which is no longer needed, because bug in libxcb was fixed in the meanwhile (boo#1099908) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-862=1 Package List: - openSUSE Leap 15.0 (x86_64): sddm-0.17.0-lp150.9.3.1 sddm-branding-openSUSE-0.17.0-lp150.9.3.1 sddm-branding-upstream-0.17.0-lp150.9.3.1 sddm-debuginfo-0.17.0-lp150.9.3.1 sddm-debugsource-0.17.0-lp150.9.3.1 References: https://www.suse.com/security/cve/CVE-2018-14345.html https://bugzilla.suse.com/1099908 https://bugzilla.suse.com/1101450 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2309-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2309-1 Rating: moderate References: #1101288 Cross-References: CVE-2018-13796 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2018-13796: Fix a content spoofing vulnerability with invalid list name messages inside the web UI (boo#1101288). Bug fixes: - update to 2.1.29: * Fixed the listinfo and admin overview pages that were broken - update to 2.1.28: * It is now possible to edit HTML and text templates via the web admin UI in a supported language other than the list's preferred_language. * The Japanese translation has been updated * The German translation has been updated * The Esperanto translation has been updated * The BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE feature added in 2.1.27 was not working. This is fixed. * Escaping of HTML entities for the web UI is now done more selectively. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-861=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-861=1 Package List: - openSUSE Leap 42.3 (x86_64): mailman-2.1.29-2.11.2 mailman-debuginfo-2.1.29-2.11.2 mailman-debugsource-2.1.29-2.11.2 - openSUSE Leap 15.0 (x86_64): mailman-2.1.29-lp150.2.8.1 mailman-debuginfo-2.1.29-lp150.2.8.1 mailman-debugsource-2.1.29-lp150.2.8.1 References: https://www.suse.com/security/cve/CVE-2018-13796.html https://bugzilla.suse.com/1101288 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2308-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2308-1 Rating: moderate References: #1103799 Cross-References: CVE-2018-14912 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cgit fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off (boo#1103799) The following other changes were made: - Update to upstream release 1.2.1 * syntax-highlighting: replace invalid unicode with '?' * ui-repolist: properly sort by age * ui-patch: fix crash when using path limit Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-863=1 Package List: - openSUSE Leap 15.0 (x86_64): cgit-1.2.1-lp150.2.3.1 cgit-debuginfo-1.2.1-lp150.2.3.1 cgit-debugsource-1.2.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14912.html https://bugzilla.suse.com/1103799 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2307-1: moderate: Recommended update for NetworkManager-vpnc
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Recommended update for NetworkManager-vpnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2307-1 Rating: moderate References: #1101147 Cross-References: CVE-2018-10900 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for NetworkManager-vpnc fixes the following issues: Security issue fixed: - CVE-2018-10900: Check configurations that contain newline characters and invalidate them to avoid security attacks (bsc#1101147). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-859=1 Package List: - openSUSE Leap 42.3 (x86_64): NetworkManager-vpnc-1.0.8-7.3.1 NetworkManager-vpnc-debuginfo-1.0.8-7.3.1 NetworkManager-vpnc-debugsource-1.0.8-7.3.1 NetworkManager-vpnc-gnome-1.0.8-7.3.1 NetworkManager-vpnc-gnome-debuginfo-1.0.8-7.3.1 - openSUSE Leap 42.3 (noarch): NetworkManager-vpnc-lang-1.0.8-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-10900.html https://bugzilla.suse.com/1101147 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2306-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2306-1 Rating: moderate References: #1074014 #1076861 #1079150 #1087416 #1092885 #1094325 #1094480 #1094725 #1095556 #959329 Cross-References: CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 9 fixes is now available. Description: This update for libvirt fixes the following issues: Security issue fixed: - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka "Memory Disambiguation" (bsc#1092885). Bug fixes: - bsc#1094325: Enable virsh blockresize for XEN guests (FATE#325467). - bsc#1095556: Fix qemu VM creating with --boot uefi due to missing AppArmor profile. - bsc#1094725: Fix `virsh blockresize` to work with Xen qdisks. - bsc#1094480: Fix `virsh list` to list domains with `xl list`. - bsc#1087416: Fix missing video device within guest with default installation by virt-mamanger. - bsc#1079150: Fix libvirt-guests start dependency. - bsc#1076861: Fix locking of lockspace resource '/devcfs/disks/uatidmsvn1-xvda'. - bsc#1074014: Fix KVM live migration when shutting down cluster node. - bsc#959329: Fix wrong state of VMs in virtual manager. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-860=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-18.1 libvirt-admin-3.3.0-18.1 libvirt-admin-debuginfo-3.3.0-18.1 libvirt-client-3.3.0-18.1 libvirt-client-debuginfo-3.3.0-18.1 libvirt-daemon-3.3.0-18.1 libvirt-daemon-config-network-3.3.0-18.1 libvirt-daemon-config-nwfilter-3.3.0-18.1 libvirt-daemon-debuginfo-3.3.0-18.1 libvirt-daemon-driver-interface-3.3.0-18.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-18.1 libvirt-daemon-driver-lxc-3.3.0-18.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-18.1 libvirt-daemon-driver-network-3.3.0-18.1 libvirt-daemon-driver-network-debuginfo-3.3.0-18.1 libvirt-daemon-driver-nodedev-3.3.0-18.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-18.1 libvirt-daemon-driver-nwfilter-3.3.0-18.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-18.1 libvirt-daemon-driver-qemu-3.3.0-18.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-18.1 libvirt-daemon-driver-secret-3.3.0-18.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-3.3.0-18.1 libvirt-daemon-driver-storage-core-3.3.0-18.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-disk-3.3.0-18.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-iscsi-3.3.0-18.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-logical-3.3.0-18.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-mpath-3.3.0-18.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-scsi-3.3.0-18.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-18.1 libvirt-daemon-driver-uml-3.3.0-18.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-18.1 libvirt-daemon-driver-vbox-3.3.0-18.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-18.1 libvirt-daemon-hooks-3.3.0-18.1 libvirt-daemon-lxc-3.3.0-18.1 libvirt-daemon-qemu-3.3.0-18.1 libvirt-daemon-uml-3.3.0-18.1 libvirt-daemon-vbox-3.3.0-18.1 libvirt-debugsource-3.3.0-18.1 libvirt-devel-3.3.0-18.1 libvirt-doc-3.3.0-18.1 libvirt-libs-3.3.0-18.1 libvirt-libs-debuginfo-3.3.0-18.1 libvirt-lock-sanlock-3.3.0-18.1 libvirt-lock-sanlock-debuginfo-3.3.0-18.1 libvirt-nss-3.3.0-18.1 libvirt-nss-debuginfo-3.3.0-18.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-18.1 libvirt-daemon-driver-libxl-3.3.0-18.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-rbd-3.3.0-18.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-18.1 libvirt-daemon-xen-3.3.0-18.1 libvirt-devel-32bit-3.3.0-18.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1074014 https://bugzilla.suse.com/1076861 https://bugzilla.suse.com/1079150 https://bugzilla.suse.com/1087416 https://bugzilla.suse.com/1092885 https://bugzilla.suse.com/1094325 https://bugzilla.suse.com/1094480 https://bugzilla.suse.com/1094725 https://bugzilla.suse.com/1095556 https://bugzilla.suse.com/959329 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2296-1: moderate: Security update for libsoup
