September 2018 - openSUSE Security Announce

[security-announce] openSUSE-SU-2018:2664-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2664-1 Rating: important References: #1106341 #1107235 Cross-References: CVE-2017-15430 CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 CVE-2018-16079 CVE-2018-16080 CVE-2018-16081 CVE-2018-16082 CVE-2018-16083 CVE-2018-16084 CVE-2018-16085 CVE-2018-16086 CVE-2018-16087 CVE-2018-16088 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for Chromium to version 69.0.3497.81 fixes multiple issues. Security issues fixed (boo#1107235): - CVE-2018-16065: Out of bounds write in V8 - CVE-2018-16066:Out of bounds read in Blink - CVE-2018-16067: Out of bounds read in WebAudio - CVE-2018-16068: Out of bounds write in Mojo - CVE-2018-16069:Out of bounds read in SwiftShader - CVE-2018-16070: Integer overflow in Skia - CVE-2018-16071: Use after free in WebRTC - CVE-2018-16073: Site Isolation bypass after tab restore - CVE-2018-16074: Site Isolation bypass using Blob URLS - Out of bounds read in Little-CMS - CVE-2018-16075: Local file access in Blink - CVE-2018-16076: Out of bounds read in PDFium - CVE-2018-16077: Content security policy bypass in Blink - CVE-2018-16078: Credit card information leak in Autofill - CVE-2018-16079: URL spoof in permission dialogs - CVE-2018-16080: URL spoof in full screen mode - CVE-2018-16081: Local file access in DevTools - CVE-2018-16082: Stack buffer overflow in SwiftShader - CVE-2018-16083: Out of bounds read in WebRTC - CVE-2018-16084: User confirmation bypass in external protocol handling - CVE-2018-16085: Use after free in Memory Instrumentation - CVE-2017-15430: Unsafe navigation in Chromecast (boo#1106341) - CVE-2018-16086: Script injection in New Tab Page - CVE-2018-16087: Multiple download restriction bypass - CVE-2018-16088: User gesture requirement bypass The re2 regular expression library was updated to the current version 2018-09-01. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-979=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-979=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libre2-0-20180901-18.1 libre2-0-debuginfo-20180901-18.1 re2-debugsource-20180901-18.1 re2-devel-20180901-18.1 - openSUSE Leap 42.3 (x86_64): chromedriver-69.0.3497.81-168.1 chromedriver-debuginfo-69.0.3497.81-168.1 chromium-69.0.3497.81-168.1 chromium-debuginfo-69.0.3497.81-168.1 chromium-debugsource-69.0.3497.81-168.1 libre2-0-32bit-20180901-18.1 libre2-0-debuginfo-32bit-20180901-18.1 - openSUSE Leap 15.0 (i586 x86_64): libre2-0-20180901-lp150.7.3.1 libre2-0-debuginfo-20180901-lp150.7.3.1 re2-debugsource-20180901-lp150.7.3.1 re2-devel-20180901-lp150.7.3.1 - openSUSE Leap 15.0 (x86_64): chromedriver-69.0.3497.81-lp150.2.10.1 chromedriver-debuginfo-69.0.3497.81-lp150.2.10.1 chromium-69.0.3497.81-lp150.2.10.1 chromium-debuginfo-69.0.3497.81-lp150.2.10.1 chromium-debugsource-69.0.3497.81-lp150.2.10.1 libre2-0-32bit-20180901-lp150.7.3.1 libre2-0-32bit-debuginfo-20180901-lp150.7.3.1 References: https://www.suse.com/security/cve/CVE-2017-15430.html https://www.suse.com/security/cve/CVE-2018-16065.html https://www.suse.com/security/cve/CVE-2018-16066.html https://www.suse.com/security/cve/CVE-2018-16067.html https://www.suse.com/security/cve/CVE-2018-16068.html https://www.suse.com/security/cve/CVE-2018-16069.html https://www.suse.com/security/cve/CVE-2018-16070.html https://www.suse.com/security/cve/CVE-2018-16071.html https://www.suse.com/security/cve/CVE-2018-16073.html https://www.suse.com/security/cve/CVE-2018-16074.html https://www.suse.com/security/cve/CVE-2018-16075.html https://www.suse.com/security/cve/CVE-2018-16076.html https://www.suse.com/security/cve/CVE-2018-16077.html