September 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2859-1: moderate: Security update for php5-smarty3
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for php5-smarty3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2859-1 Rating: moderate References: #1108741 Cross-References: CVE-2018-16381 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5-smarty3 fixes the following issues: - CVE-2018-16381: Prevent traversal vulnerability due to insufficient template code sanitization that allowed attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files (bsc#1108741). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1052=1 Package List: - openSUSE Leap 42.3 (noarch): php5-smarty3-3.1.33-5.5.1 php5-smarty3-doc-3.1.33-5.5.1 References: https://www.suse.com/security/cve/CVE-2018-16381.html https://bugzilla.suse.com/1108741 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2856-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2856-1 Rating: moderate References: #1016715 #1104826 Cross-References: CVE-2016-4975 CVE-2016-8743 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715) - CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the "Location" or other outbound header key or value. (bsc#1104826) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1046=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-28.1 apache2-debuginfo-2.4.23-28.1 apache2-debugsource-2.4.23-28.1 apache2-devel-2.4.23-28.1 apache2-event-2.4.23-28.1 apache2-event-debuginfo-2.4.23-28.1 apache2-example-pages-2.4.23-28.1 apache2-prefork-2.4.23-28.1 apache2-prefork-debuginfo-2.4.23-28.1 apache2-utils-2.4.23-28.1 apache2-utils-debuginfo-2.4.23-28.1 apache2-worker-2.4.23-28.1 apache2-worker-debuginfo-2.4.23-28.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-28.1 References: https://www.suse.com/security/cve/CVE-2016-4975.html https://www.suse.com/security/cve/CVE-2016-8743.html https://bugzilla.suse.com/1016715 https://bugzilla.suse.com/1104826 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2855-1: moderate: Security update for nodejs8
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2855-1 Rating: moderate References: #1097158 #1097748 #1105019 Cross-References: CVE-2018-0732 CVE-2018-12115 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nodejs8 to version 8.11.4 fixes the following issues: Security issues fixed: - CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer (bsc#1105019) - Upgrade to OpenSSL 1.0.2p, which fixed: - CVE-2018-0732: Client denial-of-service due to large DH parameter (bsc#1097158) - ECDSA key extraction via local side-channel Other changes made: - Recommend same major version npm package (bsc#1097748) - Fix parallel/test-tls-passphrase.js test to continue to function with older versions of OpenSSL library. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1047=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): nodejs8-8.11.4-lp150.2.6.1 nodejs8-debuginfo-8.11.4-lp150.2.6.1 nodejs8-debugsource-8.11.4-lp150.2.6.1 nodejs8-devel-8.11.4-lp150.2.6.1 npm8-8.11.4-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): nodejs8-docs-8.11.4-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-12115.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097748 https://bugzilla.suse.com/1105019 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2854-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2854-1 Rating: moderate References: #1047002 #1105437 #1105459 #1105460 Cross-References: CVE-2017-10790 CVE-2018-10844 CVE-2018-10845 CVE-2018-10846 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - CVE-2018-10846: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery (bsc#1105460) - CVE-2018-10845: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant (bsc#1105459) - CVE-2018-10844: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls (bsc#1105437) - CVE-2017-10790: The _asn1_check_identifier function in Libtasn1 caused a NULL pointer dereference and crash (bsc#1047002) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1049=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnutls-3.3.27-2.3.1 gnutls-debuginfo-3.3.27-2.3.1 gnutls-debugsource-3.3.27-2.3.1 libgnutls-devel-3.3.27-2.3.1 libgnutls-openssl-devel-3.3.27-2.3.1 libgnutls-openssl27-3.3.27-2.3.1 libgnutls-openssl27-debuginfo-3.3.27-2.3.1 libgnutls28-3.3.27-2.3.1 libgnutls28-debuginfo-3.3.27-2.3.1 libgnutlsxx-devel-3.3.27-2.3.1 libgnutlsxx28-3.3.27-2.3.1 libgnutlsxx28-debuginfo-3.3.27-2.3.1 - openSUSE Leap 42.3 (x86_64): libgnutls-devel-32bit-3.3.27-2.3.1 