August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2375-1: important: Security update for python-Django1
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for python-Django1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2375-1 Rating: important References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django1 to version 1.11.15 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-875=1 Package List: - openSUSE Leap 15.0 (noarch): python2-Django1-1.11.15-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2373-1: important: Security update for nemo-extensions
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for nemo-extensions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2373-1 Rating: important References: #1084703 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for nemo-extensions fixes the following issues: The following security vulnerability was fixed: - Prevent unprivileged users from adding other users to sambashare (boo#1084703) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-874=1 Package List: - openSUSE Leap 15.0 (x86_64): nemo-extension-dropbox-3.6.0-lp150.2.3.1 nemo-extension-dropbox-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-fileroller-3.6.0-lp150.2.3.1 nemo-extension-fileroller-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-gtkhash-3.6.0-lp150.2.3.1 nemo-extension-gtkhash-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-image-converter-3.6.0-lp150.2.3.1 nemo-extension-image-converter-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-preview-3.6.0-lp150.2.3.1 nemo-extension-preview-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-repairer-3.6.0-lp150.2.3.1 nemo-extension-repairer-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-seahorse-3.6.0-lp150.2.3.1 nemo-extension-seahorse-debuginfo-3.6.0-lp150.2.3.1 nemo-extension-share-3.6.0-lp150.2.3.1 nemo-extension-share-debuginfo-3.6.0-lp150.2.3.1 nemo-extensions-debuginfo-3.6.0-lp150.2.3.1 nemo-extensions-debugsource-3.6.0-lp150.2.3.1 python-nemo-3.6.0-lp150.2.3.1 python-nemo-debuginfo-3.6.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): nemo-extension-audio-tab-3.6.0-lp150.2.3.1 nemo-extension-compare-3.6.0-lp150.2.3.1 nemo-extension-emblems-3.6.0-lp150.2.3.1 nemo-extension-pastebin-3.6.0-lp150.2.3.1 nemo-extension-rabbitvcs-3.6.0-lp150.2.3.1 nemo-extension-terminal-3.6.0-lp150.2.3.1 References: https://bugzilla.suse.com/1084703 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2343-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 16 Aug '18

16 Aug '18

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2343-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-868=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-868=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aubio-debugsource-0.4.1-9.9.1 aubio-tools-0.4.1-9.9.1 aubio-tools-debuginfo-0.4.1-9.9.1 libaubio-devel-0.4.1-9.9.1 libaubio4-0.4.1-9.9.1 libaubio4-debuginfo-0.4.1-9.9.1 - openSUSE Leap 42.3 (x86_64): libaubio4-32bit-0.4.1-9.9.1 libaubio4-debuginfo-32bit-0.4.1-9.9.1 - openSUSE Leap 15.0 (i586 x86_64): aubio-debugsource-0.4.6-lp150.3.6.1 aubio-tools-0.4.6-lp150.3.6.1 aubio-tools-debuginfo-0.4.6-lp150.3.6.1 libaubio-devel-0.4.6-lp150.3.6.1 libaubio5-0.4.6-lp150.3.6.1 libaubio5-debuginfo-0.4.6-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libaubio5-32bit-0.4.6-lp150.3.6.1 libaubio5-32bit-debuginfo-0.4.6-lp150.3.6.1 python-aubio-debugsource-0.4.6-lp150.3.6.1 python2-aubio-0.4.6-lp150.3.6.1 python2-aubio-debuginfo-0.4.6-lp150.3.6.1 python3-aubio-0.4.6-lp150.3.6.1 python3-aubio-debuginfo-0.4.6-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2330-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 15 Aug '18

15 Aug '18

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2330-1 Rating: important References: #1020631 #1062195 #1076907 #1077291 #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-5156 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr (boo#1098998). Security issues fixed with MFSA 2018-16 (boo#1098998): * CVE-2018-12359: Buffer overflow using computed size of canvas element * CVE-2018-12360: Use-after-free when using focus() * CVE-2018-12362: Integer overflow in SSSE3 scaler * CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture * CVE-2018-12363: Use-after-free when appending DOM nodes * CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins * CVE-2018-12365: Compromised IPC child process can list local filenames * CVE-2018-12366: Invalid data handling during QCMS transformations * CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Localizations finally included again (boo#1062195) Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with Update to Seamonkey 2.49.2 * Gecko 52.6esr (including security relevant fixes) (boo#1077291) * fix issue in Composer * With some themes, the menulist- and history-dropmarker didn't show * Scrollbars didn't show the buttons * WebRTC has been disabled by default. It needs an add-on to enable it per site * The active title bar was not visually emphasized Correct requires and provides handling (boo#1076907) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-867=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-867=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): seamonkey-2.49.4-13.3.2 seamonkey-debuginfo-2.49.4-13.3.2 seamonkey-debugsource-2.49.4-13.3.2 seamonkey-translations-common-2.49.4-13.3.2 seamonkey-translations-other-2.49.4-13.3.2 - openSUSE Leap 15.0 (x86_64): seamonkey-2.49.4-lp150.2.3.2 seamonkey-debuginfo-2.49.4-lp150.2.3.2 seamonkey-debugsource-2.49.4-lp150.2.3.2 seamonkey-translations-common-2.49.4-lp150.2.3.2 seamonkey-translations-other-2.49.4-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1020631 https://bugzilla.suse.com/1062195 https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1077291 https://bugzilla.suse.com/1098998 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2327-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 14 Aug '18

