January 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:0327-1: moderate: Recommended update for multipath-tools, rdma-core
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for multipath-tools, rdma-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0327-1 Rating: moderate References: #1033541 #1037533 #1038865 #1043027 #1045111 #1046092 #1047180 #1049515 #1053515 #1058504 #1058539 #1060413 #1063639 #1063642 #1063697 #1063698 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: This update for multipath-tools and rdma-core provides fixes and enhancements. multipath-tools: - Adjust kpartx.rules so that the link priority is not increased when DM_UDEV_LOW_PRIORITY_FLAG is set. (bsc#1047180) - Fix timeout caused by a deadlock when processing "add map" commands. (bsc#1053515) - Fix queue_if_no_path logic, avoiding warnings when conflicting configuration options are found. (bsc#1043027) - Ensure that option "no_path_retry" always takes precedence over "features queue_if_no_path", and fix respective log messages and documentation. (bsc#1043027) - Backport many fixes and enhancements for kpartx. (bsc#1037533, bsc#1033541) - Ensure strings printed are always null terminated. (bsc#1038865) - Fix syntax error in kpartx.rules. (bsc#1046092) - Default to running kpartx in sync mode, waiting until requested operation is finished. rdma-core: - Fix a byte order issue which causes ibacm to fail to join a multicast group on recent on recent kernels. (bsc#1063639, bsc#1063697) - Fix a segmentation fault of ibacm when a provider other than default is set. (bsc#1063642, bsc#1063698) - Add support for new Broadcom devices. (bsc#1060413) - Remove runtime dependency on dracut. (bsc#1058504) - Fix issue with umad when QSFP is not plugged in. (bsc#1058539) - Fix a problem with SRP daemon not handling subnet manager changes properly. (bsc#1049515) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-120=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ibacm-14-8.1 ibacm-debuginfo-14-8.1 iwpmd-14-8.1 iwpmd-debuginfo-14-8.1 kpartx-0.7.1+71+suse.632dbce970c0-6.1 kpartx-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 libdmmp-devel-0.7.1+71+suse.632dbce970c0-6.1 libdmmp0_1_0-0.7.1+71+suse.632dbce970c0-6.1 libdmmp0_1_0-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 libibcm1-14-8.1 libibcm1-debuginfo-14-8.1 libibumad3-14-8.1 libibumad3-debuginfo-14-8.1 libibverbs-14-8.1 libibverbs-debuginfo-14-8.1 libibverbs-utils-14-8.1 libibverbs-utils-debuginfo-14-8.1 libibverbs1-14-8.1 libibverbs1-debuginfo-14-8.1 libmlx5-1-14-8.1 libmlx5-1-debuginfo-14-8.1 librdmacm-utils-14-8.1 librdmacm-utils-debuginfo-14-8.1 librdmacm1-14-8.1 librdmacm1-debuginfo-14-8.1 multipath-tools-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-debugsource-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-devel-0.7.1+71+suse.632dbce970c0-6.1 rdma-core-14-8.1 rdma-core-debugsource-14-8.1 rdma-core-devel-14-8.1 rdma-ndd-14-8.1 rdma-ndd-debuginfo-14-8.1 rsocket-14-8.1 rsocket-debuginfo-14-8.1 srp_daemon-14-8.1 srp_daemon-debuginfo-14-8.1 - openSUSE Leap 42.3 (x86_64): libibcm1-32bit-14-8.1 libibcm1-debuginfo-32bit-14-8.1 libibumad3-32bit-14-8.1 libibumad3-debuginfo-32bit-14-8.1 libibverbs-32bit-14-8.1 libibverbs-debuginfo-32bit-14-8.1 libibverbs1-32bit-14-8.1 libibverbs1-debuginfo-32bit-14-8.1 libmlx5-1-32bit-14-8.1 libmlx5-1-debuginfo-32bit-14-8.1 librdmacm1-32bit-14-8.1 librdmacm1-debuginfo-32bit-14-8.1 rdma-core-devel-32bit-14-8.1 rsocket-32bit-14-8.1 rsocket-debuginfo-32bit-14-8.1 References: https://bugzilla.suse.com/1033541 https://bugzilla.suse.com/1037533 https://bugzilla.suse.com/1038865 https://bugzilla.suse.com/1043027 https://bugzilla.suse.com/1045111 https://bugzilla.suse.com/1046092 https://bugzilla.suse.com/1047180 https://bugzilla.suse.com/1049515 https://bugzilla.suse.com/1053515 https://bugzilla.suse.com/1058504 https://bugzilla.suse.com/1058539 https://bugzilla.suse.com/1060413 https://bugzilla.suse.com/1063639 https://bugzilla.suse.com/1063642 https://bugzilla.suse.com/1063697 https://bugzilla.suse.com/1063698