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libsoup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2296-1 Rating: moderate References: #1052916 #1086036 #1100097 Cross-References: CVE-2017-2885 CVE-2018-12910 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libsoup fixes the following issues: Security issue fixed: - CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097). - CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916). Bug fixes: - bsc#1086036: translation-update-upstream commented out for Leap This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-856=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsoup-2_4-1-2.62.2-8.1 libsoup-2_4-1-debuginfo-2.62.2-8.1 libsoup-debugsource-2.62.2-8.1 libsoup-devel-2.62.2-8.1 typelib-1_0-Soup-2_4-2.62.2-8.1 - openSUSE Leap 42.3 (noarch): libsoup-lang-2.62.2-8.1 - openSUSE Leap 42.3 (x86_64): libsoup-2_4-1-32bit-2.62.2-8.1 libsoup-2_4-1-debuginfo-32bit-2.62.2-8.1 libsoup-devel-32bit-2.62.2-8.1 References: https://www.suse.com/security/cve/CVE-2017-2885.html https://www.suse.com/security/cve/CVE-2018-12910.html https://bugzilla.suse.com/1052916 https://bugzilla.suse.com/1086036 https://bugzilla.suse.com/1100097 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2295-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2295-1 Rating: important References: #1101667 Cross-References: CVE-2018-3005 CVE-2018-3055 CVE-2018-3085 CVE-2018-3086 CVE-2018-3087 CVE-2018-3088 CVE-2018-3089 CVE-2018-3090 CVE-2018-3091 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for virtualbox to version 5.2.16 fixes the following issues: The following security vulnerabilities were fixed (boo#1101667): - CVE-2018-3005: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. - CVE-2018-3055: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2018-3085: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2018-3086: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3087: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3088: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3089: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3090: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3091: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The following bugs were fixed: - OVF: case insensitive comparison of manifest attribute values, to improve compatibility Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-853=1 Package List: - openSUSE Leap 15.0 (x86_64): python3-virtualbox-5.2.16-lp150.4.9.1 python3-virtualbox-debuginfo-5.2.16-lp150.4.9.1 virtualbox-5.2.16-lp150.4.9.1 virtualbox-debuginfo-5.2.16-lp150.4.9.1 virtualbox-debugsource-5.2.16-lp150.4.9.1 virtualbox-devel-5.2.16-lp150.4.9.1 virtualbox-guest-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-guest-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-guest-tools-5.2.16-lp150.4.9.1 virtualbox-guest-tools-debuginfo-5.2.16-lp150.4.9.1 virtualbox-guest-x11-5.2.16-lp150.4.9.1 virtualbox-guest-x11-debuginfo-5.2.16-lp150.4.9.1 virtualbox-host-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-host-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-qt-5.2.16-lp150.4.9.1 virtualbox-qt-debuginfo-5.2.16-lp150.4.9.1 virtualbox-vnc-5.2.16-lp150.4.9.1 virtualbox-websrv-5.2.16-lp150.4.9.1 virtualbox-websrv-debuginfo-5.2.16-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-5.2.16-lp150.4.9.1 virtualbox-guest-source-5.2.16-lp150.4.9.1 virtualbox-host-source-5.2.16-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2018-3005.html https://www.suse.com/security/cve/CVE-2018-3055.html https://www.suse.com/security/cve/CVE-2018-3085.html https://www.suse.com/security/cve/CVE-2018-3086.html https://www.suse.com/security/cve/CVE-2018-3087.html https://www.suse.com/security/cve/CVE-2018-3088.html https://www.suse.com/security/cve/CVE-2018-3089.html https://www.suse.com/security/cve/CVE-2018-3090.html https://www.suse.com/security/cve/CVE-2018-3091.html https://bugzilla.suse.com/1101667 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2294-1: Security update for libcdio
