May 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1191-1: Recommended update for sqlite3
by maintenance＠opensuse.org 06 May '17

06 May '17

openSUSE Recommended Update: Recommended update for sqlite3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1191-1 Rating: low References: #1019518 #1025034 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for sqlite3 provides the following fixes: - Avoid calling sqlite3OsFetch() on a file-handle for which the xFetch method is NULL. This prevents a potential segmentation fault. (bsc#1025034) - Fix defect in the in-memory journal logic that could leave the read cursor for the in-memory journal in an inconsistent state and result in a segmentation fault. (bsc#1019518) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-546=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-546=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsqlite3-0-3.8.10.2-8.3.1 libsqlite3-0-debuginfo-3.8.10.2-8.3.1 sqlite3-3.8.10.2-8.3.1 sqlite3-debuginfo-3.8.10.2-8.3.1 sqlite3-debugsource-3.8.10.2-8.3.1 sqlite3-devel-3.8.10.2-8.3.1 - openSUSE Leap 42.2 (noarch): sqlite3-doc-3.8.10.2-8.3.1 - openSUSE Leap 42.2 (x86_64): libsqlite3-0-32bit-3.8.10.2-8.3.1 libsqlite3-0-debuginfo-32bit-3.8.10.2-8.3.1 - openSUSE Leap 42.1 (i586 x86_64): libsqlite3-0-3.8.10.2-10.1 libsqlite3-0-debuginfo-3.8.10.2-10.1 sqlite3-3.8.10.2-10.1 sqlite3-debuginfo-3.8.10.2-10.1 sqlite3-debugsource-3.8.10.2-10.1 sqlite3-devel-3.8.10.2-10.1 - openSUSE Leap 42.1 (noarch): sqlite3-doc-3.8.10.2-10.1 - openSUSE Leap 42.1 (x86_64): libsqlite3-0-32bit-3.8.10.2-10.1 libsqlite3-0-debuginfo-32bit-3.8.10.2-10.1 References: https://bugzilla.suse.com/1019518 https://bugzilla.suse.com/1025034

1 0

openSUSE-SU-2017:1190-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 06 May '17

06 May '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1190-1 Rating: important References: #1037594 Cross-References: CVE-2017-5068 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to Chromium 58.0.3029.96 fixes one security issue: - CVE-2017-5068: race condition in WebRTC (bsc#1037594) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-541=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-541=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-58.0.3029.96-104.12.1 chromedriver-debuginfo-58.0.3029.96-104.12.1 chromium-58.0.3029.96-104.12.1 chromium-debuginfo-58.0.3029.96-104.12.1 chromium-debugsource-58.0.3029.96-104.12.1 - openSUSE Leap 42.1 (x86_64): chromedriver-58.0.3029.96-114.1 chromedriver-debuginfo-58.0.3029.96-114.1 chromium-58.0.3029.96-114.1 chromium-debuginfo-58.0.3029.96-114.1 chromium-debugsource-58.0.3029.96-114.1 References: https://www.suse.com/security/cve/CVE-2017-5068.html https://bugzilla.suse.com/1037594

1 0

openSUSE-RU-2017:1189-1: Recommended update for os-prober
by maintenance＠opensuse.org 06 May '17

06 May '17

openSUSE Recommended Update: Recommended update for os-prober ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1189-1 Rating: low References: #1008444 #997465 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for os-prober provides the following fixes: - Remove the wildcard test for ld.so. It is inaccurate, slow and could hang for a long time in some circumstances. (bsc#1008444) - Parse /etc/os-release for openSUSE Tumbleweed. (bsc#997465) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-540=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-540=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): os-prober-1.61-20.3.1 os-prober-debuginfo-1.61-20.3.1 os-prober-debugsource-1.61-20.3.1 - openSUSE Leap 42.1 (i586 x86_64): os-prober-1.61-21.1 os-prober-debuginfo-1.61-21.1 os-prober-debugsource-1.61-21.1 References: https://bugzilla.suse.com/1008444 https://bugzilla.suse.com/997465

1 0

openSUSE-SU-2017:1177-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 04 May '17

04 May '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1177-1 Rating: low References: #1034876 Cross-References: CVE-2017-7941 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes one issue. This security issue was fixed: - CVE-2017-7941: The ReadSGIImage function in sgi.c in ImageMagick allowed remote attackers to consume an amount of available memory via a crafted file (boo#1034876). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-538=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-32.1 GraphicsMagick-debuginfo-1.3.21-32.1 GraphicsMagick-debugsource-1.3.21-32.1 GraphicsMagick-devel-1.3.21-32.1 libGraphicsMagick++-Q16-11-1.3.21-32.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-32.1 libGraphicsMagick++-devel-1.3.21-32.1 libGraphicsMagick-Q16-3-1.3.21-32.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-32.1 libGraphicsMagick3-config-1.3.21-32.1 libGraphicsMagickWand-Q16-2-1.3.21-32.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-32.1 perl-GraphicsMagick-1.3.21-32.1 perl-GraphicsMagick-debuginfo-1.3.21-32.1 References: https://www.suse.com/security/cve/CVE-2017-7941.html https://bugzilla.suse.com/1034876

