August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2502-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2502-1 Rating: important References: #1095219 #1100612 #1100613 #1104641 Cross-References: CVE-2018-10887 CVE-2018-10888 CVE-2018-11235 CVE-2018-15501 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libgit2 to version 0.26.5 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10887: Fixed an integer overflow which in turn leads to an out of bound read, allowing to read the base object, which could be exploited by an attacker to cause denial of service (DoS) (bsc#1100613). - CVE-2018-10888: Fixed an out-of-bound read while reading a binary delta file, which could be exploited by an attacker t ocause a denial of service (DoS) (bsc#1100612). - CVE-2018-11235: Fixed a remote code execution, which could occur with a crafted .gitmodules file (bsc#1095219) - CVE-2018-15501: Prevent out-of-bounds reads when processing smart-protocol "ng" packets (bsc#1104641) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-922=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgit2-26-0.26.6-lp150.2.3.1 libgit2-26-debuginfo-0.26.6-lp150.2.3.1 libgit2-debugsource-0.26.6-lp150.2.3.1 libgit2-devel-0.26.6-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libgit2-26-32bit-0.26.6-lp150.2.3.1 libgit2-26-32bit-debuginfo-0.26.6-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10887.html https://www.suse.com/security/cve/CVE-2018-10888.html https://www.suse.com/security/cve/CVE-2018-11235.html https://www.suse.com/security/cve/CVE-2018-15501.html https://bugzilla.suse.com/1095219 https://bugzilla.suse.com/1100612 https://bugzilla.suse.com/1100613 https://bugzilla.suse.com/1104641 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2488-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2488-1 Rating: moderate References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB - Fixed a regression where django.template.Template crashed if the template_string argument is lazy - Fixed __regex and __iregex lookups with MySQL - Fixed admin check crash when using a query expression in ModelAdmin.ordering - Fixed admin changelist crash when using a query expression without asc() or desc() in the page’s ordering - Fixed a regression that broke custom template filters that use decorators - Fixed detection of custom URL converters in included pattern - Fixed a regression that added an unnecessary subquery to the GROUP BY clause on MySQL when using a RawSQL annotation - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable - Corrected the import paths that inspectdb generates for django.contrib.postgres fields - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-914=1 Package List: - openSUSE Leap 15.0 (noarch): python3-Django-2.0.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2487-1: Security update for libXcursor
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for libXcursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2487-1 Rating: low References: #1103511 Cross-References: CVE-2015-9262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libXcursor fixes the following issues: - CVE-2015-9262: _XcursorThemeInherits allowed remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow (bsc#1103511) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-915=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libXcursor-debugsource-1.1.14-10.6.1 libXcursor-devel-1.1.14-10.6.1 libXcursor1-1.1.14-10.6.1 libXcursor1-debuginfo-1.1.14-10.6.1 - openSUSE Leap 42.3 (x86_64): libXcursor-devel-32bit-1.1.14-10.6.1 libXcursor1-32bit-1.1.14-10.6.1 libXcursor1-debuginfo-32bit-1.1.14-10.6.1 References: https://www.suse.com/security/cve/CVE-2015-9262.html https://bugzilla.suse.com/1103511 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2479-1: important: Security update for ceph
by opensuse-security＠opensuse.org 22 Aug '18

22 Aug '18

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2479-1 Rating: important References: #1051598 #1054061 #1056125 #1056967 #1059458 #1060904 #1061461 #1063014 #1066182 #1066502 #1067088 #1067119 #1067705 #1070357 #1071386 #1074301 #1079076 #1080788 #1081379 #1081600 #1086340 #1087269 #1087493 Cross-References: CVE-2017-16818 CVE-2018-7262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 21 fixes is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379). - CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014). Bug fixes: - bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster. - bsc#1079076: RGW openssl fixes. - bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start. - bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool. - bsc#1087269: allow_ec_overwrites option not in command options list. - bsc#1051598: Fix mountpoint check for systemctl enable --runtime. - bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR. - bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster. - bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs. - bsc#1060904: Loglevel misleading during keystone authentication. - bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs. - bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2. - bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw. - bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy. - bsc#1066182: Container synchronization between two Ceph clusters failed. - bsc#1081600: Crash in civetweb/RGW. - bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client. - bsc#1074301: OSDs keep aborting: SnapMapper failed asserts. - bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled. - bsc#1080788: fsid mismatch when creating additional OSDs. - bsc#1071386: Metadata spill onto block.slow. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-541=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 References: https://www.suse.com/security/cve/CVE-2017-16818.html https://www.suse.com/security/cve/CVE-2018-7262.html https://bugzilla.suse.com/1051598 https://bugzilla.suse.com/1054061 https://bugzilla.suse.com/1056125 https://bugzilla.suse.com/1056967 https://bugzilla.suse.com/1059458 https://bugzilla.suse.com/1060904 https://bugzilla.suse.com/1061461 https://bugzilla.suse.com/1063014 https://bugzilla.suse.com/1066182 https://bugzilla.suse.com/1066502 https://bugzilla.suse.com/1067088 https://bugzilla.suse.com/1067119 https://bugzilla.suse.com/1067705 https://bugzilla.suse.com/1070357 https://bugzilla.suse.com/1071386 https://bugzilla.suse.com/1074301 https://bugzilla.suse.com/1079076 https://bugzilla.suse.com/1080788 https://bugzilla.suse.com/1081379 https://bugzilla.suse.com/1081600 https://bugzilla.suse.com/1086340 https://bugzilla.suse.com/1087269 https://bugzilla.suse.com/1087493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2439-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2439-1 Rating: low References: #1102007 Cross-References: CVE-2018-14435 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: The following security issue was fixed: - CVE-2018-14435: Fixed a memory leak in DecodeImage in coders/pcd.c (boo#1102007) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-906=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-96.2 GraphicsMagick-debuginfo-1.3.25-96.2 GraphicsMagick-debugsource-1.3.25-96.2 GraphicsMagick-devel-1.3.25-96.2 libGraphicsMagick++-Q16-12-1.3.25-96.2 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-96.2 libGraphicsMagick++-devel-1.3.25-96.2 libGraphicsMagick-Q16-3-1.3.25-96.2 libGraphicsMagick-Q16-3-debuginfo-1.3.25-96.2 libGraphicsMagick3-config-1.3.25-96.2 libGraphicsMagickWand-Q16-2-1.3.25-96.2 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-96.2 perl-GraphicsMagick-1.3.25-96.2 perl-GraphicsMagick-debuginfo-1.3.25-96.2 References: https://www.suse.com/security/cve/CVE-2018-14435.html https://bugzilla.suse.com/1102007 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2438-1: moderate: Security update for perl-Archive-Zip
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for perl-Archive-Zip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2438-1 Rating: moderate References: #1099497 Cross-References: CVE-2018-10860 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-Archive-Zip fixes the following security issue: - CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-904=1 Package List: - openSUSE Leap 15.0 (noarch): perl-Archive-Zip-1.60-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10860.html https://bugzilla.suse.com/1099497 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2436-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2436-1 Rating: important References: #1027519 #1091107 #1103276 Cross-References: CVE-2018-3646 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-911=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xen-debugsource-4.10.1_08-lp150.2.9.1 xen-devel-4.10.1_08-lp150.2.9.1 xen-libs-4.10.1_08-lp150.2.9.1 xen-libs-debuginfo-4.10.1_08-lp150.2.9.1 xen-tools-domU-4.10.1_08-lp150.2.9.1 xen-tools-domU-debuginfo-4.10.1_08-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): xen-4.10.1_08-lp150.2.9.1 xen-doc-html-4.10.1_08-lp150.2.9.1 xen-libs-32bit-4.10.1_08-lp150.2.9.1 xen-libs-32bit-debuginfo-4.10.1_08-lp150.2.9.1 xen-tools-4.10.1_08-lp150.2.9.1 xen-tools-debuginfo-4.10.1_08-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1103276 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2434-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2434-1 Rating: important References: #1027519 #1091107 #1103276 Cross-References: CVE-2018-3646 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-910=1 Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.2_10-28.1 xen-debugsource-4.9.2_10-28.1 xen-devel-4.9.2_10-28.1 xen-doc-html-4.9.2_10-28.1 xen-libs-4.9.2_10-28.1 xen-libs-debuginfo-4.9.2_10-28.1 xen-tools-4.9.2_10-28.1 xen-tools-debuginfo-4.9.2_10-28.1 xen-tools-domU-4.9.2_10-28.1 xen-tools-domU-debuginfo-4.9.2_10-28.1 References: https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1103276 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2433-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2433-1 Rating: moderate References: #1101688 #1101689 Cross-References: CVE-2018-1333 CVE-2018-8011 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache2 fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-1333: Fixed a worker exhaustion that could have lead to a denial of service via specially crafted HTTP/2 requests (bsc#1101689). - CVE-2018-8011: Fixed a null pointer dereference in mod_md, which could have lead to a denial of service via specially crafted HTTP requests (bsc#1101688). Note: We are currently not shipping this modules, since it is still considered experimental, but we might start to ship it with future releases. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-907=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.3.1 apache2-debuginfo-2.4.33-lp150.2.3.1 apache2-debugsource-2.4.33-lp150.2.3.1 apache2-devel-2.4.33-lp150.2.3.1 apache2-event-2.4.33-lp150.2.3.1 apache2-event-debuginfo-2.4.33-lp150.2.3.1 apache2-example-pages-2.4.33-lp150.2.3.1 apache2-prefork-2.4.33-lp150.2.3.1 apache2-prefork-debuginfo-2.4.33-lp150.2.3.1 apache2-utils-2.4.33-lp150.2.3.1 apache2-utils-debuginfo-2.4.33-lp150.2.3.1 apache2-worker-2.4.33-lp150.2.3.1 apache2-worker-debuginfo-2.4.33-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1333.html https://www.suse.com/security/cve/CVE-2018-8011.html https://bugzilla.suse.com/1101688 https://bugzilla.suse.com/1101689 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2431-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2431-1 Rating: moderate References: #1099793 Cross-References: CVE-2018-0500 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2018-0500: Fix a SMTP send heap buffer overflow (bsc#1099793). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-908=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.9.1 curl-debuginfo-7.60.0-lp150.2.9.1 curl-debugsource-7.60.0-lp150.2.9.1 curl-mini-7.60.0-lp150.2.9.1 curl-mini-debuginfo-7.60.0-lp150.2.9.1 curl-mini-debugsource-7.60.0-lp150.2.9.1 libcurl-devel-7.60.0-lp150.2.9.1 libcurl-mini-devel-7.60.0-lp150.2.9.1 libcurl4-7.60.0-lp150.2.9.1 libcurl4-debuginfo-7.60.0-lp150.2.9.1 libcurl4-mini-7.60.0-lp150.2.9.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.9.1 libcurl4-32bit-7.60.0-lp150.2.9.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-0500.html https://bugzilla.suse.com/1099793 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0