https://www.suse.com/security/cve/CVE-2018-16078.html https://www.suse.com/security/cve/CVE-2018-16079.html https://www.suse.com/security/cve/CVE-2018-16080.html https://www.suse.com/security/cve/CVE-2018-16081.html https://www.suse.com/security/cve/CVE-2018-16082.html https://www.suse.com/security/cve/CVE-2018-16083.html https://www.suse.com/security/cve/CVE-2018-16084.html https://www.suse.com/security/cve/CVE-2018-16085.html https://www.suse.com/security/cve/CVE-2018-16086.html https://www.suse.com/security/cve/CVE-2018-16087.html https://www.suse.com/security/cve/CVE-2018-16088.html https://bugzilla.suse.com/1106341 https://bugzilla.suse.com/1107235 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2659-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2659-1 Rating: important References: #1106341 #1107235 Cross-References: CVE-2017-15430 CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 CVE-2018-16079 CVE-2018-16080 CVE-2018-16081 CVE-2018-16082 CVE-2018-16083 CVE-2018-16084 CVE-2018-16085 CVE-2018-16086 CVE-2018-16087 CVE-2018-16088 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for Chromium to version 69.0.3497.81 fixes multiple issues. Security issues fixed (boo#1107235): - CVE-2018-16065: Out of bounds write in V8 - CVE-2018-16066:Out of bounds read in Blink - CVE-2018-16067: Out of bounds read in WebAudio - CVE-2018-16068: Out of bounds write in Mojo - CVE-2018-16069:Out of bounds read in SwiftShader - CVE-2018-16070: Integer overflow in Skia - CVE-2018-16071: Use after free in WebRTC - CVE-2018-16073: Site Isolation bypass after tab restore - CVE-2018-16074: Site Isolation bypass using Blob URLS - Out of bounds read in Little-CMS - CVE-2018-16075: Local file access in Blink - CVE-2018-16076: Out of bounds read in PDFium - CVE-2018-16077: Content security policy bypass in Blink - CVE-2018-16078: Credit card information leak in Autofill - CVE-2018-16079: URL spoof in permission dialogs - CVE-2018-16080: URL spoof in full screen mode - CVE-2018-16081: Local file access in DevTools - CVE-2018-16082: Stack buffer overflow in SwiftShader - CVE-2018-16083: Out of bounds read in WebRTC - CVE-2018-16084: User confirmation bypass in external protocol handling - CVE-2018-16085: Use after free in Memory Instrumentation - CVE-2017-15430: Unsafe navigation in Chromecast (boo#1106341) - CVE-2018-16086: Script injection in New Tab Page - CVE-2018-16087: Multiple download restriction bypass - CVE-2018-16088: User gesture requirement bypass The re2 regular expression library was updated to the current version 2018-09-01. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-979=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): libre2-0-20180901-11.1 libre2-0-debuginfo-20180901-11.1 re2-debugsource-20180901-11.1 re2-devel-20180901-11.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le): libre2-0-20180901-11.2 libre2-0-debuginfo-20180901-11.2 re2-debugsource-20180901-11.2 re2-devel-20180901-11.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-69.0.3497.81-65.1 chromedriver-debuginfo-69.0.3497.81-65.1 chromium-69.0.3497.81-65.1 chromium-debuginfo-69.0.3497.81-65.1 chromium-debugsource-69.0.3497.81-65.1 References: https://www.suse.com/security/cve/CVE-2017-15430.html https://www.suse.com/security/cve/CVE-2018-16065.html https://www.suse.com/security/cve/CVE-2018-16066.html https://www.suse.com/security/cve/CVE-2018-16067.html https://www.suse.com/security/cve/CVE-2018-16068.html https://www.suse.com/security/cve/CVE-2018-16069.html https://www.suse.com/security/cve/CVE-2018-16070.html https://www.suse.com/security/cve/CVE-2018-16071.html https://www.suse.com/security/cve/CVE-2018-16073.html