August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2213-1: moderate: Security update for python-dulwich
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for python-dulwich ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2213-1 Rating: moderate References: #1066430 Cross-References: CVE-2017-16228 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-dulwich to version 0.18.5 fixes this security issue: - CVE-2017-16228: Dulwich, when an SSH subprocess is used, allowed remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname (bsc#1066430). For detailed changes please see https://www.dulwich.io/code/dulwich/ This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-801=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): python-dulwich-0.18.5-11.1 python-dulwich-debuginfo-0.18.5-11.1 python-dulwich-debugsource-0.18.5-11.1 References: https://www.suse.com/security/cve/CVE-2017-16228.html https://bugzilla.suse.com/1066430 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2212-1: important: Security update for mutt
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2212-1 Rating: important References: #1094717 #1101428 #1101566 #1101567 #1101568 #1101569 #1101570 #1101571 #1101573 #1101576 #1101577 #1101578 #1101581 #1101582 #1101583 #1101588 #1101589 Cross-References: CVE-2014-9116 CVE-2018-14349 CVE-2018-14350 CVE-2018-14351 CVE-2018-14352 CVE-2018-14353 CVE-2018-14354 CVE-2018-14355 CVE-2018-14356 CVE-2018-14357 CVE-2018-14358 CVE-2018-14359 CVE-2018-14360 CVE-2018-14361 CVE-2018-14362 CVE-2018-14363 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has one errata is now available. Description: This update for mutt fixes the following issues: Security issues fixed: - bsc#1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583). - CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581). - CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567). - CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578). - CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582). - CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576). - CVE-2018-14355: Fix imap/util.c that mishandles ".." directory traversal in a mailbox name (bsc#1101577). - CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589). - CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588). - CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566). - CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570). - CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571). - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569). - CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573). - CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568). Bug fixes: - mutt reports as neomutt and incorrect version (bsc#1094717) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-809=1 Package List: - openSUSE Leap 15.0 (noarch): mutt-doc-1.10.1-lp150.2.3.1 mutt-lang-1.10.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): mutt-1.10.1-lp150.2.3.1 mutt-debuginfo-1.10.1-lp150.2.3.1 mutt-debugsource-1.10.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2014-9116.html https://www.suse.com/security/cve/CVE-2018-14349.html https://www.suse.com/security/cve/CVE-2018-14350.html https://www.suse.com/security/cve/CVE-2018-14351.html https://www.suse.com/security/cve/CVE-2018-14352.html https://www.suse.com/security/cve/CVE-2018-14353.html https://www.suse.com/security/cve/CVE-2018-14354.html https://www.suse.com/security/cve/CVE-2018-14355.html https://www.suse.com/security/cve/CVE-2018-14356.html https://www.suse.com/security/cve/CVE-2018-14357.html https://www.suse.com/security/cve/CVE-2018-14358.html https://www.suse.com/security/cve/CVE-2018-14359.html https://www.suse.com/security/cve/CVE-2018-14360.html https://www.suse.com/security/cve/CVE-2018-14361.html https://www.suse.com/security/cve/CVE-2018-14362.html https://www.suse.com/security/cve/CVE-2018-14363.html https://bugzilla.suse.com/1094717 https://bugzilla.suse.com/1101428 https://bugzilla.suse.com/1101566 https://bugzilla.suse.com/1101567 https://bugzilla.suse.com/1101568 https://bugzilla.suse.com/1101569 https://bugzilla.suse.com/1101570 https://bugzilla.suse.com/1101571 https://bugzilla.suse.com/1101573 https://bugzilla.suse.com/1101576 https://bugzilla.suse.com/1101577 https://bugzilla.suse.com/1101578 https://bugzilla.suse.com/1101581 https://bugzilla.suse.com/1101582 https://bugzilla.suse.com/1101583 https://bugzilla.suse.com/1101588 https://bugzilla.suse.com/1101589 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2211-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2211-1 Rating: moderate References: #1027519 #1087289 #1095242 #1096224 #1097521 #1097522 #1097523 Cross-References: CVE-2018-11806 CVE-2018-12891 CVE-2018-12892 CVE-2018-12893 CVE-2018-3665 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for xen fixes the following issues: Security issues fixed: - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). Bug fixes: - bsc#1027519: Add upstream patches from January. - bsc#1087289: Fix xen scheduler crash. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-803=1 Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.2_08-25.2 xen-debugsource-4.9.2_08-25.2 xen-devel-4.9.2_08-25.2 xen-doc-html-4.9.2_08-25.2 xen-libs-4.9.2_08-25.2 xen-libs-debuginfo-4.9.2_08-25.2 xen-tools-4.9.2_08-25.2 xen-tools-debuginfo-4.9.2_08-25.2 xen-tools-domU-4.9.2_08-25.2 xen-tools-domU-debuginfo-4.9.2_08-25.2 References: https://www.suse.com/security/cve/CVE-2018-11806.html https://www.suse.com/security/cve/CVE-2018-12891.html https://www.suse.com/security/cve/CVE-2018-12892.html https://www.suse.com/security/cve/CVE-2018-12893.html https://www.suse.com/security/cve/CVE-2018-3665.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1087289 https://bugzilla.suse.com/1095242 https://bugzilla.suse.com/1096224 https://bugzilla.suse.com/1097521 https://bugzilla.suse.com/1097522 https://bugzilla.suse.com/1097523 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2210-1: Security update for nautilus
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for nautilus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2210-1 Rating: low References: #1060031 Cross-References: CVE-2017-14604 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nautilus fixes the following issues: Security issue fixed: - CVE-2017-14604: Add a metadata::trusted metadata to the file once the user acknowledges the file as trusted, and also remove the "trusted" content in the desktop file (bsc#1060031). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-802=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnome-shell-search-provider-nautilus-3.20.3-8.3.1 libnautilus-extension1-3.20.3-8.3.1 libnautilus-extension1-debuginfo-3.20.3-8.3.1 nautilus-3.20.3-8.3.1 nautilus-debuginfo-3.20.3-8.3.1 nautilus-debugsource-3.20.3-8.3.1 nautilus-devel-3.20.3-8.3.1 typelib-1_0-Nautilus-3_0-3.20.3-8.3.1 - openSUSE Leap 42.3 (x86_64): libnautilus-extension1-32bit-3.20.3-8.3.1 libnautilus-extension1-debuginfo-32bit-3.20.3-8.3.1 - openSUSE Leap 42.3 (noarch): nautilus-lang-3.20.3-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-14604.html https://bugzilla.suse.com/1060031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2209-1: moderate: Security update for libsndfile
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2209-1 Rating: moderate References: #1071767 #1071777 #1100167 Cross-References: CVE-2017-17456 CVE-2017-17457 CVE-2018-13139 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libsndfile fixes the following issues: Security issues fixed: - CVE-2018-13139: Fix a stack-based buffer overflow in psf_memset in common.c that allows remote attackers to cause a denial of service (bsc#1100167). - CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777) - CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-806=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsndfile-debugsource-1.0.28-lp150.3.3.1 libsndfile-devel-1.0.28-lp150.3.3.1 libsndfile1-1.0.28-lp150.3.3.1 libsndfile1-debuginfo-1.0.28-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libsndfile-progs-1.0.28-lp150.3.3.1 libsndfile-progs-debuginfo-1.0.28-lp150.3.3.1 libsndfile-progs-debugsource-1.0.28-lp150.3.3.1 libsndfile1-32bit-1.0.28-lp150.3.3.1 libsndfile1-32bit-debuginfo-1.0.28-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-17456.html https://www.suse.com/security/cve/CVE-2017-17457.html https://www.suse.com/security/cve/CVE-2018-13139.html https://bugzilla.suse.com/1071767 https://bugzilla.suse.com/1071777 https://bugzilla.suse.com/1100167 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2208-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2208-1 Rating: moderate References: #1094289 Cross-References: CVE-2018-0739 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094289). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-807=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.3.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.3.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-0739.html https://bugzilla.suse.com/1094289 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2206-1: important: Security update for java-10-openjdk