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libcdio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2294-1 Rating: low References: #1082821 #1082877 Cross-References: CVE-2017-18199 CVE-2017-18201 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libcdio fixes the following issues: The following security vulnerabilities were addressed: - CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c (bsc#1082821) - CVE-2017-18201: Fixed a double free vulnerability in get_cdtext_generic() in _cdio_generic.c (bsc#1082877) - Fixed several memory leaks (bsc#1082821) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-857=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libcdio++0-0.94-lp150.5.3.1 libcdio++0-debuginfo-0.94-lp150.5.3.1 libcdio-debugsource-0.94-lp150.5.3.1 libcdio-devel-0.94-lp150.5.3.1 libcdio16-0.94-lp150.5.3.1 libcdio16-debuginfo-0.94-lp150.5.3.1 libiso9660-10-0.94-lp150.5.3.1 libiso9660-10-debuginfo-0.94-lp150.5.3.1 libudf0-0.94-lp150.5.3.1 libudf0-debuginfo-0.94-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): cdio-utils-0.94-lp150.5.3.1 cdio-utils-debuginfo-0.94-lp150.5.3.1 cdio-utils-debugsource-0.94-lp150.5.3.1 libcdio++0-32bit-0.94-lp150.5.3.1 libcdio++0-32bit-debuginfo-0.94-lp150.5.3.1 libcdio16-32bit-0.94-lp150.5.3.1 libcdio16-32bit-debuginfo-0.94-lp150.5.3.1 libiso9660-10-32bit-0.94-lp150.5.3.1 libiso9660-10-32bit-debuginfo-0.94-lp150.5.3.1 libudf0-32bit-0.94-lp150.5.3.1 libudf0-32bit-debuginfo-0.94-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-18199.html https://www.suse.com/security/cve/CVE-2017-18201.html https://bugzilla.suse.com/1082821 https://bugzilla.suse.com/1082877 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2293-1: moderate: Security update for mysql-community-server
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2293-1 Rating: moderate References: #1087102 #1088681 #1101676 #1101678 #1101679 #1101680 #1103342 #1103344 Cross-References: CVE-2018-0739 CVE-2018-2767 CVE-2018-3058 CVE-2018-3062 CVE-2018-3064 CVE-2018-3066 CVE-2018-3070 CVE-2018-3081 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for mysql-community-server to version 5.6.41 fixes the following issues: Security vulnerabilities fixed: - CVE-2018-3064: Fixed an easily exploitable vulnerability that allowed a low privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (bsc#1103342) - CVE-2018-3070: Fixed an easily exploitable vulnerability that allowed a low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (bsc#1101679) - CVE-2018-0739: Fixed a stack exhaustion in case of recursively constructed ASN.1 types. (boo#1087102) - CVE-2018-3062: Fixed a difficult to exploit vulnerability that allowed low privileged attacker with network access via memcached to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (bsc#1103344) - CVE-2018-3081: Fixed a difficult to exploit vulnerability that allowed high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client as well as unauthorized update, insert or delete access to some of MySQL Client accessible data. (bsc#1101680) - CVE-2018-3058: Fixed an easily exploitable vulnerability that allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. (bsc#1101676) - CVE-2018-3066: Fixed a difficult to exploit vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. (bsc#1101678) - CVE-2018-2767: Fixed a difficult to exploit vulnerability that allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. (boo#1088681) You can find more detailed information about this update in the [release notes](http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-41.html) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-844=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.41-39.1 libmysql56client18-debuginfo-5.6.41-39.1 libmysql56client_r18-5.6.41-39.1 mysql-community-server-5.6.41-39.1 mysql-community-server-bench-5.6.41-39.1 mysql-community-server-bench-debuginfo-5.6.41-39.1 mysql-community-server-client-5.6.41-39.1 mysql-community-server-client-debuginfo-5.6.41-39.1 mysql-community-server-debuginfo-5.6.41-39.1 mysql-community-server-debugsource-5.6.41-39.1 mysql-community-server-test-5.6.41-39.1 mysql-community-server-test-debuginfo-5.6.41-39.1 mysql-community-server-tools-5.6.41-39.1 mysql-community-server-tools-debuginfo-5.6.41-39.