https://www.suse.com/security/cve/CVE-2018-16074.html https://www.suse.com/security/cve/CVE-2018-16075.html https://www.suse.com/security/cve/CVE-2018-16076.html https://www.suse.com/security/cve/CVE-2018-16077.html https://www.suse.com/security/cve/CVE-2018-16078.html https://www.suse.com/security/cve/CVE-2018-16079.html https://www.suse.com/security/cve/CVE-2018-16080.html https://www.suse.com/security/cve/CVE-2018-16081.html https://www.suse.com/security/cve/CVE-2018-16082.html https://www.suse.com/security/cve/CVE-2018-16083.html https://www.suse.com/security/cve/CVE-2018-16084.html https://www.suse.com/security/cve/CVE-2018-16085.html https://www.suse.com/security/cve/CVE-2018-16086.html https://www.suse.com/security/cve/CVE-2018-16087.html https://www.suse.com/security/cve/CVE-2018-16088.html https://bugzilla.suse.com/1106341 https://bugzilla.suse.com/1107235 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2658-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2658-1 Rating: important References: #1084603 #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12367 CVE-2018-12371 CVE-2018-5156 CVE-2018-5187 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.0 fixes the following issues: These security issues were fixed: - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element (bsc#1098998). - CVE-2018-12360: Prevent use-after-free when using focus() (bsc#1098998). - CVE-2018-12361: Prevent integer overflow in SwizzleData (bsc#1098998). - CVE-2018-12362: Prevent integer overflow in SSSE3 scaler (bsc#1098998). - CVE-2018-5156: Prevent media recorder segmentation fault when track type is changed during capture (bsc#1098998). - CVE-2018-12363: Prevent use-after-free when appending DOM nodes (bsc#1098998). - CVE-2018-12364: Prevent CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998). - CVE-2018-12365: Prevent compromised IPC child process listing local filenames (bsc#1098998). - CVE-2018-12371: Prevent integer overflow in Skia library during edge builder allocation (bsc#1098998). - CVE-2018-12366: Prevent invalid data handling during QCMS transformations (bsc#1098998). - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998). - CVE-2018-5187: Various memory safety bugs (bsc#1098998). - CVE-2018-5188: Various memory safety bugs (bsc#1098998). These can not, in general, be exploited through email, but are potential risks in browser or browser-like contexts. These non-security issues were fixed: - Storing of remote content settings fixed (bsc#1084603) - Improved message handling and composing - Improved handling of message templates - Support for OAuth2 and FIDO U2F - Various Calendar improvements - Various fixes and changes to e-mail workflow - Various IMAP fixes - Native desktop notifications Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-994=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-994=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.0-74.1 MozillaThunderbird-buildsymbols-60.0-74.1 MozillaThunderbird-debuginfo-60.0-74.1 MozillaThunderbird-debugsource-60.0-74.1 MozillaThunderbird-translations-common-60.0-74.1 MozillaThunderbird-translations-other-60.0-74.1 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.0-lp150.3.14.1 MozillaThunderbird-buildsymbols-60.0-lp150.3.14.1 MozillaThunderbird-debuginfo-60.0-lp150.3.14.1 MozillaThunderbird-debugsource-60.0-lp150.3.14.1 MozillaThunderbird-translations-common-60.0-lp150.3.14.1 MozillaThunderbird-translations-other-60.0-lp150.3.14.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1084603 https://bugzilla.suse.com/1098998 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2648-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 07 Sep '18

