October 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2017:2644-1: Optional update for the_silver_searcher
by maintenance＠opensuse.org 04 Oct '17

04 Oct '17

openSUSE Optional Update: Optional update for the_silver_searcher ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2644-1 Rating: low References: #1061006 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for the_silver_searcher to version 2.1 provides the following new functionality: - stream decompression of zipped files - '-A n -B n' act like '-C n' by printing blank lines Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1125=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): the_silver_searcher-2.1.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): the_silver_searcher-debuginfo-2.1.0-5.1 the_silver_searcher-debugsource-2.1.0-5.1 References: https://bugzilla.suse.com/1061006

1 0

openSUSE-RU-2017:2642-1: Recommended update for clamav-database
by maintenance＠opensuse.org 04 Oct '17

04 Oct '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2642-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database provides the following fix: - Database refresh October 2nd 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1123=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201710021446-54.85.1 References:

1 0

openSUSE-SU-2017:2641-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 04 Oct '17

04 Oct '17

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2641-1 Rating: moderate References: #1036756 Cross-References: CVE-2017-9286 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud fixes the following issues: - CVE-2017-9286: During upgrade of the nextcloud package local attackers could gain root access via a /tmp file race. (boo#1036756) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1121=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): nextcloud-11.0.3-3.1 References: https://www.suse.com/security/cve/CVE-2017-9286.html https://bugzilla.suse.com/1036756

1 0

openSUSE-RU-2017:2640-1: important: Recommended update for qemu
by maintenance＠opensuse.org 04 Oct '17

04 Oct '17

openSUSE Recommended Update: Recommended update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2640-1 Rating: important References: #1059369 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update of the qemu package fixes the following regression: - Some keys presses were not being recorded anymore in openQA installations after recent qemu update. [bsc#1059369] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1122=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): qemu-2.6.2-31.6.2 qemu-arm-2.6.2-31.6.2 qemu-arm-debuginfo-2.6.2-31.6.2 qemu-block-curl-2.6.2-31.6.2 qemu-block-curl-debuginfo-2.6.2-31.6.2 qemu-block-dmg-2.6.2-31.6.2 qemu-block-dmg-debuginfo-2.6.2-31.6.2 qemu-block-iscsi-2.6.2-31.6.2 qemu-block-iscsi-debuginfo-2.6.2-31.6.2 qemu-block-ssh-2.6.2-31.6.2 qemu-block-ssh-debuginfo-2.6.2-31.6.2 qemu-debugsource-2.6.2-31.6.2 qemu-extra-2.6.2-31.6.2 qemu-extra-debuginfo-2.6.2-31.6.2 qemu-guest-agent-2.6.2-31.6.2 qemu-guest-agent-debuginfo-2.6.2-31.6.2 qemu-kvm-2.6.2-31.6.2 qemu-lang-2.6.2-31.6.2 qemu-linux-user-2.6.2-31.6.1 qemu-linux-user-debuginfo-2.6.2-31.6.1 qemu-linux-user-debugsource-2.6.2-31.6.1 qemu-ppc-2.6.2-31.6.2 qemu-ppc-debuginfo-2.6.2-31.6.2 qemu-s390-2.6.2-31.6.2 qemu-s390-debuginfo-2.6.2-31.6.2 qemu-testsuite-2.6.2-31.6.4 qemu-tools-2.6.2-31.6.2 qemu-tools-debuginfo-2.6.2-31.6.2 qemu-x86-2.6.2-31.6.2 qemu-x86-debuginfo-2.6.2-31.6.2 - openSUSE Leap 42.2 (noarch): qemu-ipxe-1.0.0-31.6.2 qemu-seabios-1.9.1-31.6.2 qemu-sgabios-8-31.6.2 qemu-vgabios-1.9.1-31.6.2 - openSUSE Leap 42.2 (x86_64): qemu-block-rbd-2.6.2-31.6.2 qemu-block-rbd-debuginfo-2.6.2-31.6.2 References: https://bugzilla.suse.com/1059369

1 0

openSUSE-SU-2017:2639-1: moderate: Security update for liblouis
by opensuse-security＠opensuse.org 03 Oct '17