1 0

openSUSE-RU-2017:1176-1: Recommended update for crash
by maintenance＠opensuse.org 04 May '17

04 May '17

openSUSE Recommended Update: Recommended update for crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1176-1 Rating: low References: #1013843 #1022962 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crash provides the following fixes: - Fix analyzing fadump (and qemu) dumps on PPC64 systems with 32TB of memory. (bsc#1022962) The following tracked packaging change was included: - do not build rt kernel module package on openSUSE. (bsc#1013843) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-539=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): crash-7.1.5-2.5.1 crash-debuginfo-7.1.5-2.5.1 crash-debugsource-7.1.5-2.5.1 crash-devel-7.1.5-2.5.1 crash-doc-7.1.5-2.5.1 crash-eppic-7.1.5-2.5.1 crash-eppic-debuginfo-7.1.5-2.5.1 crash-gcore-7.1.5-2.5.1 crash-gcore-debuginfo-7.1.5-2.5.1 - openSUSE Leap 42.2 (x86_64): crash-kmp-default-7.1.5_k4.4.57_18.3-2.5.1 crash-kmp-default-debuginfo-7.1.5_k4.4.57_18.3-2.5.1 References: https://bugzilla.suse.com/1013843 https://bugzilla.suse.com/1022962

1 0

openSUSE-RU-2017:1152-1: Recommended update for clamav-database
by maintenance＠opensuse.org 03 May '17

03 May '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1152-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh May 1st. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-537=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-537=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201705010006-54.21.1 - openSUSE Leap 42.1 (noarch): clamav-database-201705010006-252.1 References:

1 0

openSUSE-SU-2017:1150-1: moderate: Security update for weechat
by opensuse-security＠opensuse.org 02 May '17

02 May '17

openSUSE Security Update: Security update for weechat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1150-1 Rating: moderate References: #1036467 Cross-References: CVE-2017-8073 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for weechat fixes one security issues: - CVE-2017-8073: WeeChat allowed a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow (bsc#1036467). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-536=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): weechat-1.5-2.3.1 weechat-aspell-1.5-2.3.1 weechat-aspell-debuginfo-1.5-2.3.1 weechat-debuginfo-1.5-2.3.1 weechat-debugsource-1.5-2.3.1 weechat-devel-1.5-2.3.1 weechat-doc-1.5-2.3.1 weechat-guile-1.5-2.3.1 weechat-guile-debuginfo-1.5-2.3.1 weechat-lua-1.5-2.3.1 weechat-lua-debuginfo-1.5-2.3.1 weechat-perl-1.5-2.3.1 weechat-perl-debuginfo-1.5-2.3.1 weechat-python-1.5-2.3.1 weechat-python-debuginfo-1.5-2.3.1 weechat-ruby-1.5-2.3.1 weechat-ruby-debuginfo-1.5-2.3.1 weechat-tcl-1.5-2.3.1 weechat-tcl-debuginfo-1.5-2.3.1 - openSUSE Leap 42.2 (noarch): weechat-lang-1.5-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-8073.html https://bugzilla.suse.com/1036467

1 0

openSUSE-OU-2017:1144-1: moderate: Add MongoDB to the SUSE Package Hub
by maintenance＠opensuse.org 02 May '17

02 May '17

openSUSE Optional Update: Add MongoDB to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:1144-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update makes MongoDB 3.4.3 available in the SUSE Package Hub. MongoDB is a document-oriented database system. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-535=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): mongodb-3.4.3-2.1 mongodb-mongoperf-3.4.3-2.1 mongodb-mongos-3.4.3-2.1 mongodb-server-3.4.3-2.1 mongodb-shell-3.4.3-2.1 References:

1 0

openSUSE-SU-2017:1142-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 02 May '17