07 Sep '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2648-1 Rating: moderate References: #1105466 Cross-References: CVE-2017-9118 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-976=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-46.1 apache2-mod_php7-debuginfo-7.0.7-46.1 php7-7.0.7-46.1 php7-bcmath-7.0.7-46.1 php7-bcmath-debuginfo-7.0.7-46.1 php7-bz2-7.0.7-46.1 php7-bz2-debuginfo-7.0.7-46.1 php7-calendar-7.0.7-46.1 php7-calendar-debuginfo-7.0.7-46.1 php7-ctype-7.0.7-46.1 php7-ctype-debuginfo-7.0.7-46.1 php7-curl-7.0.7-46.1 php7-curl-debuginfo-7.0.7-46.1 php7-dba-7.0.7-46.1 php7-dba-debuginfo-7.0.7-46.1 php7-debuginfo-7.0.7-46.1 php7-debugsource-7.0.7-46.1 php7-devel-7.0.7-46.1 php7-dom-7.0.7-46.1 php7-dom-debuginfo-7.0.7-46.1 php7-enchant-7.0.7-46.1 php7-enchant-debuginfo-7.0.7-46.1 php7-exif-7.0.7-46.1 php7-exif-debuginfo-7.0.7-46.1 php7-fastcgi-7.0.7-46.1 php7-fastcgi-debuginfo-7.0.7-46.1 php7-fileinfo-7.0.7-46.1 php7-fileinfo-debuginfo-7.0.7-46.1 php7-firebird-7.0.7-46.1 php7-firebird-debuginfo-7.0.7-46.1 php7-fpm-7.0.7-46.1 php7-fpm-debuginfo-7.0.7-46.1 php7-ftp-7.0.7-46.1 php7-ftp-debuginfo-7.0.7-46.1 php7-gd-7.0.7-46.1 php7-gd-debuginfo-7.0.7-46.1 php7-gettext-7.0.7-46.1 php7-gettext-debuginfo-7.0.7-46.1 php7-gmp-7.0.7-46.1 php7-gmp-debuginfo-7.0.7-46.1 php7-iconv-7.0.7-46.1 php7-iconv-debuginfo-7.0.7-46.1 php7-imap-7.0.7-46.1 php7-imap-debuginfo-7.0.7-46.1 php7-intl-7.0.7-46.1 php7-intl-debuginfo-7.0.7-46.1 php7-json-7.0.7-46.1 php7-json-debuginfo-7.0.7-46.1 php7-ldap-7.0.7-46.1 php7-ldap-debuginfo-7.0.7-46.1 php7-mbstring-7.0.7-46.1 php7-mbstring-debuginfo-7.0.7-46.1 php7-mcrypt-7.0.7-46.1 php7-mcrypt-debuginfo-7.0.7-46.1 php7-mysql-7.0.7-46.1 php7-mysql-debuginfo-7.0.7-46.1 php7-odbc-7.0.7-46.1 php7-odbc-debuginfo-7.0.7-46.1 php7-opcache-7.0.7-46.1 php7-opcache-debuginfo-7.0.7-46.1 php7-openssl-7.0.7-46.1 php7-openssl-debuginfo-7.0.7-46.1 php7-pcntl-7.0.7-46.1 php7-pcntl-debuginfo-7.0.7-46.1 php7-pdo-7.0.7-46.1 php7-pdo-debuginfo-7.0.7-46.1 php7-pgsql-7.0.7-46.1 php7-pgsql-debuginfo-7.0.7-46.1 php7-phar-7.0.7-46.1 php7-phar-debuginfo-7.0.7-46.1 php7-posix-7.0.7-46.1 php7-posix-debuginfo-7.0.7-46.1 php7-pspell-7.0.7-46.1 php7-pspell-debuginfo-7.0.7-46.1 php7-readline-7.0.7-46.1 php7-readline-debuginfo-7.0.7-46.1 php7-shmop-7.0.7-46.1 php7-shmop-debuginfo-7.0.7-46.1 php7-snmp-7.0.7-46.1 php7-snmp-debuginfo-7.0.7-46.1 php7-soap-7.0.7-46.1 php7-soap-debuginfo-7.0.7-46.1 php7-sockets-7.0.7-46.1 php7-sockets-debuginfo-7.0.7-46.1 php7-sqlite-7.0.7-46.1 php7-sqlite-debuginfo-7.0.7-46.1 php7-sysvmsg-7.0.7-46.1 php7-sysvmsg-debuginfo-7.0.7-46.1 php7-sysvsem-7.0.7-46.1 php7-sysvsem-debuginfo-7.0.7-46.1 php7-sysvshm-7.0.7-46.1 php7-sysvshm-debuginfo-7.0.7-46.1 php7-tidy-7.0.7-46.1 php7-tidy-debuginfo-7.0.7-46.1 php7-tokenizer-7.0.7-46.1 php7-tokenizer-debuginfo-7.0.7-46.1 php7-wddx-7.0.7-46.1 php7-wddx-debuginfo-7.0.7-46.1 php7-xmlreader-7.0.7-46.1 php7-xmlreader-debuginfo-7.0.7-46.1 php7-xmlrpc-7.0.7-46.1 php7-xmlrpc-debuginfo-7.0.7-46.1 php7-xmlwriter-7.0.7-46.1 php7-xmlwriter-debuginfo-7.0.7-46.1 php7-xsl-7.0.7-46.1 php7-xsl-debuginfo-7.0.7-46.1 php7-zip-7.0.7-46.1 php7-zip-debuginfo-7.0.7-46.1 php7-zlib-7.0.7-46.1 php7-zlib-debuginfo-7.0.7-46.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-46.1 php7-pear-Archive_Tar-7.0.7-46.1 References: https://www.suse.com/security/cve/CVE-2017-9118.html https://bugzilla.suse.com/1105466 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2645-1: moderate: Security update for apache-pdfbox
by opensuse-security＠opensuse.org 07 Sep '18