libgnutls28-32bit-3.3.27-2.3.1 libgnutls28-debuginfo-32bit-3.3.27-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-10790.html https://www.suse.com/security/cve/CVE-2018-10844.html https://www.suse.com/security/cve/CVE-2018-10845.html https://www.suse.com/security/cve/CVE-2018-10846.html https://bugzilla.suse.com/1047002 https://bugzilla.suse.com/1105437 https://bugzilla.suse.com/1105459 https://bugzilla.suse.com/1105460 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2852-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2852-1 Rating: moderate References: #1106914 Cross-References: CVE-2018-16588 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadow fixes the following security issue: - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 (bsc#1106914) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1051=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): shadow-4.5-lp150.6.3.1 shadow-debuginfo-4.5-lp150.6.3.1 shadow-debugsource-4.5-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-16588.html https://bugzilla.suse.com/1106914 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2851-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2851-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1048=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-27.1 gd-debuginfo-2.1.0-27.1 gd-debugsource-2.1.0-27.1 gd-devel-2.1.0-27.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-27.1 gd-debuginfo-32bit-2.1.0-27.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2849-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2849-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1050=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.12.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.12.1 php7-7.2.5-lp150.2.12.1 php7-bcmath-7.2.5-lp150.2.12.1 php7-bcmath-debuginfo-7.2.5-lp150.2.12.1 php7-bz2-7.2.5-lp150.2.12.1 php7-bz2-debuginfo-7.2.5-lp150.2.12.1 php7-calendar-7.2.5-lp150.2.12.1 php7-calendar-debuginfo-7.2.5-lp150.2.12.1 php7-ctype-7.2.5-lp150.2.12.1 php7-ctype-debuginfo-7.2.5-lp150.2.12.1 php7-curl-7.2.5-lp150.2.12.1 php7-curl-debuginfo-7.2.5-lp150.2.12.1 php7-dba-7.2.5-lp150.2.12.1 php7-dba-debuginfo-7.2.5-lp150.2.12.1 php7-debuginfo-7.2.5-lp150.2.12.1 php7-debugsource-7.2.5-lp150.2.12.1 php7-devel-7.2.5-lp150.2.12.1 php7-dom-7.2.5-lp150.2.12.1 php7-dom-debuginfo-7.2.5-lp150.2.12.1 php7-embed-7.2.5-lp150.2.12.1 php7-embed-debuginfo-7.2.5-lp150.2.12.1 php7-enchant-7.2.5-lp150.2.12.1 php7-enchant-debuginfo-7.2.5-lp150.2.12.1 php7-exif-7.2.5-lp150.2.12.1 php7-exif-debuginfo-7.2.5-lp150.2.12.1 php7-fastcgi-7.2.5-lp150.2.12.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.12.1 php7-fileinfo-7.2.5-lp150.2.12.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.12.1 php7-firebird-7.2.5-lp150.2.12.1 php7-firebird-debuginfo-7.2.5-lp150.2.12.1 php7-fpm-7.2.5-lp150.2.12.1 php7-fpm-debuginfo-7.2.5-lp150.2.12.1 php7-ftp-7.2.5-lp150.2.12.1 php7-ftp-debuginfo-7.2.5-lp150.2.12.1 php7-gd-7.2.5-lp150.2.12.1 php7-gd-debuginfo-7.2.5-lp150.2.12.1 php7-gettext-7.2.5-lp150.2.12.1 php7-gettext-debuginfo-7.2.5-lp150.2.12.1 php7-gmp-7.2.5-lp150.2.12.1 php7-gmp-debuginfo-7.2.5-lp150.2.12.1 php7-iconv-7.2.5-lp150.2.12.1 php7-iconv-debuginfo-7.2.5-lp150.2.12.1 php7-intl-7.2.5-lp150.2.12.1 php7-intl-debuginfo-7.2.5-lp150.2.12.1 php7-json-7.2.5-lp150.2.12.1 php7-json-debuginfo-7.2.5-lp150.2.12.1 php7-ldap-7.2.5-lp150.2.12.1 php7-ldap-debuginfo-7.2.5-lp150.2.12.1 php7-mbstring-7.2.5-lp150.2.12.1 php7-mbstring-debuginfo-7.2.5-lp150.2.12.1 php7-mysql-7.2.5-lp150.2.12.1 php7-mysql-debuginfo-7.2.5-lp150.2.12.1 php7-odbc-7.2.5-lp150.2.12.1 php7-odbc-debuginfo-7.2.5-lp150.2.12.1 php7-opcache-7.2.5-lp150.2.12.1 php7-opcache-debuginfo-7.2.5-lp150.2.12.1 php7-openssl-7.2.5-lp150.2.12.1 php7-openssl-debuginfo-7.2.5-lp150.2.12.1 php7-pcntl-7.2.5-lp150.2.12.1 php7-pcntl-debuginfo-7.2.5-lp150.2.12.1 php7-pdo-7.2.5-lp150.2.12.1 php7-pdo-debuginfo-7.2.5-lp150.2.12.1 php7-pgsql-7.2.5-lp150.2.12.1 php7-pgsql-debuginfo-7.2.5-lp150.2.12.1 php7-phar-7.2.5-lp150.2.12.1 php7-phar-debuginfo-7.2.5-lp150.2.12.1 php7-posix-7.2.5-lp150.2.12.1 php7-posix-debuginfo-7.2.5-lp150.2.12.1 php7-readline-7.2.5-lp150.2.12.1 php7-readline-debuginfo-7.2.5-lp150.2.12.1 php7-shmop-7.2.5-lp150.2.12.1 php7-shmop-debuginfo-7.2.5-lp150.2.12.1 php7-snmp-7.2.5-lp150.2.12.1 php7-snmp-debuginfo-7.2.5-lp150.2.12.1 php7-soap-7.2.5-lp150.2.12.1 php7-soap-debuginfo-7.2.5-lp150.2.12.1 php7-sockets-7.2.5-lp150.2.12.1 php7-sockets-debuginfo-7.2.5-lp150.2.12.1 php7-sodium-7.2.5-lp150.2.12.1 php7-sodium-debuginfo-7.2.5-lp150.2.12.1 php7-sqlite-7.2.5-lp150.2.12.1 php7-sqlite-debuginfo-7.2.5-lp150.2.12.1 php7-sysvmsg-7.2.5-lp150.2.12.