14 Aug '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2327-1 Rating: moderate References: #1102680 Cross-References: CVE-2018-14574 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django to 1.11.15 fixes the following issues: This security issue was fixed: - CVE-2018-14574: Prevent open redirect in django.middleware.common.CommonMiddleware (bsc#1102680). These non-security issues were fixed: - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression that could result in large memory usage when making edits using ModelAdmin.list_editable - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary - Fixed a regression where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns - Fixed a regression where an empty choice could be initially selected for the SelectMultiple and CheckboxSelectMultiple widgets Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-866=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Django-1.11.15-11.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2316-1: moderate: Security update for lxc
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2316-1 Rating: moderate References: #988348 Cross-References: CVE-2018-6556 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lxc fixes the following issues: The following security vulnerability was fixed: - CVE-2018-6556: Fixed an information leak and possible open() side effects to regular users via lxc-user-nic (boo#988348) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-865=1 Package List: - openSUSE Leap 15.0 (x86_64): liblxc-devel-2.0.9-lp150.2.6.1 liblxc1-2.0.9-lp150.2.6.1 liblxc1-debuginfo-2.0.9-lp150.2.6.1 lxc-2.0.9-lp150.2.6.1 lxc-debuginfo-2.0.9-lp150.2.6.1 lxc-debugsource-2.0.9-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-6556.html https://bugzilla.suse.com/988348 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2313-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2313-1 Rating: moderate References: #1103799 Cross-References: CVE-2018-14912 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cgit to version 1.2.1 fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off (boo#1103799) The following other changes were made: - Update to upstream release 1.2.1: - syntax-highlighting: replace invalid unicode with '?' - ui-repolist: properly sort by age - ui-patch: fix crash when using path limit - Update bundled git to 2.11.1 - Update to upstream release 1.0: * Add repo.homepage/gitweb.homepage setting and homepage tab. * Show reverse paths in title bar so that browser tab shows filename. * Allow redirects even when caching is turned on. * More gracefully deal with unparsable commits. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-864=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cgit-1.2.1-13.3.1 cgit-debuginfo-1.2.1-13.3.1 cgit-debugsource-1.2.1-13.3.1 References: https://www.suse.com/security/cve/CVE-2018-14912.html https://bugzilla.suse.com/1103799 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2310-1: moderate: Security update for sddm
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2310-1 Rating: moderate References: #1099908 #1101450 Cross-References: CVE-2018-14345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sddm fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14345: Fixed the authentication, which did not check the password for users with an already existing session and allowed any user with access to the system bus to unlock any graphical session. (boo#1101450) The following other bugs were addressed: - Fallback to embedded theme, if none is set - Corrected section name for Wayland - Removed patch, which is no longer needed, because bug in libxcb was fixed in the meanwhile (boo#1099908) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-862=1 Package List: - openSUSE Leap 15.0 (x86_64): sddm-0.17.0-lp150.9.3.1 sddm-branding-openSUSE-0.17.0-lp150.9.3.1 sddm-branding-upstream-0.17.0-lp150.9.3.1 sddm-debuginfo-0.17.0-lp150.9.3.1 sddm-debugsource-0.17.0-lp150.9.3.1 References: https://www.suse.com/security/cve/CVE-2018-14345.html https://bugzilla.suse.com/1099908 https://bugzilla.suse.com/1101450 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2309-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2309-1 Rating: moderate References: #1101288 Cross-References: CVE-2018-13796 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2018-13796: Fix a content spoofing vulnerability with invalid list name messages inside the web UI (boo#1101288). Bug fixes: - update to 2.1.29: * Fixed the listinfo and admin overview pages that were broken - update to 2.1.28: * It is now possible to edit HTML and text templates via the web admin UI in a supported language other than the list's preferred_language. * The Japanese translation has been updated * The German translation has been updated * The Esperanto translation has been updated * The BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE feature added in 2.1.27 was not working. This is fixed. * Escaping of HTML entities for the web UI is now done more selectively. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-861=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-861=1 Package List: - openSUSE Leap 42.3 (x86_64): mailman-2.1.29-2.11.2 mailman-debuginfo-2.1.29-2.11.2 mailman-debugsource-2.1.29-2.11.2 - openSUSE Leap 15.0 (x86_64): mailman-2.1.29-lp150.2.8.1 mailman-debuginfo-2.1.29-lp150.2.8.1 mailman-debugsource-2.1.29-lp150.2.8.1 References: https://www.suse.com/security/cve/CVE-2018-13796.html https://bugzilla.suse.com/1101288 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2308-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2308-1 Rating: moderate References: #1103799 Cross-References: CVE-2018-14912 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cgit fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off (boo#1103799) The following other changes were made: - Update to upstream release 1.2.1 * syntax-highlighting: replace invalid unicode with '?' * ui-repolist: properly sort by age * ui-patch: fix crash when using path limit Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-863=1 Package List: - openSUSE Leap 15.0 (x86_64): cgit-1.2.1-lp150.2.3.1 cgit-debuginfo-1.2.1-lp150.2.3.1 cgit-debugsource-1.2.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14912.html https://bugzilla.suse.com/1103799 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0