03 Oct '17

openSUSE Security Update: Security update for liblouis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2639-1 Rating: moderate References: #1056088 #1056090 #1056093 #1056095 #1056097 #1056101 #1056105 Cross-References: CVE-2017-13738 CVE-2017-13739 CVE-2017-13740 CVE-2017-13741 CVE-2017-13743 CVE-2017-13744 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for liblouis fixes several issues. These security issues were fixed: - CVE-2017-13738: Prevent illegal address access in the _lou_getALine function that allowed to cause remote DoS (bsc#1056105). - CVE-2017-13739: Prevent heap-based buffer overflow in the function resolveSubtable() that could have caused DoS or remote code execution (bsc#1056101). - CVE-2017-13740: Prevent stack-based buffer overflow in the function parseChars() that could have caused DoS or possibly unspecified other impact (bsc#1056097) - CVE-2017-13741: Prevent use-after-free in function compileBrailleIndicator() that allowed to cause remote DoS (bsc#1056095). - CVE_2017-13742: Prevent stack-based buffer overflow in function includeFile that allowed to cause remote DoS (bsc#1056093). - CVE-2017-13743: Prevent buffer overflow triggered in the function _lou_showString() that allowed to cause remote DoS (bsc#1056090). - CVE-2017-13744: Prevent illegal address access in the function _lou_getALine() that allowed to cause remote DoS (bsc#1056088). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1120=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1120=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): liblouis-data-2.6.4-6.1 liblouis-debugsource-2.6.4-6.1 liblouis-devel-2.6.4-6.1 liblouis-doc-2.6.4-6.1 liblouis-tools-2.6.4-6.1 liblouis-tools-debuginfo-2.6.4-6.1 liblouis9-2.6.4-6.1 liblouis9-debuginfo-2.6.4-6.1 python-louis-2.6.4-6.1 - openSUSE Leap 42.2 (i586 x86_64): liblouis-data-2.6.4-3.3.1 liblouis-debugsource-2.6.4-3.3.1 liblouis-devel-2.6.4-3.3.1 liblouis-doc-2.6.4-3.3.1 liblouis-tools-2.6.4-3.3.1 liblouis-tools-debuginfo-2.6.4-3.3.1 liblouis9-2.6.4-3.3.1 liblouis9-debuginfo-2.6.4-3.3.1 python-louis-2.6.4-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-13738.html https://www.suse.com/security/cve/CVE-2017-13739.html https://www.suse.com/security/cve/CVE-2017-13740.html https://www.suse.com/security/cve/CVE-2017-13741.html https://www.suse.com/security/cve/CVE-2017-13743.html https://www.suse.com/security/cve/CVE-2017-13744.html https://bugzilla.suse.com/1056088 https://bugzilla.suse.com/1056090 https://bugzilla.suse.com/1056093 https://bugzilla.suse.com/1056095 https://bugzilla.suse.com/1056097 https://bugzilla.suse.com/1056101 https://bugzilla.suse.com/1056105

1 0

openSUSE-SU-2017:2638-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 03 Oct '17

03 Oct '17

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2638-1 Rating: moderate References: #1060163 #1060321 Cross-References: CVE-2017-13735 CVE-2017-14265 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libraw fixes the following issues: Security issue fixed: * CVE-2017-14265: A stack based buffer overflow in the xtrans_interpolate function was fixed. [boo#1060163] * CVE-2017-13735: A floating point exception in the kodak_radc_load_raw function was fixed which could have lead to aborts of programs using libraw on reading malicious files. [bsc#1060321] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1119=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-11.1 libraw-devel-0.17.1-11.1 libraw-devel-static-0.17.1-11.1 libraw-tools-0.17.1-11.1 libraw-tools-debuginfo-0.17.1-11.1 libraw15-0.17.1-11.1 libraw15-debuginfo-0.17.1-11.1 - openSUSE Leap 42.2 (i586 x86_64): libraw-debugsource-0.17.1-2.11.1 libraw-devel-0.17.1-2.11.1 libraw-devel-static-0.17.1-2.11.1 libraw-tools-0.17.1-2.11.1 libraw-tools-debuginfo-0.17.1-2.11.1 libraw15-0.17.1-2.11.1 libraw15-debuginfo-0.17.1-2.11.1 References: https://www.suse.com/security/cve/CVE-2017-13735.html https://www.suse.com/security/cve/CVE-2017-14265.html https://bugzilla.suse.com/1060163 https://bugzilla.suse.com/1060321

