January 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:0224-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0224-1 Rating: moderate References: #1077177 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner contains the following fixes and changes (boo#1077177) - Allow changelog-year specification via cmdline - Add groups for rust - Fix bug in otherprovides removal Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-96=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): spec-cleaner-1.0.2-40.1 spec-cleaner-format_spec_file-1.0.2-40.1 References: https://bugzilla.suse.com/1077177

1 0

openSUSE-SU-2018:0223-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0223-1 Rating: important References: #1076369 Cross-References: CVE-2017-3737 CVE-2018-2562 CVE-2018-2573 CVE-2018-2583 CVE-2018-2590 CVE-2018-2591 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2645 CVE-2018-2647 CVE-2018-2665 CVE-2018-2668 CVE-2018-2696 CVE-2018-2703 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for mysql-community-server to version 5.6.39 fixes several issues. These security issues were fixed: - CVE-2018-2622: Vulnerability in the subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2562: Vulnerability in the subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1076369). - CVE-2018-2640: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2665: Vulnerability in the subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2668: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2696: Vulnerability in the subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2583: Vulnerability in the subcomponent: Stored Procedure. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2612: Vulnerability in the subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2703: Vulnerability in the subcomponent: Server : Security : Privileges. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2573: Vulnerability in the subcomponent: Server: GIS. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2017-3737: OpenSSL introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it did not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error - CVE-2018-2647: Vulnerability in the subcomponent: Server: Replication. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1076369). - CVE-2018-2591: Vulnerability in the subcomponent: Server : Partition. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2590: Vulnerability in the subcomponent: Server: Performance Schema. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2645: Vulnerability in the subcomponent: Server: Performance Schema. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data (bsc#1076369). For additional details please see http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-39.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-90=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-90=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.39-33.1 libmysql56client18-debuginfo-5.6.39-33.1 libmysql56client_r18-5.6.39-33.1 mysql-community-server-5.6.39-33.1 mysql-community-server-bench-5.6.39-33.1 mysql-community-server-bench-debuginfo-5.6.39-33.1 mysql-community-server-client-5.6.39-33.1 mysql-community-server-client-debuginfo-5.6.39-33.1 mysql-community-server-debuginfo-5.6.39-33.1 mysql-community-server-debugsource-5.6.39-33.1 mysql-community-server-test-5.6.39-33.1 mysql-community-server-test-debuginfo-5.6.39-33.1 mysql-community-server-tools-5.6.39-33.1 mysql-community-server-tools-debuginfo-5.6.39-33.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.39-33.1 libmysql56client18-debuginfo-32bit-5.6.39-33.1 libmysql56client_r18-32bit-5.6.39-33.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.39-33.1 - openSUSE Leap 42.2 (i586 x86_64): libmysql56client18-5.6.39-24.15.1 libmysql56client18-debuginfo-5.6.39-24.15.1 libmysql56client_r18-5.6.39-24.15.1 mysql-community-server-5.6.39-24.15.1 mysql-community-server-bench-5.6.39-24.15.1 mysql-community-server-bench-debuginfo-5.6.39-24.15.1 mysql-community-server-client-5.6.39-24.15.1 mysql-community-server-client-debuginfo-5.6.39-24.15.1 mysql-community-server-debuginfo-5.6.39-24.15.1 mysql-community-server-debugsource-5.6.39-24.15.1 mysql-community-server-test-5.6.39-24.15.1 mysql-community-server-test-debuginfo-5.6.39-24.15.1 mysql-community-server-tools-5.6.39-24.15.1 mysql-community-server-tools-debuginfo-5.6.39-24.15.1 - openSUSE Leap 42.2 (noarch): mysql-community-server-errormessages-5.6.39-24.15.1 - openSUSE Leap 42.2 (x86_64): libmysql56client18-32bit-5.6.39-24.15.1 libmysql56client18-debuginfo-32bit-5.6.39-24.15.1 libmysql56client_r18-32bit-5.6.39-24.15.1 References: https://www.suse.com/security/cve/CVE-2017-3737.html https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2573.html https://www.suse.com/security/cve/CVE-2018-2583.html https://www.suse.com/security/cve/CVE-2018-2590.html https://www.suse.com/security/cve/CVE-2018-2591.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2645.html https://www.suse.com/security/cve/CVE-2018-2647.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://www.suse.com/security/cve/CVE-2018-2696.html https://www.suse.com/security/cve/CVE-2018-2703.html https://bugzilla.suse.com/1076369