1 0

openSUSE-SU-2018:0326-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0326-1 Rating: important References: #1020950 #1024749 #1050469 #1066892 #1069925 #1073654 #1075419 Cross-References: CVE-2016-4692 CVE-2016-4743 CVE-2016-7586 CVE-2016-7587 CVE-2016-7589 CVE-2016-7592 CVE-2016-7598 CVE-2016-7599 CVE-2016-7610 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 CVE-2017-13788 CVE-2017-13798 CVE-2017-13803 CVE-2017-13856 CVE-2017-13866 CVE-2017-13870 CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 CVE-2017-2496 CVE-2017-2510 CVE-2017-2539 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-7006 CVE-2017-7011 CVE-2017-7012 CVE-2017-7018 CVE-2017-7019 CVE-2017-7020 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7038 CVE-2017-7039 CVE-2017-7040 CVE-2017-7041 CVE-2017-7042 CVE-2017-7043 CVE-2017-7046 CVE-2017-7048 CVE-2017-7049 CVE-2017-7052 CVE-2017-7055 CVE-2017-7056 CVE-2017-7059 CVE-2017-7061 CVE-2017-7064 CVE-2017-7081 CVE-2017-7087 CVE-2017-7089 CVE-2017-7090 CVE-2017-7091 CVE-2017-7092 CVE-2017-7093 CVE-2017-7094 CVE-2017-7095 CVE-2017-7096 CVE-2017-7098 CVE-2017-7099 CVE-2017-7100 CVE-2017-7102 CVE-2017-7104 CVE-2017-7107 CVE-2017-7109 CVE-2017-7111 CVE-2017-7117 CVE-2017-7120 CVE-2017-7142 CVE-2017-7156 CVE-2017-7157 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 89 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5: + Disable SharedArrayBuffers from Web API. + Reduce the precision of "high" resolution time to 1ms. + bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4: + Make WebDriver implementation more spec compliant. + Fix a bug when trying to remove cookies before a web process is spawned. + WebKitWebDriver process no longer links to libjavascriptcoregtk. + Fix several memory leaks in GStreamer media backend. + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3: + Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. + Fix handling of null capabilities in WebDriver implementation. + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2: + Fix rendering of arabic text. + Fix a crash in the web process when decoding GIF images. + Fix rendering of wind in Windy.com. + Fix several crashes and rendering issues. Update to version 2.18.1: + Improve performance of GIF animations. + Fix garbled display in GMail. + Fix rendering of several material design icons when using the web font. + Fix flickering when resizing the window in Wayland. + Prevent default kerberos authentication credentials from being used in ephemeral sessions. + Fix a crash when webkit_web_resource_get_data() is cancelled. + Correctly handle touchmove and touchend events in WebKitWebView. + Fix the build with enchant 2.1.1. + Fix the build in HPPA and Alpha. + Fix several crashes and rendering issues. + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142. - Enable gold linker on s390/s390x on SLE15/Tumbleweed. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-8.1 libwebkit2gtk-4_0-37-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-2.18.5-8.1 typelib-1_0-JavaScriptCore-4_0-2.18.5-8.1 typelib-1_0-WebKit2-4_0-2.18.5-8.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.5-8.1 webkit-jsc-4-2.18.5-8.1 webkit-jsc-4-debuginfo-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-8.1 webkit2gtk3-debugsource-2.18.5-8.1 webkit2gtk3-devel-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.5-8.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.5-8.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.18.5-8.1 References: https://www.suse.com/security/cve/CVE-2016-4692.html https://www.suse.com/security/cve/CVE-2016-4743.html https://www.suse.com/security/cve/CVE-2016-7586.html https://www.suse.com/security/cve/CVE-2016-7587.html https://www.suse.com/security/cve/CVE-2016-7589.html https://www.suse.com/security/cve/CVE-2016-7592.html https://www.suse.com/security/cve/CVE-2016-7598.html https://www.suse.com/security/cve/CVE-2016-7599.html https://www.suse.com/security/cve/CVE-2016-7610.html https://www.suse.com/security/cve/CVE-2016-7623.html https://www.suse.com/security/cve/CVE-2016-7632.html https://www.suse.com/security/cve/CVE-2016-7635.html