1 0

openSUSE-SU-2017:2635-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 03 Oct '17

03 Oct '17

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2635-1 Rating: moderate References: #1033109 #1033111 #1033112 #1033113 #1033118 #1033120 #1033126 #1033127 #1033128 #1033129 #1033131 #1038438 #1042804 #1042805 Cross-References: CVE-2016-10371 CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 CVE-2017-9403 CVE-2017-9404 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for tiff to version 4.0.8 fixes a several bugs and security issues: These security issues were fixed: - CVE-2017-7595: The JPEGSetupEncode function allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image (bsc#1033127). - CVE-2016-10371: The TIFFWriteDirectoryTagCheckedRational function allowed remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file (bsc#1038438). - CVE-2017-7598: Error in tif_dirread.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image (bsc#1033118). - CVE-2017-7596: Undefined behavior because of floats outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033126). - CVE-2017-7597: Undefined behavior because of floats outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033120). - CVE-2017-7599: Undefined behavior because of shorts outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033113). - CVE-2017-7600: Undefined behavior because of chars outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033112). - CVE-2017-7601: Because of a shift exponent too large for 64-bit type long undefined behavior was caused, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033111). - CVE-2017-7602: Prevent signed integer overflow, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033109). - CVE-2017-7592: The putagreytile function had a left-shift undefined behavior issue, which might allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033131). - CVE-2017-7593: Ensure that tif_rawdata is properly initialized, to prevent remote attackers to obtain sensitive information from process memory via a crafted image (bsc#1033129). - CVE-2017-7594: The OJPEGReadHeaderInfoSecTablesDcTable function allowed remote attackers to cause a denial of service (memory leak) via a crafted image (bsc#1033128). - CVE-2017-9403: Prevent memory leak in function TIFFReadDirEntryLong8Array, which allowed attackers to cause a denial of service via a crafted file (bsc#1042805). - CVE-2017-9404: Fixed memory leak vulnerability in function OJPEGReadHeaderInfoSecTablesQTable, which allowed attackers to cause a denial of service via a crafted file (bsc#1042804). These various other issues were fixed: - Fix uint32 overflow in TIFFReadEncodedStrip() that caused an integer division by zero. Reported by Agostino Sarubbo. - fix heap-based buffer overflow on generation of PixarLog / LUV compressed files, with ColorMap, TransferFunction attached and nasty plays with bitspersample. The fix for LUV has not been tested, but suffers from the same kind of issue of PixarLog. - modify ChopUpSingleUncompressedStrip() to instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a logic based on the total size of data. Which is faulty is the total size of data is not sufficient to fill the whole image, and thus results in reading outside of the StripByCounts/StripOffsets arrays when using TIFFReadScanline() - make OJPEGDecode() early exit in case of failure in OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues. - fix misleading indentation as warned by GCC. - revert change done on 2016-01-09 that made Param member of TIFFFaxTabEnt structure a uint16 to reduce size of the binary. It happens that the Hylafax software uses the tables that follow this typedef (TIFFFaxMainTable, TIFFFaxWhiteTable, TIFFFaxBlackTable), although they are not in a public libtiff header. - add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants of the functions without ext, with an extra argument to control the stop_on_error behaviour. - fix potential memory leaks in error code path of TIFFRGBAImageBegin(). - increase libjpeg max memory usable to 10 MB instead of libjpeg 1MB default. This helps when creating files with "big" tile, without using libjpeg temporary files. - add _TIFFcalloc() - return 0 in Encode functions instead of -1 when TIFFFlushData1() fails. - only run JPEGFixupTagsSubsampling() if the YCbCrSubsampling tag is not explicitly present. This helps a bit to reduce the I/O amount when the tag is present (especially on cloud hosted files). - in LZWPostEncode(), increase, if necessary, the code bit-width after flushing the remaining code and before emitting the EOI code. - fix memory leak in error code path of PixarLogSetupDecode(). - fix potential memory leak in OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and OJPEGReadHeaderInfoSecTablesAcTable - avoid crash in Fax3Close() on empty file. - TIFFFillStrip(): add limitation to the number of bytes read in case td_stripbytecount[strip] is bigger than reasonable, so as to avoid excessive memory allocation. - fix memory leak when the underlying codec (ZIP, PixarLog) succeeds its setupdecode() method, but PredictorSetup fails. - TIFFFillStrip() and TIFFFillTile(): avoid excessive memory allocation in case of shorten files. Only effective on 64 bit builds