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for java-10-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2206-1 Rating: important References: #1096420 #1101645 #1101651 #1101655 #1101656 Cross-References: CVE-2018-2940 CVE-2018-2952 CVE-2018-2972 CVE-2018-2973 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for OpenJDK 10.0.2 fixes the following security issues: - CVE-2018-2940: the libraries sub-component contained an easily exploitable vulnerability that allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining unauthorized read access to data that's accessible to the server. [bsc#1101645] - CVE-2018-2952: the concurrency sub-component contained a difficult to exploit vulnerability that allowed attackers to compromise Java SE, Java SE Embedded, or JRockit over the network. This issue could have been abused to mount a partial denial-of-service attack on the server. [bsc#1101651] - CVE-2018-2972: the security sub-component contained a difficult to exploit vulnerability that allowed attackers to compromise Java SE over the network, potentially gaining unauthorized access to critical data or complete access to all Java SE accessible data. [bsc#1101655) - CVE-2018-2973: the JSSE sub-component contained a difficult to exploit vulnerability allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining the ability to create, delete or modify critical data or all Java SE, Java SE Embedded accessible data without authorization. [bsc#1101656] Furthemore, the following bugs were fixed: - Properly remove the existing alternative for java before reinstalling it. [bsc#1096420] - idlj was moved to the *-devel package. [bsc#1096420] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-810=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-10-openjdk-10.0.2.0-lp150.2.3.2 java-10-openjdk-accessibility-10.0.2.0-lp150.2.3.2 java-10-openjdk-accessibility-debuginfo-10.0.2.0-lp150.2.3.2 java-10-openjdk-debuginfo-10.0.2.0-lp150.2.3.2 java-10-openjdk-debugsource-10.0.2.0-lp150.2.3.2 java-10-openjdk-demo-10.0.2.0-lp150.2.3.2 java-10-openjdk-devel-10.0.2.0-lp150.2.3.2 java-10-openjdk-headless-10.0.2.0-lp150.2.3.2 java-10-openjdk-jmods-10.0.2.0-lp150.2.3.2 java-10-openjdk-src-10.0.2.0-lp150.2.3.2 - openSUSE Leap 15.0 (noarch): java-10-openjdk-javadoc-10.0.2.0-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-2940.html https://www.suse.com/security/cve/CVE-2018-2952.html https://www.suse.com/security/cve/CVE-2018-2972.html https://www.suse.com/security/cve/CVE-2018-2973.html https://bugzilla.suse.com/1096420 https://bugzilla.suse.com/1101645 https://bugzilla.suse.com/1101651 https://bugzilla.suse.com/1101655 https://bugzilla.suse.com/1101656 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2205-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2205-1 Rating: moderate References: #1084300 Cross-References: CVE-2018-7738 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for util-linux fixes the following security issue: - CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name (bsc#1084300) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-811=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libblkid-devel-2.31.1-lp150.7.6.1 libblkid-devel-static-2.31.1-lp150.7.6.1 libblkid1-2.31.1-lp150.7.6.1 libblkid1-debuginfo-2.31.1-lp150.7.6.1 libfdisk-devel-2.31.1-lp150.7.6.1 libfdisk-devel-static-2.31.1-lp150.7.6.1 libfdisk1-2.31.1-lp150.7.6.1 libfdisk1-debuginfo-2.31.1-lp150.7.6.1 libmount-devel-2.31.1-lp150.7.6.1 libmount-devel-static-2.31.1-lp150.7.6.1 libmount1-2.31.1-lp150.7.6.1 libmount1-debuginfo-2.31.1-lp150.7.6.1 libsmartcols-devel-2.31.1-lp150.7.6.1 libsmartcols-devel-static-2.31.1-lp150.7.6.1 libsmartcols1-2.31.1-lp150.7.6.1 libsmartcols1-debuginfo-2.31.1-lp150.7.6.1 libuuid-devel-2.31.1-lp150.7.6.1 libuuid-devel-static-2.31.1-lp150.7.6.1 libuuid1-2.31.1-lp150.7.6.1 libuuid1-debuginfo-2.31.1-lp150.7.6.1 util-linux-2.31.1-lp150.7.6.1 util-linux-debuginfo-2.31.1-lp150.7.6.1 util-linux-debugsource-2.31.1-lp150.7.6.1 util-linux-systemd-2.31.1-lp150.7.6.1 util-linux-systemd-debuginfo-2.31.1-lp150.7.6.1 util-linux-systemd-debugsource-2.31.1-lp150.7.6.1 uuidd-2.31.1-lp150.7.6.1 uuidd-debuginfo-2.31.1-lp150.7.6.1 - openSUSE Leap 15.0 (noarch): util-linux-lang-2.31.1-lp150.7.6.1 - openSUSE Leap 15.0 (x86_64): libblkid-devel-32bit-2.31.1-lp150.7.6.1 libblkid1-32bit-2.31.1-lp150.7.6.1 libblkid1-32bit-debuginfo-2.31.1-lp150.7.6.1 libmount-devel-32bit-2.31.1-lp150.7.6.1 libmount1-32bit-2.31.1-lp150.7.6.1 libmount1-32bit-debuginfo-2.31.1-lp150.7.6.1 libuuid-devel-32bit-2.31.1-lp150.7.6.1 libuuid1-32bit-2.31.1-lp150.7.6.1 libuuid1-32bit-debuginfo-2.31.1-lp150.7.6.1 python-libmount-2.31.1-lp150.7.6.1 python-libmount-debuginfo-2.31.1-lp150.7.6.1 