https://www.suse.com/security/cve/CVE-2016-7639.html https://www.suse.com/security/cve/CVE-2016-7641.html https://www.suse.com/security/cve/CVE-2016-7645.html https://www.suse.com/security/cve/CVE-2016-7652.html https://www.suse.com/security/cve/CVE-2016-7654.html https://www.suse.com/security/cve/CVE-2016-7656.html https://www.suse.com/security/cve/CVE-2017-13788.html https://www.suse.com/security/cve/CVE-2017-13798.html https://www.suse.com/security/cve/CVE-2017-13803.html https://www.suse.com/security/cve/CVE-2017-13856.html https://www.suse.com/security/cve/CVE-2017-13866.html https://www.suse.com/security/cve/CVE-2017-13870.html https://www.suse.com/security/cve/CVE-2017-2350.html https://www.suse.com/security/cve/CVE-2017-2354.html https://www.suse.com/security/cve/CVE-2017-2355.html https://www.suse.com/security/cve/CVE-2017-2356.html https://www.suse.com/security/cve/CVE-2017-2362.html https://www.suse.com/security/cve/CVE-2017-2363.html https://www.suse.com/security/cve/CVE-2017-2364.html https://www.suse.com/security/cve/CVE-2017-2365.html https://www.suse.com/security/cve/CVE-2017-2366.html https://www.suse.com/security/cve/CVE-2017-2369.html https://www.suse.com/security/cve/CVE-2017-2371.html https://www.suse.com/security/cve/CVE-2017-2373.html https://www.suse.com/security/cve/CVE-2017-2496.html https://www.suse.com/security/cve/CVE-2017-2510.html https://www.suse.com/security/cve/CVE-2017-2539.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-7006.html https://www.suse.com/security/cve/CVE-2017-7011.html https://www.suse.com/security/cve/CVE-2017-7012.html https://www.suse.com/security/cve/CVE-2017-7018.html https://www.suse.com/security/cve/CVE-2017-7019.html https://www.suse.com/security/cve/CVE-2017-7020.html https://www.suse.com/security/cve/CVE-2017-7030.html https://www.suse.com/security/cve/CVE-2017-7034.html https://www.suse.com/security/cve/CVE-2017-7037.html https://www.suse.com/security/cve/CVE-2017-7038.html https://www.suse.com/security/cve/CVE-2017-7039.html https://www.suse.com/security/cve/CVE-2017-7040.html https://www.suse.com/security/cve/CVE-2017-7041.html https://www.suse.com/security/cve/CVE-2017-7042.html https://www.suse.com/security/cve/CVE-2017-7043.html https://www.suse.com/security/cve/CVE-2017-7046.html https://www.suse.com/security/cve/CVE-2017-7048.html https://www.suse.com/security/cve/CVE-2017-7049.html https://www.suse.com/security/cve/CVE-2017-7052.html https://www.suse.com/security/cve/CVE-2017-7055.html https://www.suse.com/security/cve/CVE-2017-7056.html https://www.suse.com/security/cve/CVE-2017-7059.html https://www.suse.com/security/cve/CVE-2017-7061.html https://www.suse.com/security/cve/CVE-2017-7064.html https://www.suse.com/security/cve/CVE-2017-7081.html https://www.suse.com/security/cve/CVE-2017-7087.html https://www.suse.com/security/cve/CVE-2017-7089.html https://www.suse.com/security/cve/CVE-2017-7090.html https://www.suse.com/security/cve/CVE-2017-7091.html https://www.suse.com/security/cve/CVE-2017-7092.html https://www.suse.com/security/cve/CVE-2017-7093.html https://www.suse.com/security/cve/CVE-2017-7094.html https://www.suse.com/security/cve/CVE-2017-7095.html https://www.suse.com/security/cve/CVE-2017-7096.html https://www.suse.com/security/cve/CVE-2017-7098.html https://www.suse.com/security/cve/CVE-2017-7099.html https://www.suse.com/security/cve/CVE-2017-7100.html https://www.suse.com/security/cve/CVE-2017-7102.html https://www.suse.com/security/cve/CVE-2017-7104.html https://www.suse.com/security/cve/CVE-2017-7107.html https://www.suse.com/security/cve/CVE-2017-7109.html https://www.suse.com/security/cve/CVE-2017-7111.html https://www.suse.com/security/cve/CVE-2017-7117.html https://www.suse.com/security/cve/CVE-2017-7120.html https://www.suse.com/security/cve/CVE-2017-7142.html https://www.suse.com/security/cve/CVE-2017-7156.html https://www.suse.com/security/cve/CVE-2017-7157.html https://bugzilla.suse.com/1020950 https://bugzilla.suse.com/1024749 https://bugzilla.suse.com/1050469 https://bugzilla.suse.com/1066892 https://bugzilla.suse.com/1069925 https://bugzilla.suse.com/1073654 https://bugzilla.suse.com/1075419

