August 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2184-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2184-1 Rating: moderate References: #1101776 #1101777 #1101786 #1101788 #1101791 #1101794 #1101800 #1101802 #1101804 #1101810 Cross-References: CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14367 CVE-2018-14368 CVE-2018-14369 CVE-2018-14370 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, boo#1101777) - CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, boo#1101788) - CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, boo#1101804) - CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, boo#1101786) - CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, boo#1101810) - CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, boo#1101776) - CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, boo#1101794) - CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, boo#1101800) - CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, boo#1101791) - CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, boo#1101802) Bug fixes: - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.8.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-793=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.8-lp150.2.6.1 libwireshark9-debuginfo-2.4.8-lp150.2.6.1 libwiretap7-2.4.8-lp150.2.6.1 libwiretap7-debuginfo-2.4.8-lp150.2.6.1 libwscodecs1-2.4.8-lp150.2.6.1 libwscodecs1-debuginfo-2.4.8-lp150.2.6.1 libwsutil8-2.4.8-lp150.2.6.1 libwsutil8-debuginfo-2.4.8-lp150.2.6.1 wireshark-2.4.8-lp150.2.6.1 wireshark-debuginfo-2.4.8-lp150.2.6.1 wireshark-debugsource-2.4.8-lp150.2.6.1 wireshark-devel-2.4.8-lp150.2.6.1 wireshark-ui-qt-2.4.8-lp150.2.6.1 wireshark-ui-qt-debuginfo-2.4.8-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-14339.html https://www.suse.com/security/cve/CVE-2018-14340.html https://www.suse.com/security/cve/CVE-2018-14341.html https://www.suse.com/security/cve/CVE-2018-14342.html https://www.suse.com/security/cve/CVE-2018-14343.html https://www.suse.com/security/cve/CVE-2018-14344.html https://www.suse.com/security/cve/CVE-2018-14367.html https://www.suse.com/security/cve/CVE-2018-14368.html https://www.suse.com/security/cve/CVE-2018-14369.html https://www.suse.com/security/cve/CVE-2018-14370.html https://bugzilla.suse.com/1101776 https://bugzilla.suse.com/1101777 https://bugzilla.suse.com/1101786 https://bugzilla.suse.com/1101788 https://bugzilla.suse.com/1101791 https://bugzilla.suse.com/1101794 https://bugzilla.suse.com/1101800 https://bugzilla.suse.com/1101802 https://bugzilla.suse.com/1101804 https://bugzilla.suse.com/1101810 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2180-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2180-1 Rating: moderate References: #1100694 Cross-References: CVE-2018-1000613 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following issues: Security issue fixed: - CVE-2018-1000613: Fix use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (boo#1100694). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-794=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.60-23.7.1 bouncycastle-javadoc-1.60-23.7.1 References: https://www.suse.com/security/cve/CVE-2018-1000613.html https://bugzilla.suse.com/1100694 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2178-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2178-1 Rating: moderate References: #1064455 #1090766 #1097410 Cross-References: CVE-2018-0495 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libgcrypt fixes the following issues: The following security vulnerability was addressed: - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures (bsc#1097410). The following other issues were fixed: - Extended the fipsdrv dsa-sign and dsa-verify commands with the --algo parameter for the FIPS testing of DSA SigVer and SigGen (bsc#1064455). - Ensure libgcrypt20-hmac and libgcrypt20 are installed in the correct order. (bsc#1090766) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-795=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgcrypt-cavs-1.6.1-45.1 libgcrypt-cavs-debuginfo-1.6.1-45.1 libgcrypt-debugsource-1.6.1-45.1 libgcrypt-devel-1.6.1-45.1 libgcrypt-devel-debuginfo-1.6.1-45.1 libgcrypt20-1.6.1-45.1 libgcrypt20-debuginfo-1.6.1-45.1 libgcrypt20-hmac-1.6.1-45.1 - openSUSE Leap 42.3 (x86_64): libgcrypt-devel-32bit-1.6.1-45.1 libgcrypt-devel-debuginfo-32bit-1.6.1-45.1 libgcrypt20-32bit-1.6.1-45.1 libgcrypt20-debuginfo-32bit-1.6.1-45.1 libgcrypt20-hmac-32bit-1.6.1-45.1 References: https://www.suse.com/security/cve/CVE-2018-0495.html https://bugzilla.suse.com/1064455 https://bugzilla.suse.com/1090766 https://bugzilla.suse.com/1097410 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2166-1: moderate: Security update for rsyslog
by opensuse-security＠opensuse.org 01 Aug '18