1 0

openSUSE-SU-2018:0222-1: moderate: Security update for tre
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for tre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0222-1 Rating: moderate References: #1005483 Cross-References: CVE-2016-8859 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tre fixes one issue. This security issue was fixed: - CVE-2016-8859: Fixed multiple integer overflows which allowed attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggered an out-of-bounds write (boo#1005483) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-91=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-91=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): agrep-0.8.0_git201402282055-10.1 agrep-debuginfo-0.8.0_git201402282055-10.1 libtre5-0.8.0_git201402282055-10.1 libtre5-debuginfo-0.8.0_git201402282055-10.1 python-tre-0.8.0_git201402282055-10.1 python-tre-debuginfo-0.8.0_git201402282055-10.1 tre-0.8.0_git201402282055-10.1 tre-debugsource-0.8.0_git201402282055-10.1 tre-devel-0.8.0_git201402282055-10.1 - openSUSE Leap 42.3 (noarch): tre-lang-0.8.0_git201402282055-10.1 - openSUSE Leap 42.2 (i586 x86_64): agrep-0.8.0_git201402282055-7.3.1 agrep-debuginfo-0.8.0_git201402282055-7.3.1 libtre5-0.8.0_git201402282055-7.3.1 libtre5-debuginfo-0.8.0_git201402282055-7.3.1 python-tre-0.8.0_git201402282055-7.3.1 python-tre-debuginfo-0.8.0_git201402282055-7.3.1 tre-0.8.0_git201402282055-7.3.1 tre-debugsource-0.8.0_git201402282055-7.3.1 tre-devel-0.8.0_git201402282055-7.3.1 - openSUSE Leap 42.2 (noarch): tre-lang-0.8.0_git201402282055-7.3.1 References: https://www.suse.com/security/cve/CVE-2016-8859.html https://bugzilla.suse.com/1005483

1 0

openSUSE-RU-2018:0221-1: Recommended update for yast2-fcoe-client
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for yast2-fcoe-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0221-1 Rating: low References: #1043419 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-fcoe-client provides the following fix: - Make sure the interface gets correctly named when using auto_vlan=yes. (bsc#1043419) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-94=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-94=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): yast2-fcoe-client-3.1.15-5.1 - openSUSE Leap 42.2 (noarch): yast2-fcoe-client-3.1.15-2.3.1 References: https://bugzilla.suse.com/1043419

1 0

openSUSE-SU-2018:0220-1: moderate: Security update for libevent
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for libevent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0220-1 Rating: moderate References: #1022917 #1022918 #1022919 Cross-References: CVE-2016-10195 CVE-2016-10196 CVE-2016-10197 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libevent fixes the following security issues: - CVE-2016-10195: DNS remote stack overread vulnerability (bsc#1022917) - CVE-2016-10196: stack/buffer overflow in evutil_parse_sockaddr_port() (bsc#1022918) - CVE-2016-10197: out-of-bounds read in search_make_new() (bsc#1022919) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-95=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-95=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libevent-2_0-5-2.0.21-10.1 libevent-2_0-5-debuginfo-2.0.21-10.1 libevent-debugsource-2.0.21-10.1 libevent-devel-2.0.21-10.1 - openSUSE Leap 42.3 (x86_64): libevent-2_0-5-32bit-2.0.21-10.1 libevent-2_0-5-debuginfo-32bit-2.0.21-10.1 - openSUSE Leap 42.2 (i586 x86_64): libevent-2_0-5-2.0.21-7.3.1 libevent-2_0-5-debuginfo-2.0.21-7.3.1 libevent-debugsource-2.0.21-7.3.1 libevent-devel-2.0.21-7.3.1 - openSUSE Leap 42.2 (x86_64): libevent-2_0-5-32bit-2.0.21-7.3.1 libevent-2_0-5-debuginfo-32bit-2.0.21-7.3.1 References: https://www.suse.com/security/cve/CVE-2016-10195.html https://www.suse.com/security/cve/CVE-2016-10196.html https://www.suse.com/security/cve/CVE-2016-10197.html https://bugzilla.suse.com/1022917 https://bugzilla.suse.com/1022918 https://bugzilla.suse.com/1022919