1 0

openSUSE-RU-2018:0325-1: Recommended update for k3b
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0325-1 Rating: low References: #1077728 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for k3b contains the following fix: - build with libmad, lame and ffmpeg, no longer show a warning that libmap is not available (boo#1077728) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-110=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): k3b-lang-17.04.2-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): k3b-17.04.2-8.1 k3b-debuginfo-17.04.2-8.1 k3b-debugsource-17.04.2-8.1 k3b-devel-17.04.2-8.1 References: https://bugzilla.suse.com/1077728

1 0

openSUSE-SU-2018:0324-1: moderate: Security update for libtasn1
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0324-1 Rating: moderate References: #1076832 Cross-References: CVE-2018-6003 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtasn1 fixes one issue. This security issue was fixed: - CVE-2018-6003: Prevent a stack exhaustion in _asn1_decode_simple_ber (lib/decoding.c) when decoding BER encoded structure allowed for DoS (bsc#1076832). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-112=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libtasn1-4.9-3.1 libtasn1-6-4.9-3.1 libtasn1-6-debuginfo-4.9-3.1 libtasn1-debuginfo-4.9-3.1 libtasn1-debugsource-4.9-3.1 libtasn1-devel-4.9-3.1 - openSUSE Leap 42.3 (x86_64): libtasn1-6-32bit-4.9-3.1 libtasn1-6-debuginfo-32bit-4.9-3.1 libtasn1-devel-32bit-4.9-3.1 References: https://www.suse.com/security/cve/CVE-2018-6003.html https://bugzilla.suse.com/1076832

1 0

openSUSE-SU-2018:0323-1: important: Security update for bind
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0323-1 Rating: important References: #1040039 #1047184 #1076118 Cross-References: CVE-2017-3145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes several issues. This security issue was fixed: - CVE-2017-3145: Improper sequencing during cleanup could have lead to a use-after-free error that triggered an assertion failure and crash in named (bsc#1076118). These non-security issues were fixed: - Updated named.root file (bsc#1040039) - Update bind.keys for DNSSEC root KSK rollover (bsc#1047184) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-114=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-devel-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-lwresd-9.9.9P1-53.1 bind-lwresd-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - openSUSE Leap 42.3 (x86_64): bind-libs-32bit-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 - openSUSE Leap 42.3 (noarch): bind-doc-9.9.9P1-53.1 References: https://www.suse.com/security/cve/CVE-2017-3145.html https://bugzilla.suse.com/1040039 https://bugzilla.suse.com/1047184 https://bugzilla.suse.com/1076118