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.41-39.1 libmysql56client18-debuginfo-32bit-5.6.41-39.1 libmysql56client_r18-32bit-5.6.41-39.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.41-39.1 References: https://www.suse.com/security/cve/CVE-2018-0739.html https://www.suse.com/security/cve/CVE-2018-2767.html https://www.suse.com/security/cve/CVE-2018-3058.html https://www.suse.com/security/cve/CVE-2018-3062.html https://www.suse.com/security/cve/CVE-2018-3064.html https://www.suse.com/security/cve/CVE-2018-3066.html https://www.suse.com/security/cve/CVE-2018-3070.html https://www.suse.com/security/cve/CVE-2018-3081.html https://bugzilla.suse.com/1087102 https://bugzilla.suse.com/1088681 https://bugzilla.suse.com/1101676 https://bugzilla.suse.com/1101678 https://bugzilla.suse.com/1101679 https://bugzilla.suse.com/1101680 https://bugzilla.suse.com/1103342 https://bugzilla.suse.com/1103344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2292-1: moderate: Security update for cups
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2292-1 Rating: moderate References: #1096405 #1096406 #1096407 #1096408 Cross-References: CVE-2018-4180 CVE-2018-4181 CVE-2018-4182 CVE-2018-4183 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for cups fixes the following issues: The following security vulnerabilities were fixed: - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend (bsc#1096405) - CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406) - CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling (bsc#1096407) - CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration (bsc#1096408) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-852=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cups-2.2.7-lp150.2.3.1 cups-client-2.2.7-lp150.2.3.1 cups-client-debuginfo-2.2.7-lp150.2.3.1 cups-config-2.2.7-lp150.2.3.1 cups-ddk-2.2.7-lp150.2.3.1 cups-ddk-debuginfo-2.2.7-lp150.2.3.1 cups-debuginfo-2.2.7-lp150.2.3.1 cups-debugsource-2.2.7-lp150.2.3.1 cups-devel-2.2.7-lp150.2.3.1 libcups2-2.2.7-lp150.2.3.1 libcups2-debuginfo-2.2.7-lp150.2.3.1 libcupscgi1-2.2.7-lp150.2.3.1 libcupscgi1-debuginfo-2.2.7-lp150.2.3.1 libcupsimage2-2.2.7-lp150.2.3.1 libcupsimage2-debuginfo-2.2.7-lp150.2.3.1 libcupsmime1-2.2.7-lp150.2.3.1 libcupsmime1-debuginfo-2.2.7-lp150.2.3.1 libcupsppdc1-2.2.7-lp150.2.3.1 libcupsppdc1-debuginfo-2.2.7-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): cups-devel-32bit-2.2.7-lp150.2.3.1 libcups2-32bit-2.2.7-lp150.2.3.1 libcups2-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupscgi1-32bit-2.2.7-lp150.2.3.1 libcupscgi1-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupsimage2-32bit-2.2.7-lp150.2.3.1 libcupsimage2-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupsmime1-32bit-2.2.7-lp150.2.3.1 libcupsmime1-32bit-debuginfo-2.2.7-lp150.2.3.1 libcupsppdc1-32bit-2.2.7-lp150.2.3.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-4180.html https://www.suse.com/security/cve/CVE-2018-4181.html https://www.suse.com/security/cve/CVE-2018-4182.html https://www.suse.com/security/cve/CVE-2018-4183.html https://bugzilla.suse.com/1096405 https://bugzilla.suse.com/1096406 https://bugzilla.suse.com/1096407 https://bugzilla.suse.com/1096408 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2291-1: moderate: Security update for python-mitmproxy