and non-mapped cases. - TIFFFillStripPartial() / TIFFSeek(), avoid potential integer overflows with read_ahead in CHUNKY_STRIP_READ_SUPPORT mode. - avoid excessive memory allocation in case of shorten files. Only effective on 64 bit builds. - update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT mode with tif_rawdataloaded when calling TIFFStartStrip() or TIFFFillStripPartial(). - avoid potential int32 overflow in TIFFYCbCrToRGBInit() Fixes - avoid potential int32 overflows in multiply_ms() and add_ms(). - fix out-of-buffer read in PackBitsDecode() Fixes - LogL16InitState(): avoid excessive memory allocation when RowsPerStrip tag is missing. - update dec_bitsleft at beginning of LZWDecode(), and update tif_rawcc at end of LZWDecode(). This is needed to properly work with the latest chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode. - PixarLogDecode(): resync tif_rawcp with next_in and tif_rawcc with avail_in at beginning and end of function, similarly to what is done in LZWDecode(). Likely needed so that it works properly with latest chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode. - initYCbCrConversion(): add basic validation of luma and refBlackWhite coefficients (just check they are not NaN for now), to avoid potential float to int overflows. - _TIFFVSetField(): fix outside range cast of double to float. - initYCbCrConversion(): check luma[1] is not zero to avoid division by zero - _TIFFVSetField(): fix outside range cast of double to float. - initYCbCrConversion(): check luma[1] is not zero to avoid division by zero. - initYCbCrConversion(): stricter validation for refBlackWhite coefficients values. - avoid uint32 underflow in cpDecodedStrips that can cause various issues, such as buffer overflows in the library. - fix readContigStripsIntoBuffer() in -i (ignore) mode so that the output buffer is correctly incremented to avoid write outside bounds. - add 3 extra bytes at end of strip buffer in readSeparateStripsIntoBuffer() to avoid read outside of heap allocated buffer. - fix integer division by zero when BitsPerSample is missing. - fix null pointer dereference in -r mode when the image has no StripByteCount tag. - avoid potential division by zero is BitsPerSamples tag is missing. - when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called, limit the return number of inks to SamplesPerPixel, so that code that parses ink names doesn't go past the end of the buffer. - avoid potential division by zero is BitsPerSamples tag is missing. - fix uint32 underflow/overflow that can cause heap-based buffer overflow. - replace assert( (bps % 8) == 0 ) by a non assert check. - fix 2 heap-based buffer overflows (in PSDataBW and PSDataColorContig). - prevent heap-based buffer overflow in -j mode on a paletted image. - fix wrong usage of memcpy() that can trigger unspecified behaviour. - avoid potential invalid memory read in t2p_writeproc. - avoid potential heap-based overflow in t2p_readwrite_pdf_image_tile(). - remove extraneous TIFFClose() in error code path, that caused double free. - error out cleanly in cpContig2SeparateByRow and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based overflow. - avoid integer division by zero. - call TIFFClose() in error code paths. - emit appropriate message if the input file is empty. - close TIFF handle in error code path. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1118=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.8-21.1 libtiff5-4.0.8-21.1 libtiff5-debuginfo-4.0.8-21.1 tiff-4.0.8-21.1 tiff-debuginfo-4.0.8-21.1 tiff-debugsource-4.0.8-21.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.8-21.1 libtiff5-32bit-4.0.8-21.1 libtiff5-debuginfo-32bit-4.0.8-21.1 - openSUSE Leap 42.2 (i586 x86_64): libtiff-devel-4.0.8-17.6.1 libtiff5-4.0.8-17.6.1 libtiff5-debuginfo-4.0.8-17.6.1 tiff-4.0.8-17.6.1 tiff-debuginfo-4.0.8-17.6.1 tiff-debugsource-4.0.8-17.6.1 - openSUSE Leap 42.2 (x86_64): libtiff-devel-32bit-4.0.8-17.6.1 libtiff5-32bit-4.0.8-17.6.1 libtiff5-debuginfo-32bit-4.0.8-17.6.1 References: https://www.suse.com/security/cve/CVE-2016-10371.html https://www.suse.com/security/cve/CVE-2017-7592.html https://www.suse.com/security/cve/CVE-2017-7593.html https://www.suse.com/security/cve/CVE-2017-7594.html https://www.suse.com/security/cve/CVE-2017-7595.html https://www.suse.com/security/cve/CVE-2017-7596.html https://www.suse.com/security/cve/CVE-2017-7597.html https://www.suse.com/security/cve/CVE-2017-7598.html https://www.suse.com/security/cve/CVE-2017-7599.html https://www.suse.com/security/cve/CVE-2017-7600.html https://www.suse.com/security/cve/CVE-2017-7601.html https://www.suse.com/security/cve/CVE-2017-7602.html https://www.suse.com/security/cve/CVE-2017-9403.html https://www.suse.com/security/cve/CVE-2017-9404.html https://bugzilla.suse.com/1033109 https://bugzilla.suse.com/1033111 https://bugzilla.suse.com/1033112 https://bugzilla.suse.com/1033113 https://bugzilla.suse.com/1033118 https://bugzilla.suse.com/1033120 https://bugzilla.suse.com/1033126 https://bugzilla.suse.com/1033127 https://bugzilla.suse.com/1033128 https://bugzilla.suse.com/1033129 https://bugzilla.suse.com/1033131 https://bugzilla.suse.com/1038438 https://bugzilla.suse.com/1042804 https://bugzilla.suse.com/1042805