1 0

openSUSE-SU-2018:0322-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0322-1 Rating: moderate References: #1035442 #1052825 #1062571 #1062760 #1064947 #1065766 #1070130 #1072887 #1073973 #1076500 Cross-References: CVE-2018-5748 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 9 fixes is now available. Description: This update for libvirt provides several fixes. This security issue was fixed: - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead() method which allowed to cause DoS (bsc#1076500). These security issues were fixed: - Add a qemu hook script providing functionality similar to Xen's block-dmmd script. (fate#324177) - schema: Make disk driver name attribute optional. (bsc#1073973) - virt-create-rootfs: Handle all SLE 12 versions. (bsc#1072887) - libvirt-guests: Fix the 'stop' operation when action is 'suspend'. (bsc#1070130) - s390: Fix missing host cpu model info. (bsc#1065766) - cpu: Add new EPYC CPU model. (bsc#1052825, fate#324038) - pci: Fix the detection of the link's maximum speed. (bsc#1064947) - nodedev: Increase the netlink socket buffer size. (bsc#1035442) - storage: Fix a race between the volume creation and the pool refresh. (bsc#1062571) - daemon: Drop the minsize directive from hypervisor logrotate files. (bsc#1062760) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-115=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-12.1 libvirt-admin-3.3.0-12.1 libvirt-admin-debuginfo-3.3.0-12.1 libvirt-client-3.3.0-12.1 libvirt-client-debuginfo-3.3.0-12.1 libvirt-daemon-3.3.0-12.1 libvirt-daemon-config-network-3.3.0-12.1 libvirt-daemon-config-nwfilter-3.3.0-12.1 libvirt-daemon-debuginfo-3.3.0-12.1 libvirt-daemon-driver-interface-3.3.0-12.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-12.1 libvirt-daemon-driver-lxc-3.3.0-12.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-12.1 libvirt-daemon-driver-network-3.3.0-12.1 libvirt-daemon-driver-network-debuginfo-3.3.0-12.1 libvirt-daemon-driver-nodedev-3.3.0-12.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-12.1 libvirt-daemon-driver-nwfilter-3.3.0-12.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-12.1 libvirt-daemon-driver-qemu-3.3.0-12.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-12.1 libvirt-daemon-driver-secret-3.3.0-12.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-3.3.0-12.1 libvirt-daemon-driver-storage-core-3.3.0-12.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-disk-3.3.0-12.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-iscsi-3.3.0-12.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-logical-3.3.0-12.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-mpath-3.3.0-12.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-scsi-3.3.0-12.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-12.1 libvirt-daemon-driver-uml-3.3.0-12.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-12.1 libvirt-daemon-driver-vbox-3.3.0-12.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-12.1 libvirt-daemon-hooks-3.3.0-12.1 libvirt-daemon-lxc-3.3.0-12.1 libvirt-daemon-qemu-3.3.0-12.1 libvirt-daemon-uml-3.3.0-12.1 libvirt-daemon-vbox-3.3.0-12.1 libvirt-debugsource-3.3.0-12.1 libvirt-devel-3.3.0-12.1 libvirt-doc-3.3.0-12.1 libvirt-libs-3.3.0-12.1 libvirt-libs-debuginfo-3.3.0-12.1 libvirt-lock-sanlock-3.3.0-12.1 libvirt-lock-sanlock-debuginfo-3.3.0-12.1 libvirt-nss-3.3.0-12.1 libvirt-nss-debuginfo-3.3.0-12.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-12.1 libvirt-daemon-driver-libxl-3.3.0-12.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-rbd-3.3.0-12.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-12.1 libvirt-daemon-xen-3.3.0-12.1 libvirt-devel-32bit-3.3.0-12.1 References: https://www.suse.com/security/cve/CVE-2018-5748.html https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1052825 https://bugzilla.suse.com/1062571 https://bugzilla.suse.com/1062760 https://bugzilla.suse.com/1064947 https://bugzilla.suse.com/1065766 https://bugzilla.suse.com/1070130 https://bugzilla.suse.com/1072887 https://bugzilla.suse.com/1073973 https://bugzilla.suse.com/1076500

1 0

openSUSE-RU-2018:0321-1: Recommended update for dmraid
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for dmraid ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0321-1 Rating: low References: #1060551 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dmraid provides the following fixes: - Remove partitions with O_RDONLY: it's not necessary to use O_RDWR to use BLKPG_DEL_PARTITION. It's actually harmful, because closing the device will cause an IN_CLOSE_WRITE inotify event, which will trigger a BLKRRPART from systemd, which will reinstate all partitions just deleted. (bsc#1060551) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-113=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): dmraid-1.0.0.rc16-42.1 dmraid-debuginfo-1.0.0.rc16-42.1 dmraid-debugsource-1.0.0.rc16-42.1 References: https://bugzilla.suse.com/1060551