1 0

openSUSE-SU-2018:0218-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0218-1 Rating: moderate References: #1043353 #1043354 #1051442 #1052708 #1052717 #1052777 #1054600 #1055374 #1055455 #1057000 #1062752 Cross-References: CVE-2017-11750 CVE-2017-12641 CVE-2017-12673 CVE-2017-12676 CVE-2017-12935 CVE-2017-13142 CVE-2017-13147 CVE-2017-14103 CVE-2017-15218 CVE-2017-9261 CVE-2017-9262 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2017-9262: The ReadJNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043353) - CVE-2017-9261: The ReadMNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043354) - CVE-2017-11750: The ReadOneJNGImage function in coders/png.c allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1051442) - CVE-2017-12676: Prevent memory leak in the function ReadOneJNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052708) - CVE-2017-12673: Prevent memory leak in the function ReadOneMNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052717) - CVE-2017-12641: Prevent a memory leak vulnerability in ReadOneJNGImage in coders\png.c (bsc#1052777) - CVE-2017-12935: The ReadMNGImage function in coders/png.c mishandled large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c (bsc#1054600) - CVE-2017-13147: Prevent allocation failure in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value (bsc#1055374) - CVE-2017-13142: Added additional checks for short files to prevent a crafted PNG file from triggering a crash (bsc#1055455) - CVE-2017-14103: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c did not properly manage image pointers after certain error conditions, which allowed remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call (bsc#1057000) - CVE-2017-15218: Prevent memory leak in ReadOneJNGImage in coders/png.c (bsc#1062752) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-88=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-88=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-60.1 GraphicsMagick-debuginfo-1.3.25-60.1 GraphicsMagick-debugsource-1.3.25-60.1 GraphicsMagick-devel-1.3.25-60.1 libGraphicsMagick++-Q16-12-1.3.25-60.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-60.1 libGraphicsMagick++-devel-1.3.25-60.1 libGraphicsMagick-Q16-3-1.3.25-60.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-60.1 libGraphicsMagick3-config-1.3.25-60.1 libGraphicsMagickWand-Q16-2-1.3.25-60.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-60.1 perl-GraphicsMagick-1.3.25-60.1 perl-GraphicsMagick-debuginfo-1.3.25-60.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.63.1 GraphicsMagick-debuginfo-1.3.25-11.63.1 GraphicsMagick-debugsource-1.3.25-11.63.1 GraphicsMagick-devel-1.3.25-11.63.1 libGraphicsMagick++-Q16-12-1.3.25-11.63.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.63.1 libGraphicsMagick++-devel-1.3.25-11.63.1 libGraphicsMagick-Q16-3-1.3.25-11.63.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.63.1 libGraphicsMagick3-config-1.3.25-11.63.1 libGraphicsMagickWand-Q16-2-1.3.25-11.63.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.63.1 perl-GraphicsMagick-1.3.25-11.63.1 perl-GraphicsMagick-debuginfo-1.3.25-11.63.1 References: https://www.suse.com/security/cve/CVE-2017-11750.html https://www.suse.com/security/cve/CVE-2017-12641.html https://www.suse.com/security/cve/CVE-2017-12673.html https://www.suse.com/security/cve/CVE-2017-12676.html https://www.suse.com/security/cve/CVE-2017-12935.html https://www.suse.com/security/cve/CVE-2017-13142.html https://www.suse.com/security/cve/CVE-2017-13147.html https://www.suse.com/security/cve/CVE-2017-14103.html https://www.suse.com/security/cve/CVE-2017-15218.html https://www.suse.com/security/cve/CVE-2017-9261.html https://www.suse.com/security/cve/CVE-2017-9262.html https://bugzilla.suse.com/1043353 https://bugzilla.suse.com/1043354 https://bugzilla.suse.com/1051442 https://bugzilla.suse.com/1052708 https://bugzilla.suse.com/1052717 https://bugzilla.suse.com/1052777 https://bugzilla.suse.com/1054600 https://bugzilla.suse.com/1055374 https://bugzilla.suse.com/1055455 https://bugzilla.suse.com/1057000 https://bugzilla.suse.com/1062752