02 May '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1142-1 Rating: important References: #1034854 Cross-References: CVE-2017-3513 CVE-2017-3538 CVE-2017-3558 CVE-2017-3559 CVE-2017-3561 CVE-2017-3563 CVE-2017-3575 CVE-2017-3576 CVE-2017-3587 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for virtualbox to version 5.1.22 fixes the following issues: These security issues were fixed (bsc#1034854): - CVE-2017-3561: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2017-3563: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2017-3576: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2017-3587: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2017-3575: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2017-3538: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2017-3513: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2017-3558: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2017-3559: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. These non-security issues were fixed: - GUI: don't check if the Extension Pack is up-to-date if the user is about to install a new Extension Pack - GUI: fixed a possible crash when switching a multi-monitor VM into full-screen or seamless mode - GUI: several mini-toolbar fixes in full-screen / seamless mode - GUI: don't crash on restoring defaults in the appliance import dialog - ICH9: fix for Windows guests with a huge amount (more than 64G) of guest memory - BIOS: fixed El Torito hard disk emulation geometry calculation - VMM: fixed VERR_IEM_INSTR_NOT_IMPLEMENTED Guru Meditation under certain conditions - Storage: fixed a potential hang under rare circumstances - Storage: fixed a potential crash under rare circumstances (asynchronous I/O disabled or during maintenance file operations like merging snapshots) - Linux hosts: make the ALSA backend work again as well as loading the GL libraries on certain hosts - Linux Additions: fixed mount.vboxsf symlink problem Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-533=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.22-19.10.1 python-virtualbox-debuginfo-5.1.22-19.10.1 virtualbox-5.1.22-19.10.1 virtualbox-debuginfo-5.1.22-19.10.1 virtualbox-debugsource-5.1.22-19.10.1 virtualbox-devel-5.1.22-19.10.1 virtualbox-guest-kmp-default-5.1.22_k4.4.57_18.3-19.10.1 virtualbox-guest-kmp-default-debuginfo-5.1.22_k4.4.57_18.3-19.10.1 virtualbox-guest-tools-5.1.22-19.10.1 virtualbox-guest-tools-debuginfo-5.1.22-19.10.1 virtualbox-guest-x11-5.1.22-19.10.1 virtualbox-guest-x11-debuginfo-5.1.22-19.10.1 virtualbox-host-kmp-default-5.1.22_k4.4.57_18.3-19.10.1 virtualbox-host-kmp-default-debuginfo-5.1.22_k4.4.57_18.3-19.10.1 virtualbox-qt-5.1.22-19.10.1 virtualbox-qt-debuginfo-5.1.22-19.10.1 virtualbox-websrv-5.1.22-19.10.1 virtualbox-websrv-debuginfo-5.1.22-19.10.1 - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.22-19.10.1 virtualbox-host-source-5.1.22-19.10.1 References: https://www.suse.com/security/cve/CVE-2017-3513.html https://www.suse.com/security/cve/CVE-2017-3538.html https://www.suse.com/security/cve/CVE-2017-3558.html https://www.suse.com/security/cve/CVE-2017-3559.html https://www.suse.com/security/cve/CVE-2017-3561.html https://www.suse.com/security/cve/CVE-2017-3563.html https://www.suse.com/security/cve/CVE-2017-3575.html https://www.suse.com/security/cve/CVE-2017-3576.html https://www.suse.com/security/cve/CVE-2017-3587.html https://bugzilla.suse.com/1034854

1 0

openSUSE-SU-2017:1141-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 02 May '17

02 May '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1141-1 Rating: important References: #1034854 Cross-References: CVE-2017-3513 CVE-2017-3538 CVE-2017-3558 CVE-2017-3559 CVE-2017-3561 CVE-2017-3563 CVE-2017-3575 CVE-2017-3576 CVE-2017-3587 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update to virtualbox 5.0.40 fixes the following issues: These security issues were fixed (bsc#1034854): - CVE-2017-3513: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2017-3538: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2017-3558: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2017-3559: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2017-3561: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2017-3563: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2017-3575: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2017-3576: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2017-3587: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. These non-security issues were fixed: - Storage: fixed a potential hang under rare circumstances - Storage: fixed a potential crash under rare circumstances (asynchronous I/O disabled or during maintenance file operations like merging snapshots) - Storage: fixed a potential crash under rare circumstances (no asynchronous I/O or during maintenance file operations like merging snapshots) - Linux hosts: make the ALSA backend work again as well as Loading the GL libraries on certain hosts - GUI: don't crash on restoring defaults in the appliance import dialog Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-534=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): virtualbox-guest-desktop-icons-5.0.40-40.1 virtualbox-host-source-5.0.40-40.1 - openSUSE Leap 42.1 (x86_64): python-virtualbox-5.0.40-40.1 python-virtualbox-debuginfo-5.0.40-40.1 virtualbox-5.0.40-40.1 virtualbox-debuginfo-5.0.40-40.1 virtualbox-debugsource-5.0.40-40.1 virtualbox-devel-5.0.40-40.1 virtualbox-guest-kmp-default-5.0.40_k4.1.39_53-40.1 virtualbox-guest-kmp-default-debuginfo-5.0.40_k4.1.39_53-40.1 virtualbox-guest-tools-5.0.40-40.1 virtualbox-guest-tools-debuginfo-5.0.40-40.1 virtualbox-guest-x11-5.0.40-40.1 virtualbox-guest-x11-debuginfo-5.0.40-40.1 virtualbox-host-kmp-default-5.0.40_k4.1.39_53-40.1 virtualbox-host-kmp-default-debuginfo-5.0.40_k4.1.39_53-40.1 virtualbox-qt-5.0.40-40.1 virtualbox-qt-debuginfo-5.0.40-40.1 virtualbox-websrv-5.0.40-40.1 virtualbox-websrv-debuginfo-5.0.40-40.1 References: https://www.suse.com/security/cve/CVE-2017-3513.html https://www.suse.com/security/cve/CVE-2017-3538.html https://www.suse.com/security/cve/CVE-2017-3558.html https://www.suse.com/security/cve/CVE-2017-3559.html https://www.suse.com/security/cve/CVE-2017-3561.html https://www.suse.com/security/cve/CVE-2017-3563.html https://www.suse.com/security/cve/CVE-2017-3575.html https://www.suse.com/security/cve/CVE-2017-3576.html https://www.suse.com/security/cve/CVE-2017-3587.html https://bugzilla.suse.com/1034854

1 0