1 0

openSUSE-SU-2018:0320-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0320-1 Rating: moderate References: #1048510 #1065276 #1066156 #1068251 #1070428 #1071558 #1074254 #1075724 #1076308 #897422 Cross-References: CVE-2017-15908 CVE-2018-1049 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update for systemd fixes several issues. This security issue was fixed: - CVE-2018-1049: Prevent race that can lead to DoS when using automounts (bsc#1076308). These non-security issues were fixed: - core: don't choke if a unit another unit triggers vanishes during reload - delta: don't ignore PREFIX when the given argument is PREFIX/SUFFIX - delta: extend skip logic to work on full directory paths (prefix+suffix) (bsc#1070428) - delta: check if a prefix needs to be skipped only once - delta: skip symlink paths when split-usr is enabled (#4591) - sysctl: use raw file descriptor in sysctl_write (#7753) - sd-netlink: don't take possesion of netlink fd from caller on failure (bsc#1074254) - Fix the regexp used to detect broken by-id symlinks in /etc/crypttab It was missing the following case: "/dev/disk/by-id/cr_-xxx". - sysctl: disable buffer while writing to /proc (bsc#1071558) - Use read_line() and LONG_LINE_MAX to read values configuration files. (bsc#1071558) - sysctl: no need to check for eof twice - def: add new constant LONG_LINE_MAX - fileio: add new helper call read_line() as bounded getline() replacement - service: Don't stop unneeded units needed by restarted service (#7526) (bsc#1066156) - gpt-auto-generator: fix the handling of the value returned by fstab_has_fstype() in add_swap() (#6280) - gpt-auto-generator: disable gpt auto logic for swaps if at least one is defined in fstab (bsc#897422) - fstab-util: introduce fstab_has_fstype() helper - fstab-generator: ignore root=/dev/nfs (#3591) - fstab-generator: don't process root= if it happens to be "gpt-auto" (#3452) - virt: use XENFEAT_dom0 to detect the hardware domain (#6442, #6662) (#7581) (bsc#1048510) - analyze: replace --no-man with --man=no in the man page (bsc#1068251) - udev: net_setup_link: don't error out when we couldn't apply link config (#7328) - Add missing /etc/systemd/network directory - Fix parsing of features in detect_vm_xen_dom0 (#7890) (bsc#1048510) - sd-bus: use -- when passing arguments to ssh (#6706) - systemctl: make sure we terminate the bus connection first, and then close the pager (#3550) - sd-bus: bump message queue size (bsc#1075724) - tmpfiles: downgrade warning about duplicate line This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-117=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-41.1 libsystemd0-debuginfo-228-41.1 libsystemd0-mini-228-41.1 libsystemd0-mini-debuginfo-228-41.1 libudev-devel-228-41.1 libudev-mini-devel-228-41.1 libudev-mini1-228-41.1 libudev-mini1-debuginfo-228-41.1 libudev1-228-41.1 libudev1-debuginfo-228-41.1 nss-myhostname-228-41.1 nss-myhostname-debuginfo-228-41.1 nss-mymachines-228-41.1 nss-mymachines-debuginfo-228-41.1 systemd-228-41.1 systemd-debuginfo-228-41.1 systemd-debugsource-228-41.1 systemd-devel-228-41.1 systemd-logger-228-41.1 systemd-mini-228-41.1 systemd-mini-debuginfo-228-41.1 systemd-mini-debugsource-228-41.1 systemd-mini-devel-228-41.1 systemd-mini-sysvinit-228-41.1 systemd-sysvinit-228-41.1 udev-228-41.1 udev-debuginfo-228-41.1 udev-mini-228-41.1 udev-mini-debuginfo-228-41.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-41.1 libsystemd0-debuginfo-32bit-228-41.1 libudev1-32bit-228-41.1 libudev1-debuginfo-32bit-228-41.1 nss-myhostname-32bit-228-41.1 nss-myhostname-debuginfo-32bit-228-41.1 systemd-32bit-228-41.1 systemd-debuginfo-32bit-228-41.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-41.1 systemd-mini-bash-completion-228-41.1 References: https://www.suse.com/security/cve/CVE-2017-15908.html https://www.suse.com/security/cve/CVE-2018-1049.html https://bugzilla.suse.com/1048510 https://bugzilla.suse.com/1065276 https://bugzilla.suse.com/1066156 https://bugzilla.suse.com/1068251 https://bugzilla.suse.com/1070428 https://bugzilla.suse.com/1071558 https://bugzilla.suse.com/1074254 https://bugzilla.suse.com/1075724 https://bugzilla.suse.com/1076308 https://bugzilla.suse.com/897422

1 0

openSUSE-RU-2018:0319-1: moderate: Recommended update for python-py2pack
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for python-py2pack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0319-1 Rating: moderate References: #1055632 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-py2pack fixes the following issues: - Run-time requirement on python-setuptools was missing (boo#1055632) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-111=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-py2pack-0.6.3-5.1 References: https://bugzilla.suse.com/1055632