1 0

openSUSE-SU-2018:0211-1: moderate: Security update for libexif
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for libexif ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0211-1 Rating: moderate References: #1055857 #1059893 Cross-References: CVE-2016-6328 CVE-2017-7544 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libexif fixes several issues. These security issues were fixed: - CVE-2016-6328: Fixed integer overflow in parsing MNOTE entry data of the input file (bsc#1055857) - CVE-2017-7544: Fixed out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure (bsc#1059893) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-86=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-86=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libexif-debugsource-0.6.21-15.1 libexif-devel-0.6.21-15.1 libexif12-0.6.21-15.1 libexif12-debuginfo-0.6.21-15.1 - openSUSE Leap 42.3 (x86_64): libexif12-32bit-0.6.21-15.1 libexif12-debuginfo-32bit-0.6.21-15.1 - openSUSE Leap 42.2 (i586 x86_64): libexif-debugsource-0.6.21-12.3.1 libexif-devel-0.6.21-12.3.1 libexif12-0.6.21-12.3.1 libexif12-debuginfo-0.6.21-12.3.1 - openSUSE Leap 42.2 (x86_64): libexif12-32bit-0.6.21-12.3.1 libexif12-debuginfo-32bit-0.6.21-12.3.1 References: https://www.suse.com/security/cve/CVE-2016-6328.html https://www.suse.com/security/cve/CVE-2017-7544.html https://bugzilla.suse.com/1055857 https://bugzilla.suse.com/1059893

1 0

openSUSE-SU-2018:0210-1: moderate: Security update for libvpx
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for libvpx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0210-1 Rating: moderate References: #1075992 Cross-References: CVE-2017-13194 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvpx fixes one issues. This security issue was fixed: - CVE-2017-13194: Fixed incorrect memory allocation related to odd frame width (bsc#1075992). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-87=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-87=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvpx-debugsource-1.3.0-8.1 libvpx-devel-1.3.0-8.1 libvpx1-1.3.0-8.1 libvpx1-debuginfo-1.3.0-8.1 vpx-tools-1.3.0-8.1 vpx-tools-debuginfo-1.3.0-8.1 - openSUSE Leap 42.3 (x86_64): libvpx1-32bit-1.3.0-8.1 libvpx1-debuginfo-32bit-1.3.0-8.1 - openSUSE Leap 42.2 (i586 x86_64): libvpx-debugsource-1.3.0-5.3.1 libvpx-devel-1.3.0-5.3.1 libvpx1-1.3.0-5.3.1 libvpx1-debuginfo-1.3.0-5.3.1 vpx-tools-1.3.0-5.3.1 vpx-tools-debuginfo-1.3.0-5.3.1 - openSUSE Leap 42.2 (x86_64): libvpx1-32bit-1.3.0-5.3.1 libvpx1-debuginfo-32bit-1.3.0-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-13194.html https://bugzilla.suse.com/1075992

1 0

openSUSE-RU-2018:0209-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0209-1 Rating: moderate References: #1069777 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - The KDE Plasma workspace may have crashed after switching activities (boo#1069777) - Auto-hide panels containing the global menu would not be visible on menu activation (kde#384861) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-78=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): drkonqi5-5.8.7-5.1 drkonqi5-debuginfo-5.8.7-5.1 plasma5-workspace-5.8.7-5.1 plasma5-workspace-debuginfo-5.8.7-5.1 plasma5-workspace-debugsource-5.8.7-5.1 plasma5-workspace-devel-5.8.7-5.1 plasma5-workspace-libs-5.8.7-5.1 plasma5-workspace-libs-debuginfo-5.8.7-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-workspace-lang-5.8.7-5.1 References: https://bugzilla.suse.com/1069777

1 0

openSUSE-RU-2018:0208-1: Recommended update for yast2-firstboot
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for yast2-firstboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0208-1 Rating: low References: #1028371 #1070388 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-firstboot provides the following fix: - Bring back HostnameDialog adding it into firstboot_hostname once it was removed from yast2-network (bsc#1028371, bsc#1070388) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-79=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-79=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): yast2-firstboot-3.1.18-5.1 - openSUSE Leap 42.2 (noarch): yast2-firstboot-3.1.18-2.3.1 References: https://bugzilla.suse.com/1028371 https://bugzilla.suse.com/1070388

1 0