1 0

openSUSE-SU-2017:2633-1: important: Security update for dnsmasq
by opensuse-security＠opensuse.org 03 Oct '17

03 Oct '17

openSUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2633-1 Rating: important References: #1060354 #1060355 #1060360 #1060361 #1060362 #1060364 Cross-References: CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for dnsmasq fixes the following security issues: - CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354] - CVE-2017-14492: heap based overflow. [bsc#1060355] - CVE-2017-14493: stack based overflow. [bsc#1060360] - CVE-2017-14494: DHCP - info leak. [bsc#1060361] - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362] - CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364] This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1116=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1116=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): dnsmasq-2.78-13.1 dnsmasq-debuginfo-2.78-13.1 dnsmasq-debugsource-2.78-13.1 dnsmasq-utils-2.78-13.1 dnsmasq-utils-debuginfo-2.78-13.1 - openSUSE Leap 42.2 (i586 x86_64): dnsmasq-2.78-10.6.1 dnsmasq-debuginfo-2.78-10.6.1 dnsmasq-debugsource-2.78-10.6.1 dnsmasq-utils-2.78-10.6.1 dnsmasq-utils-debuginfo-2.78-10.6.1 References: https://www.suse.com/security/cve/CVE-2017-14491.html https://www.suse.com/security/cve/CVE-2017-14492.html https://www.suse.com/security/cve/CVE-2017-14493.html https://www.suse.com/security/cve/CVE-2017-14494.html https://www.suse.com/security/cve/CVE-2017-14495.html https://www.suse.com/security/cve/CVE-2017-14496.html https://bugzilla.suse.com/1060354 https://bugzilla.suse.com/1060355 https://bugzilla.suse.com/1060360 https://bugzilla.suse.com/1060361 https://bugzilla.suse.com/1060362 https://bugzilla.suse.com/1060364

1 0

openSUSE-SU-2017:2632-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 03 Oct '17