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.12.1 php7-sysvsem-7.2.5-lp150.2.12.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.12.1 php7-sysvshm-7.2.5-lp150.2.12.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.12.1 php7-tidy-7.2.5-lp150.2.12.1 php7-tidy-debuginfo-7.2.5-lp150.2.12.1 php7-tokenizer-7.2.5-lp150.2.12.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.12.1 php7-wddx-7.2.5-lp150.2.12.1 php7-wddx-debuginfo-7.2.5-lp150.2.12.1 php7-xmlreader-7.2.5-lp150.2.12.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.12.1 php7-xmlrpc-7.2.5-lp150.2.12.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.12.1 php7-xmlwriter-7.2.5-lp150.2.12.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.12.1 php7-xsl-7.2.5-lp150.2.12.1 php7-xsl-debuginfo-7.2.5-lp150.2.12.1 php7-zip-7.2.5-lp150.2.12.1 php7-zip-debuginfo-7.2.5-lp150.2.12.1 php7-zlib-7.2.5-lp150.2.12.1 php7-zlib-debuginfo-7.2.5-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.12.1 php7-pear-Archive_Tar-7.2.5-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2833-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2833-1 Rating: low References: #1108282 #1108283 Cross-References: CVE-2018-16749 CVE-2018-16750 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following security issue: - CVE-2018-16750: Prevent memory leak in the formatIPTCfromBuffer function (bsc#1108283). An earlier update added a change that also fixed this issues that was unknown at the time of release: - CVE-2018-16749: Added missing NULL check in ReadOneJNGImage that allowed an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file (bsc#1108282). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1045=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-108.1 GraphicsMagick-debuginfo-1.3.25-108.1 GraphicsMagick-debugsource-1.3.25-108.1 GraphicsMagick-devel-1.3.25-108.1 libGraphicsMagick++-Q16-12-1.3.25-108.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-108.1 libGraphicsMagick++-devel-1.3.25-108.1 libGraphicsMagick-Q16-3-1.3.25-108.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-108.1 libGraphicsMagick3-config-1.3.25-108.1 libGraphicsMagickWand-Q16-2-1.3.25-108.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-108.1 perl-GraphicsMagick-1.3.25-108.1 perl-GraphicsMagick-debuginfo-1.3.25-108.1 References: https://www.suse.com/security/cve/CVE-2018-16749.html https://www.suse.com/security/cve/CVE-2018-16750.html https://bugzilla.suse.com/1108282 https://bugzilla.suse.com/1108283 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2827-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2827-1 Rating: moderate References: #1108480 Cross-References: CVE-2016-3822 CVE-2018-16554 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jhead fixes the following security issues: - CVE-2016-3822: jhead remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data (bsc#1108480). - CVE-2018-16554: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling (bsc#1108480). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1044=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1044=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1044=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): jhead-3.00-11.1 jhead-debuginfo-3.00-11.1 jhead-debugsource-3.00-11.1 - openSUSE Leap 15.0 (x86_64): jhead-3.00-lp150.3.3.1 jhead-debuginfo-3.00-lp150.3.3.1 jhead-debugsource-3.00-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): jhead-3.00-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2016-3822.html https://www.suse.com/security/cve/CVE-2018-16554.html https://bugzilla.suse.com/1108480 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2820-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2820-1 Rating: moderate References: #1096291 Cross-References: CVE-2018-1000180 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following security issue: - CVE-2018-1000180: Fixed flaw in the Low-level interface to RSA key pair generator. RSA Key Pairs generated in low-level API with added certainty may had less M-R tests than expected (bsc#1096291). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1043=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.60-23.10.1 bouncycastle-javadoc-1.60-23.10.1 References: https://www.suse.com/security/cve/CVE-2018-1000180.html https://bugzilla.suse.com/1096291 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0