python-libmount-debugsource-2.31.1-lp150.7.6.1 References: https://www.suse.com/security/cve/CVE-2018-7738.html https://bugzilla.suse.com/1084300 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2203-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2203-1 Rating: moderate References: #1072947 #1078662 #1080740 #1084300 Cross-References: CVE-2018-7738 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for util-linux fixes the following issues: This non-security issue was fixed: - CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300). These non-security issues were fixed: - Fixed crash loop in lscpu (bsc#1072947). - Fixed possible segfault of umount -a - Fixed mount -a on NFS bind mounts (bsc#1080740). - Fixed lsblk on NVMe (bsc#1078662). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-805=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libblkid-devel-2.29.2-8.1 libblkid-devel-static-2.29.2-8.1 libblkid1-2.29.2-8.1 libblkid1-debuginfo-2.29.2-8.1 libfdisk-devel-2.29.2-8.1 libfdisk-devel-static-2.29.2-8.1 libfdisk1-2.29.2-8.1 libfdisk1-debuginfo-2.29.2-8.1 libmount-devel-2.29.2-8.1 libmount-devel-static-2.29.2-8.1 libmount1-2.29.2-8.1 libmount1-debuginfo-2.29.2-8.1 libsmartcols-devel-2.29.2-8.1 libsmartcols-devel-static-2.29.2-8.1 libsmartcols1-2.29.2-8.1 libsmartcols1-debuginfo-2.29.2-8.1 libuuid-devel-2.29.2-8.1 libuuid-devel-static-2.29.2-8.1 libuuid1-2.29.2-8.1 libuuid1-debuginfo-2.29.2-8.1 python-libmount-2.29.2-8.1 python-libmount-debuginfo-2.29.2-8.1 python-libmount-debugsource-2.29.2-8.1 util-linux-2.29.2-8.1 util-linux-debuginfo-2.29.2-8.1 util-linux-debugsource-2.29.2-8.1 util-linux-systemd-2.29.2-8.1 util-linux-systemd-debuginfo-2.29.2-8.1 util-linux-systemd-debugsource-2.29.2-8.1 uuidd-2.29.2-8.1 uuidd-debuginfo-2.29.2-8.1 - openSUSE Leap 42.3 (x86_64): libblkid-devel-32bit-2.29.2-8.1 libblkid1-32bit-2.29.2-8.1 libblkid1-debuginfo-32bit-2.29.2-8.1 libmount-devel-32bit-2.29.2-8.1 libmount1-32bit-2.29.2-8.1 libmount1-debuginfo-32bit-2.29.2-8.1 libuuid-devel-32bit-2.29.2-8.1 libuuid1-32bit-2.29.2-8.1 libuuid1-debuginfo-32bit-2.29.2-8.1 - openSUSE Leap 42.3 (noarch): util-linux-lang-2.29.2-8.1 References: https://www.suse.com/security/cve/CVE-2018-7738.html https://bugzilla.suse.com/1072947 https://bugzilla.suse.com/1078662 https://bugzilla.suse.com/1080740 https://bugzilla.suse.com/1084300 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2188-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2188-1 Rating: moderate References: #1082692 #1101776 #1101777 #1101786 #1101788 #1101794 #1101800 #1101804 #1101810 Cross-References: CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14368 CVE-2018-14369 CVE-2018-7325 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-7325: RPKI-Router infinite loop (boo#1082692) - CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, boo#1101777) - CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, boo#1101788) - CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, boo#1101804) - CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, boo#1101786) - CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, boo#1101810) - CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, boo#1101776) - CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, boo#1101794) - CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, boo#1101800) Bug fixes: - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.16.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-792=1 Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.16-44.1 wireshark-debuginfo-2.2.16-44.1 wireshark-debugsource-2.2.16-44.1 wireshark-devel-2.2.16-44.1 wireshark-ui-gtk-2.2.16-44.1 wireshark-ui-gtk-debuginfo-2.2.16-44.1 wireshark-ui-qt-2.2.16-44.1 wireshark-ui-qt-debuginfo-2.2.16-44.1 References: https://www.suse.com/security/cve/CVE-2018-14339.html https://www.suse.com/security/cve/CVE-2018-14340.html https://www.suse.com/security/cve/CVE-2018-14341.html https://www.suse.com/security/cve/CVE-2018-14342.html https://www.suse.com/security/cve/CVE-2018-14343.html https://www.suse.com/security/cve/CVE-2018-14344.html https://www.suse.com/security/cve/CVE-2018-14368.html https://www.suse.com/security/cve/CVE-2018-14369.html https://www.suse.com/security/cve/CVE-2018-7325.html https://bugzilla.suse.com/1082692 https://bugzilla.suse.com/1101776 https://bugzilla.suse.com/1101777 https://bugzilla.suse.com/1101786 https://bugzilla.suse.com/1101788 https://bugzilla.suse.com/1101794 https://bugzilla.suse.com/1101800 https://bugzilla.suse.com/1101804 https://bugzilla.suse.com/1101810 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0