07 Sep '18

openSUSE Security Update: Security update for apache-pdfbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2645-1 Rating: moderate References: #1099721 Cross-References: CVE-2018-8036 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-pdfbox fixes the following issues: Security issue fixed: - CVE-2018-8036: Fix infinite loop while parsing files that leads to an out of memory issue (bsc#1099721). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-975=1 Package List: - openSUSE Leap 15.0 (noarch): apache-pdfbox-1.8.12-lp150.4.3.1 apache-pdfbox-javadoc-1.8.12-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-8036.html https://bugzilla.suse.com/1099721 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2642-1: important: Security update for dovecot22
by opensuse-security＠opensuse.org 06 Sep '18

06 Sep '18

openSUSE Security Update: Security update for dovecot22 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2642-1 Rating: important References: #1082828 Cross-References: CVE-2017-15130 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dovecot22 fixes the following issues: Security issue fixed: - CVE-2017-15130: Fixed a potential denial of service via TLS SNI config lookups, which would slow the process down and could have led to exhaustive memory allocation and/or process restarts (bsc#1082828) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-973=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dovecot22-2.2.31-2.9.1 dovecot22-backend-mysql-2.2.31-2.9.1 dovecot22-backend-mysql-debuginfo-2.2.31-2.9.1 dovecot22-backend-pgsql-2.2.31-2.9.1 dovecot22-backend-pgsql-debuginfo-2.2.31-2.9.1 dovecot22-backend-sqlite-2.2.31-2.9.1 dovecot22-backend-sqlite-debuginfo-2.2.31-2.9.1 dovecot22-debuginfo-2.2.31-2.9.1 dovecot22-debugsource-2.2.31-2.9.1 dovecot22-devel-2.2.31-2.9.1 dovecot22-fts-2.2.31-2.9.1 dovecot22-fts-debuginfo-2.2.31-2.9.1 dovecot22-fts-lucene-2.2.31-2.9.1 dovecot22-fts-lucene-debuginfo-2.2.31-2.9.1 dovecot22-fts-solr-2.2.31-2.9.1 dovecot22-fts-solr-debuginfo-2.2.31-2.9.1 dovecot22-fts-squat-2.2.31-2.9.1 dovecot22-fts-squat-debuginfo-2.2.31-2.9.1 References: https://www.suse.com/security/cve/CVE-2017-15130.html https://bugzilla.suse.com/1082828 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2628-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 05 Sep '18

05 Sep '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2628-1 Rating: moderate References: #1106514 Cross-References: CVE-2018-16056 CVE-2018-16057 CVE-2018-16058 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark to version 2.4.9 fixes the following issues: Security issues fixed (bsc#1106514): - CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44) - CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45) - CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.9.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-972=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.9-lp150.2.10.1 libwireshark9-debuginfo-2.4.9-lp150.2.10.1 libwiretap7-2.4.9-lp150.2.10.1 libwiretap7-debuginfo-2.4.9-lp150.2.10.1 libwscodecs1-2.4.9-lp150.2.10.1 libwscodecs1-debuginfo-2.4.9-lp150.2.10.1 libwsutil8-2.4.9-lp150.2.10.1 libwsutil8-debuginfo-2.4.9-lp150.2.10.1 wireshark-2.4.9-lp150.2.10.1 wireshark-debuginfo-2.4.9-lp150.2.10.1 wireshark-debugsource-2.4.9-lp150.2.10.1 wireshark-devel-2.4.9-lp150.2.10.1 wireshark-ui-qt-2.4.9-lp150.2.10.1 wireshark-ui-qt-debuginfo-2.4.9-lp150.2.10.1 References: https://www.suse.com/security/cve/CVE-2018-16056.html https://www.suse.com/security/cve/CVE-2018-16057.html https://www.suse.com/security/cve/CVE-2018-16058.html https://bugzilla.suse.com/1106514 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2623-1: Security update for yubico-piv-tool
by opensuse-security＠opensuse.org 05 Sep '18