03 Oct '17

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2632-1 Rating: moderate References: #1059691 Cross-References: CVE-2017-14635 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for otrs to version 3.3.18 fixes the following issue: This security issue was fixed: - CVE-2017-14635: Remote authenticated users could have leveraged statistics-write permissions to gain privileges via code injection (bsc#1059691). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1117=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1117=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): otrs-3.3.18-9.1 otrs-doc-3.3.18-9.1 otrs-itsm-3.3.14-9.1 - openSUSE Leap 42.2 (noarch): otrs-3.3.18-5.6.1 otrs-doc-3.3.18-5.6.1 otrs-itsm-3.3.14-5.6.1 References: https://www.suse.com/security/cve/CVE-2017-14635.html https://bugzilla.suse.com/1059691

1 0

openSUSE-SU-2017:2615-1: important: Security update for Mozilla Firefox and NSS
by opensuse-security＠opensuse.org 02 Oct '17

02 Oct '17

openSUSE Security Update: Security update for Mozilla Firefox and NSS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2615-1 Rating: important References: #1060445 #1061005 Cross-References: CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update to Mozilla Firefox 52.4esr, along with Mozilla NSS 3.28.6, fixes security issues and bugs. The following vulnerabilities advised upstream under MFSA 2017-22 (boo#1060445) were fixed: - CVE-2017-7793: Use-after-free with Fetch API - CVE-2017-7818: Use-after-free during ARIA array manipulation - CVE-2017-7819: Use-after-free while resizing images in design mode - CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE - CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings - CVE-2017-7823: CSP sandbox directive did not create a unique origin - CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4 The following security issue was fixed in Mozilla NSS 3.28.6: - CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005) The following bug was fixed: - boo#1029917: language accept header use incorrect locale For compatibility reasons, java-1_8_0-openjdk was rebuilt to the updated version of NSS. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1114=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1114=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.144-15.2 java-1_8_0-openjdk-accessibility-1.8.0.144-15.2 java-1_8_0-openjdk-debuginfo-1.8.0.144-15.2 java-1_8_0-openjdk-debugsource-1.8.0.144-15.2 java-1_8_0-openjdk-demo-1.8.0.144-15.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-15.2 java-1_8_0-openjdk-devel-1.8.0.144-15.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.144-15.2 java-1_8_0-openjdk-headless-1.8.0.144-15.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-15.2 java-1_8_0-openjdk-src-1.8.0.144-15.2 libfreebl3-3.28.6-44.1 libfreebl3-debuginfo-3.28.6-44.1 libsoftokn3-3.28.6-44.1 libsoftokn3-debuginfo-3.28.6-44.1 mozilla-nss-3.28.6-44.1 mozilla-nss-certs-3.28.6-44.1 mozilla-nss-certs-debuginfo-3.28.6-44.1 mozilla-nss-debuginfo-3.28.6-44.1 mozilla-nss-debugsource-3.28.6-44.1 mozilla-nss-devel-3.28.6-44.1 mozilla-nss-sysinit-3.28.6-44.1 mozilla-nss-sysinit-debuginfo-3.28.6-44.1 mozilla-nss-tools-3.28.6-44.1 mozilla-nss-tools-debuginfo-3.28.6-44.