1 0

openSUSE-SU-2018:0318-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0318-1 Rating: moderate References: #1076220 #1076391 Cross-References: CVE-2018-5711 CVE-2018-5712 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php7 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220). - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-28.1 apache2-mod_php7-debuginfo-7.0.7-28.1 php7-7.0.7-28.1 php7-bcmath-7.0.7-28.1 php7-bcmath-debuginfo-7.0.7-28.1 php7-bz2-7.0.7-28.1 php7-bz2-debuginfo-7.0.7-28.1 php7-calendar-7.0.7-28.1 php7-calendar-debuginfo-7.0.7-28.1 php7-ctype-7.0.7-28.1 php7-ctype-debuginfo-7.0.7-28.1 php7-curl-7.0.7-28.1 php7-curl-debuginfo-7.0.7-28.1 php7-dba-7.0.7-28.1 php7-dba-debuginfo-7.0.7-28.1 php7-debuginfo-7.0.7-28.1 php7-debugsource-7.0.7-28.1 php7-devel-7.0.7-28.1 php7-dom-7.0.7-28.1 php7-dom-debuginfo-7.0.7-28.1 php7-enchant-7.0.7-28.1 php7-enchant-debuginfo-7.0.7-28.1 php7-exif-7.0.7-28.1 php7-exif-debuginfo-7.0.7-28.1 php7-fastcgi-7.0.7-28.1 php7-fastcgi-debuginfo-7.0.7-28.1 php7-fileinfo-7.0.7-28.1 php7-fileinfo-debuginfo-7.0.7-28.1 php7-firebird-7.0.7-28.1 php7-firebird-debuginfo-7.0.7-28.1 php7-fpm-7.0.7-28.1 php7-fpm-debuginfo-7.0.7-28.1 php7-ftp-7.0.7-28.1 php7-ftp-debuginfo-7.0.7-28.1 php7-gd-7.0.7-28.1 php7-gd-debuginfo-7.0.7-28.1 php7-gettext-7.0.7-28.1 php7-gettext-debuginfo-7.0.7-28.1 php7-gmp-7.0.7-28.1 php7-gmp-debuginfo-7.0.7-28.1 php7-iconv-7.0.7-28.1 php7-iconv-debuginfo-7.0.7-28.1 php7-imap-7.0.7-28.1 php7-imap-debuginfo-7.0.7-28.1 php7-intl-7.0.7-28.1 php7-intl-debuginfo-7.0.7-28.1 php7-json-7.0.7-28.1 php7-json-debuginfo-7.0.7-28.1 php7-ldap-7.0.7-28.1 php7-ldap-debuginfo-7.0.7-28.1 php7-mbstring-7.0.7-28.1 php7-mbstring-debuginfo-7.0.7-28.1 php7-mcrypt-7.0.7-28.1 php7-mcrypt-debuginfo-7.0.7-28.1 php7-mysql-7.0.7-28.1 php7-mysql-debuginfo-7.0.7-28.1 php7-odbc-7.0.7-28.1 php7-odbc-debuginfo-7.0.7-28.1 php7-opcache-7.0.7-28.1 php7-opcache-debuginfo-7.0.7-28.1 php7-openssl-7.0.7-28.1 php7-openssl-debuginfo-7.0.7-28.1 php7-pcntl-7.0.7-28.1 php7-pcntl-debuginfo-7.0.7-28.1 php7-pdo-7.0.7-28.1 php7-pdo-debuginfo-7.0.7-28.1 php7-pgsql-7.0.7-28.1 php7-pgsql-debuginfo-7.0.7-28.1 php7-phar-7.0.7-28.1 php7-phar-debuginfo-7.0.7-28.1 php7-posix-7.0.7-28.1 php7-posix-debuginfo-7.0.7-28.1 php7-pspell-7.0.7-28.1 php7-pspell-debuginfo-7.0.7-28.1 php7-readline-7.0.7-28.1 php7-readline-debuginfo-7.0.7-28.1 php7-shmop-7.0.7-28.1 php7-shmop-debuginfo-7.0.7-28.1 php7-snmp-7.0.7-28.1 php7-snmp-debuginfo-7.0.7-28.1 php7-soap-7.0.7-28.1 php7-soap-debuginfo-7.0.7-28.1 php7-sockets-7.0.7-28.1 php7-sockets-debuginfo-7.0.7-28.1 php7-sqlite-7.0.7-28.1 php7-sqlite-debuginfo-7.0.7-28.1 php7-sysvmsg-7.0.7-28.1 php7-sysvmsg-debuginfo-7.0.7-28.1 php7-sysvsem-7.0.7-28.1 php7-sysvsem-debuginfo-7.0.7-28.1 php7-sysvshm-7.0.7-28.1 php7-sysvshm-debuginfo-7.0.7-28.1 php7-tidy-7.0.7-28.1 php7-tidy-debuginfo-7.0.7-28.1 php7-tokenizer-7.0.7-28.1 php7-tokenizer-debuginfo-7.0.7-28.1 php7-wddx-7.0.7-28.1 php7-wddx-debuginfo-7.0.7-28.1 php7-xmlreader-7.0.7-28.1 php7-xmlreader-debuginfo-7.0.7-28.1 php7-xmlrpc-7.0.7-28.1 php7-xmlrpc-debuginfo-7.0.7-28.1 php7-xmlwriter-7.0.7-28.1 php7-xmlwriter-debuginfo-7.0.7-28.1 php7-xsl-7.0.7-28.1 php7-xsl-debuginfo-7.0.7-28.1 php7-zip-7.0.7-28.1 php7-zip-debuginfo-7.0.7-28.1 php7-zlib-7.0.7-28.1 php7-zlib-debuginfo-7.0.7-28.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-28.1 php7-pear-Archive_Tar-7.0.7-28.1 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://www.suse.com/security/cve/CVE-2018-5712.html https://bugzilla.suse.com/1076220 https://bugzilla.suse.com/1076391