05 Sep '18

openSUSE Security Update: Security update for yubico-piv-tool ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2623-1 Rating: low References: #1104809 #1104811 Cross-References: CVE-2018-14779 CVE-2018-14780 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for yubico-piv-tool fixes the following issues: Security issues fixed: - CVE-2018-14779: Fixed an buffer overflow and an out of bounds memory read in ykpiv_transfer_data(), which could be triggered by a malicious token. (boo#1104809, YSA-2018-03) - CVE-2018-14780: Fixed an buffer overflow and an out of bounds memory read in _ykpiv_fetch_object(), which could be triggered by a malicious token. (boo#1104811, YSA-2018-03) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-969=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libykpiv-devel-0.1.6-7.3.1 libykpiv1-0.1.6-7.3.1 libykpiv1-debuginfo-0.1.6-7.3.1 yubico-piv-tool-0.1.6-7.3.1 yubico-piv-tool-debuginfo-0.1.6-7.3.1 yubico-piv-tool-debugsource-0.1.6-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-14779.html https://www.suse.com/security/cve/CVE-2018-14780.html https://bugzilla.suse.com/1104809 https://bugzilla.suse.com/1104811 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2602-1: important: Security update for spice
by opensuse-security＠opensuse.org 04 Sep '18

04 Sep '18

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2602-1 Rating: important References: #1101295 #1104448 Cross-References: CVE-2018-10873 CVE-2018-10893 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for spice fixes the following issues: Security issues fixed: - CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448) - CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-957=1 Package List: - openSUSE Leap 42.3 (x86_64): libspice-server-devel-0.12.8-7.1 libspice-server1-0.12.8-7.1 libspice-server1-debuginfo-0.12.8-7.1 spice-debugsource-0.12.8-7.1 References: https://www.suse.com/security/cve/CVE-2018-10873.html https://www.suse.com/security/cve/CVE-2018-10893.html https://bugzilla.suse.com/1101295 https://bugzilla.suse.com/1104448 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:2601-1: important: Security update for spice-gtk
by opensuse-security＠opensuse.org 04 Sep '18

04 Sep '18

openSUSE Security Update: Security update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2601-1 Rating: important References: #1101295 #1104448 Cross-References: CVE-2018-10873 CVE-2018-10893 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for spice-gtk fixes the following issues: Security issues fixed: - CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448) - CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-958=1 Package List: - openSUSE Leap 42.3 (noarch): spice-gtk-lang-0.33-2.7.1 - openSUSE Leap 42.3 (x86_64): libspice-client-glib-2_0-8-0.33-2.7.1 libspice-client-glib-2_0-8-debuginfo-0.33-2.7.1 libspice-client-glib-helper-0.33-2.7.1 libspice-client-glib-helper-debuginfo-0.33-2.7.1 libspice-client-gtk-3_0-5-0.33-2.7.1 libspice-client-gtk-3_0-5-debuginfo-0.33-2.7.1 libspice-controller0-0.33-2.7.1 libspice-controller0-debuginfo-0.33-2.7.1 spice-gtk-0.33-2.7.1 spice-gtk-debuginfo-0.33-2.7.1 spice-gtk-debugsource-0.33-2.7.1 spice-gtk-devel-0.33-2.7.1 typelib-1_0-SpiceClientGlib-2_0-0.33-2.7.1 typelib-1_0-SpiceClientGtk-3_0-0.33-2.7.1 References: https://www.suse.com/security/cve/CVE-2018-10873.html https://www.suse.com/security/cve/CVE-2018-10893.html https://bugzilla.suse.com/1101295 https://bugzilla.suse.com/1104448 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0