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.144-15.2 - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.4.0-63.2 MozillaFirefox-branding-upstream-52.4.0-63.2 MozillaFirefox-buildsymbols-52.4.0-63.2 MozillaFirefox-debuginfo-52.4.0-63.2 MozillaFirefox-debugsource-52.4.0-63.2 MozillaFirefox-devel-52.4.0-63.2 MozillaFirefox-translations-common-52.4.0-63.2 MozillaFirefox-translations-other-52.4.0-63.2 libfreebl3-32bit-3.28.6-44.1 libfreebl3-debuginfo-32bit-3.28.6-44.1 libsoftokn3-32bit-3.28.6-44.1 libsoftokn3-debuginfo-32bit-3.28.6-44.1 mozilla-nss-32bit-3.28.6-44.1 mozilla-nss-certs-32bit-3.28.6-44.1 mozilla-nss-certs-debuginfo-32bit-3.28.6-44.1 mozilla-nss-debuginfo-32bit-3.28.6-44.1 mozilla-nss-sysinit-32bit-3.28.6-44.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.6-44.1 - openSUSE Leap 42.3 (i586): MozillaFirefox-52.4.0-63.1 MozillaFirefox-branding-upstream-52.4.0-63.1 MozillaFirefox-buildsymbols-52.4.0-63.1 MozillaFirefox-debuginfo-52.4.0-63.1 MozillaFirefox-debugsource-52.4.0-63.1 MozillaFirefox-devel-52.4.0-63.1 MozillaFirefox-translations-common-52.4.0-63.1 MozillaFirefox-translations-other-52.4.0-63.1 - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.144-10.15.2 java-1_8_0-openjdk-accessibility-1.8.0.144-10.15.2 java-1_8_0-openjdk-debuginfo-1.8.0.144-10.15.2 java-1_8_0-openjdk-debugsource-1.8.0.144-10.15.2 java-1_8_0-openjdk-demo-1.8.0.144-10.15.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.144-10.15.2 java-1_8_0-openjdk-devel-1.8.0.144-10.15.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.144-10.15.2 java-1_8_0-openjdk-headless-1.8.0.144-10.15.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.144-10.15.2 java-1_8_0-openjdk-src-1.8.0.144-10.15.2 libfreebl3-3.28.6-40.10.1 libfreebl3-debuginfo-3.28.6-40.10.1 libsoftokn3-3.28.6-40.10.1 libsoftokn3-debuginfo-3.28.6-40.10.1 mozilla-nss-3.28.6-40.10.1 mozilla-nss-certs-3.28.6-40.10.1 mozilla-nss-certs-debuginfo-3.28.6-40.10.1 mozilla-nss-debuginfo-3.28.6-40.10.1 mozilla-nss-debugsource-3.28.6-40.10.1 mozilla-nss-devel-3.28.6-40.10.1 mozilla-nss-sysinit-3.28.6-40.10.1 mozilla-nss-sysinit-debuginfo-3.28.6-40.10.1 mozilla-nss-tools-3.28.6-40.10.1 mozilla-nss-tools-debuginfo-3.28.6-40.10.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.144-10.15.2 - openSUSE Leap 42.2 (x86_64): MozillaFirefox-52.4.0-57.18.2 MozillaFirefox-branding-upstream-52.4.0-57.18.2 MozillaFirefox-buildsymbols-52.4.0-57.18.2 MozillaFirefox-debuginfo-52.4.0-57.18.2 MozillaFirefox-debugsource-52.4.0-57.18.2 MozillaFirefox-devel-52.4.0-57.18.2 MozillaFirefox-translations-common-52.4.0-57.18.2 MozillaFirefox-translations-other-52.4.0-57.18.2 libfreebl3-32bit-3.28.6-40.10.1 libfreebl3-debuginfo-32bit-3.28.6-40.10.1 libsoftokn3-32bit-3.28.6-40.10.1 libsoftokn3-debuginfo-32bit-3.28.6-40.10.1 mozilla-nss-32bit-3.28.6-40.10.1 mozilla-nss-certs-32bit-3.28.6-40.10.1 mozilla-nss-certs-debuginfo-32bit-3.28.6-40.10.1 mozilla-nss-debuginfo-32bit-3.28.6-40.10.1 mozilla-nss-sysinit-32bit-3.28.6-40.10.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.6-40.10.1 - openSUSE Leap 42.2 (i586): MozillaFirefox-52.4.0-57.18.1 MozillaFirefox-branding-upstream-52.4.0-57.18.1 MozillaFirefox-buildsymbols-52.4.0-57.18.1 MozillaFirefox-debuginfo-52.4.0-57.18.1 MozillaFirefox-debugsource-52.4.0-57.18.1 MozillaFirefox-devel-52.4.0-57.18.1 MozillaFirefox-translations-common-52.4.0-57.18.1 MozillaFirefox-translations-other-52.4.0-57.18.1 References: https://www.suse.com/security/cve/CVE-2017-7793.html https://www.suse.com/security/cve/CVE-2017-7805.html https://www.suse.com/security/cve/CVE-2017-7810.html https://www.suse.com/security/cve/CVE-2017-7814.html https://www.suse.com/security/cve/CVE-2017-7818.html https://www.suse.com/security/cve/CVE-2017-7819.html https://www.suse.com/security/cve/CVE-2017-7823.html https://www.suse.com/security/cve/CVE-2017-7824.html https://bugzilla.suse.com/1060445 https://bugzilla.suse.com/1061005

1 0