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for python-mitmproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2291-1 Rating: moderate References: #1101457 #1102178 Cross-References: CVE-2018-14505 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for python-mitmproxy fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14505: Fixed multiple DNS rebinding attacks related to tools/web/app.py (boo#1102178) The following other issue was fixed: - Fixed a dependency issue with python-ldap3 (boo#1101457) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-850=1 Package List: - openSUSE Leap 15.0 (noarch): python3-mitmproxy-3.0.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14505.html https://bugzilla.suse.com/1101457 https://bugzilla.suse.com/1102178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2290-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2290-1 Rating: moderate References: #1083066 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-855=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-855=1 Package List: - openSUSE Leap 42.3 (x86_64): blueman-2.0.6-2.3.1 blueman-debuginfo-2.0.6-2.3.1 blueman-debugsource-2.0.6-2.3.1 - openSUSE Leap 42.3 (noarch): blueman-lang-2.0.6-2.3.1 thunar-sendto-blueman-2.0.6-2.3.1 - openSUSE Leap 15.0 (x86_64): blueman-2.0.6-lp150.3.3.1 blueman-debuginfo-2.0.6-lp150.3.3.1 blueman-debugsource-2.0.6-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): blueman-lang-2.0.6-lp150.3.3.1 thunar-sendto-blueman-2.0.6-lp150.3.3.1 References: https://bugzilla.suse.com/1083066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2289-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2289-1 Rating: moderate References: #1098163 #1098377 Cross-References: CVE-2018-10852 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sssd fixes the following security issue: - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-847=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libipa_hbac-devel-1.16.1-lp150.2.3.1 libipa_hbac0-1.16.1-lp150.2.3.1 libipa_hbac0-debuginfo-1.16.1-lp150.2.3.1 libnfsidmap-sss-1.16.1-lp150.2.3.1 libnfsidmap-sss-debuginfo-1.16.1-lp150.2.3.1 libsss_certmap-devel-1.16.1-lp150.2.3.1 libsss_certmap0-1.16.1-lp150.2.3.1 libsss_certmap0-debuginfo-1.16.1-lp150.2.3.1 libsss_idmap-devel-1.16.1-lp150.2.3.1 libsss_idmap0-1.16.1-lp150.2.3.1 libsss_idmap0-debuginfo-1.16.1-lp150.2.3.1 libsss_nss_idmap-devel-1.16.1-lp150.2.3.1 libsss_nss_idmap0-1.16.1-lp150.2.3.1 libsss_nss_idmap0-debuginfo-1.16.1-lp150.2.3.1 libsss_simpleifp-devel-1.16.1-lp150.2.3.1 libsss_simpleifp0-1.16.1-lp150.2.3.1 libsss_simpleifp0-debuginfo-1.16.1-lp150.2.3.1 python3-ipa_hbac-1.16.1-lp150.2.3.1 python3-ipa_hbac-debuginfo-1.16.1-lp150.2.3.1 python3-sss-murmur-1.16.1-lp150.2.3.1 python3-sss-murmur-debuginfo-1.16.1-lp150.2.3.1 python3-sss_nss_idmap-1.16.1-lp150.2.3.1 python3-sss_nss_idmap-debuginfo-1.16.1-lp150.2.3.1 python3-sssd-config-1.16.1-lp150.2.3.1 python3-sssd-config-debuginfo-1.16.1-lp150.2.3.1 sssd-1.16.1-lp150.2.3.1 sssd-ad-1.16.1-lp150.2.3.1 sssd-ad-debuginfo-1.16.1-lp150.2.3.1 sssd-dbus-1.16.1-lp150.2.3.1 sssd-dbus-debuginfo-1.16.1-lp150.2.3.1 sssd-debuginfo-1.16.1-lp150.2.3.1 sssd-debugsource-1.16.1-lp150.2.3.1 sssd-ipa-1.16.1-lp150.2.3.1 sssd-ipa-debuginfo-1.16.1-lp150.2.3.1 sssd-krb5-1.16.1-lp150.2.3.1 sssd-krb5-common-1.16.1-lp150.2.3.1 sssd-krb5-common-debuginfo-1.16.1-lp150.2.3.1 sssd-krb5-debuginfo-1.16.1-lp150.2.3.1 sssd-ldap-1.16.1-lp150.2.3.1 sssd-ldap-debuginfo-1.16.1-lp150.2.3.1 sssd-proxy-1.16.1-lp150.2.3.1 sssd-proxy-debuginfo-1.16.1-lp150.2.3.1 sssd-tools-1.16.1-lp150.2.3.1 sssd-tools-debuginfo-1.16.1-lp150.2.3.1 sssd-wbclient-1.16.1-lp150.2.3.1 sssd-wbclient-debuginfo-1.16.1-lp150.2.3.1 sssd-wbclient-devel-1.16.1-lp150.2.3.1 sssd-winbind-idmap-1.16.1-lp150.2.3.1 sssd-winbind-idmap-debuginfo-1.16.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): sssd-32bit-1.16.1-lp150.2.3.1 sssd-32bit-debuginfo-1.16.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10852.html https://bugzilla.suse.com/1098163 https://bugzilla.suse.com/1098377 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0