01 Aug '18

openSUSE Security Update: Security update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2166-1 Rating: moderate References: #935393 Cross-References: CVE-2015-3243 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsyslog fixes the following issues: The following security vulnerability was addressed: CVE-2015-3243: Make sure that log files are not created world-readable (bsc#935393) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-789=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): rsyslog-8.24.0-2.3.1 rsyslog-debuginfo-8.24.0-2.3.1 rsyslog-debugsource-8.24.0-2.3.1 rsyslog-diag-tools-8.24.0-2.3.1 rsyslog-diag-tools-debuginfo-8.24.0-2.3.1 rsyslog-doc-8.24.0-2.3.1 rsyslog-module-dbi-8.24.0-2.3.1 rsyslog-module-dbi-debuginfo-8.24.0-2.3.1 rsyslog-module-elasticsearch-8.24.0-2.3.1 rsyslog-module-elasticsearch-debuginfo-8.24.0-2.3.1 rsyslog-module-gcrypt-8.24.0-2.3.1 rsyslog-module-gcrypt-debuginfo-8.24.0-2.3.1 rsyslog-module-gssapi-8.24.0-2.3.1 rsyslog-module-gssapi-debuginfo-8.24.0-2.3.1 rsyslog-module-gtls-8.24.0-2.3.1 rsyslog-module-gtls-debuginfo-8.24.0-2.3.1 rsyslog-module-guardtime-8.24.0-2.3.1 rsyslog-module-guardtime-debuginfo-8.24.0-2.3.1 rsyslog-module-mmnormalize-8.24.0-2.3.1 rsyslog-module-mmnormalize-debuginfo-8.24.0-2.3.1 rsyslog-module-mysql-8.24.0-2.3.1 rsyslog-module-mysql-debuginfo-8.24.0-2.3.1 rsyslog-module-omamqp1-8.24.0-2.3.1 rsyslog-module-omamqp1-debuginfo-8.24.0-2.3.1 rsyslog-module-omhttpfs-8.24.0-2.3.1 rsyslog-module-omhttpfs-debuginfo-8.24.0-2.3.1 rsyslog-module-omtcl-8.24.0-2.3.1 rsyslog-module-omtcl-debuginfo-8.24.0-2.3.1 rsyslog-module-pgsql-8.24.0-2.3.1 rsyslog-module-pgsql-debuginfo-8.24.0-2.3.1 rsyslog-module-relp-8.24.0-2.3.1 rsyslog-module-relp-debuginfo-8.24.0-2.3.1 rsyslog-module-snmp-8.24.0-2.3.1 rsyslog-module-snmp-debuginfo-8.24.0-2.3.1 rsyslog-module-udpspoof-8.24.0-2.3.1 rsyslog-module-udpspoof-debuginfo-8.24.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-3243.html https://bugzilla.suse.com/935393 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2159-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 01 Aug '18

01 Aug '18

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2159-1 Rating: moderate References: #1082318 #1092877 #1094150 #1094154 #1094161 Cross-References: CVE-2017-18269 CVE-2018-11236 CVE-2018-11237 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for glibc fixes the following security issues: - CVE-2017-18269: An SSE2-optimized memmove implementation for i386 did not correctly perform the overlapping memory check if the source memory range spaned the middle of the address space, resulting in corrupt data being produced by the copy operation. This may have disclosed information to context-dependent attackers, resulted in a denial of service or code execution (bsc#1094150). - CVE-2018-11236: Prevent integer overflow on 32-bit architectures when processing very long pathname arguments to the realpath function, leading to a stack-based buffer overflow (bsc#1094161). - CVE-2018-11237: An AVX-512-optimized implementation of the mempcpy function may have writen data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper (bsc#1092877, bsc#1094154). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-788=1 Package List: - openSUSE Leap 15.0 (i586 i686 x86_64): glibc-2.26-lp150.11.6.120 glibc-debuginfo-2.26-lp150.11.6.120 glibc-debugsource-2.26-lp150.11.6.120 glibc-devel-2.26-lp150.11.6.120 glibc-devel-debuginfo-2.26-lp150.11.6.120 glibc-devel-static-2.26-lp150.11.6.120 glibc-locale-2.26-lp150.11.6.120 glibc-locale-debuginfo-2.26-lp150.11.6.120 glibc-profile-2.26-lp150.11.6.120 - openSUSE Leap 15.0 (i586 x86_64): glibc-extra-2.26-lp150.11.6.120 glibc-extra-debuginfo-2.26-lp150.11.6.120 glibc-utils-2.26-lp150.11.6.120 glibc-utils-debuginfo-2.26-lp150.11.6.120 glibc-utils-src-debugsource-2.26-lp150.11.6.120 nscd-2.26-lp150.11.6.120 nscd-debuginfo-2.26-lp150.11.6.120 - openSUSE Leap 15.0 (x86_64): glibc-32bit-2.26-lp150.11.6.120 glibc-32bit-debuginfo-2.26-lp150.11.6.120 glibc-devel-32bit-2.26-lp150.11.6.120 glibc-devel-32bit-debuginfo-2.26-lp150.11.6.120 glibc-devel-static-32bit-2.26-lp150.11.6.120 glibc-locale-32bit-2.26-lp150.11.6.120 glibc-locale-32bit-debuginfo-2.26-lp150.11.6.120 glibc-profile-32bit-2.26-lp150.11.6.120 glibc-utils-32bit-2.26-lp150.11.6.120 glibc-utils-32bit-debuginfo-2.26-lp150.11.6.120 - openSUSE Leap 15.0 (noarch): glibc-html-2.26-lp150.11.6.120 glibc-i18ndata-2.26-lp150.11.6.120 glibc-info-2.26-lp150.11.6.120 References: https://www.suse.com/security/cve/CVE-2017-18269.html https://www.suse.com/security/cve/CVE-2018-11236.html https://www.suse.com/security/cve/CVE-2018-11237.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1092877 https://bugzilla.suse.com/1094150 https://bugzilla.suse.com/1094154 https://bugzilla.suse.com/1094161 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0