1 0

openSUSE-RU-2018:0317-1: Recommended update for k3b
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0317-1 Rating: low References: #1077728 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for k3b contains the following fix: - build with libmad, lame and ffmpeg, no longer show a warning that libmap is not available (boo#1077728) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-110=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): k3b-lang-17.04.2-10.1 - openSUSE Leap 42.3 (x86_64): k3b-17.04.2-10.1 k3b-debuginfo-17.04.2-10.1 k3b-debugsource-17.04.2-10.1 k3b-devel-17.04.2-10.1 References: https://bugzilla.suse.com/1077728

1 0

openSUSE-SU-2018:0316-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0316-1 Rating: moderate References: #1076391 Cross-References: CVE-2018-5711 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes one issues. This security issue was fixed: - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-109=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-24.1 gd-debuginfo-2.1.0-24.1 gd-debugsource-2.1.0-24.1 gd-devel-2.1.0-24.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-24.1 gd-debuginfo-32bit-2.1.0-24.1 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://bugzilla.suse.com/1076391

1 0

openSUSE-SU-2018:0315-1: moderate: Security update for nodejs6
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0315-1 Rating: moderate References: #1056058 #1066242 #1072322 Cross-References: CVE-2017-14919 CVE-2017-15896 CVE-2017-3735 CVE-2017-3736 CVE-2017-3738 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs6 fixes the following issues: Security issues fixed: - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL (bsc#1072322). - CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value. - CVE-2017-3738: Embedded OpenSSL is vulnerable to rsaz_1024_mul_avx2 overflow bug on x86_64. - CVE-2017-3736: Embedded OpenSSL is vulnerable to bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242). - CVE-2017-3735: Embedded OpenSSL is vulnerable to malformed X.509 IPAdressFamily that could cause OOB read (bsc#1056058). Bug fixes: - Update to LTS release 6.12.2 (bsc#1072322): * https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ * https://nodejs.org/en/blog/release/v6.12.2/ * https://nodejs.org/en/blog/release/v6.12.1/ * https://nodejs.org/en/blog/release/v6.12.0/ * https://nodejs.org/en/blog/release/v6.11.5/ * https://nodejs.org/en/blog/release/v6.11.4/ * https://nodejs.org/en/blog/release/v6.11.3/ * https://nodejs.org/en/blog/release/v6.11.2/ This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-116=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs6-6.12.2-6.1 nodejs6-debuginfo-6.12.2-6.1 nodejs6-debugsource-6.12.2-6.1 nodejs6-devel-6.12.2-6.1 npm6-6.12.2-6.1 - openSUSE Leap 42.3 (noarch): nodejs6-docs-6.12.2-6.1 References: https://www.suse.com/security/cve/CVE-2017-14919.html https://www.suse.com/security/cve/CVE-2017-15896.html https://www.suse.com/security/cve/CVE-2017-3735.html https://www.suse.com/security/cve/CVE-2017-3736.html https://www.suse.com/security/cve/CVE-2017-3738.html https://bugzilla.suse.com/1056058 https://bugzilla.suse.com/1066242 https://bugzilla.suse.com/1072322

1 0

openSUSE-RU-2018:0314-1: moderate: Recommended update for mtr
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for mtr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0314-1 Rating: moderate References: #1020147 #1067511 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mtr fixes the following issues: Updates Requires/Requires(post) group(dialout) (boo#1067511). Fixes Requires so mtr-gtk installs properly Version update to mtr-0.92: * Loads of fixes all around see NEWS file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-108=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): mtr-0.92-5.1 mtr-gtk-0.92-5.1 References: https://bugzilla.suse.com/1020147 https://bugzilla.suse.com/1067511

1 0

openSUSE-SU-2018:0313-1: important: Security update for chromium
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0313-1 Rating: important References: #1073323 #1077571 #1077722 Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032 CVE-2018-6033 CVE-2018-6034 CVE-2018-6035 CVE-2018-6036 CVE-2018-6037 CVE-2018-6038 CVE-2018-6039 CVE-2018-6040 CVE-2018-6041 CVE-2018-6042 CVE-2018-6043 CVE-2018-6045 CVE-2018-6046 CVE-2018-6047 CVE-2018-6048 CVE-2018-6049 CVE-2018-6050 CVE-2018-6051 CVE-2018-6052 CVE-2018-6053 CVE-2018-6054 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium to 64.0.3282.119 fixes several issues. These security issues were fixed: - CVE-2018-6031: Use after free in PDFium (boo#1077571) - CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571) - CVE-2018-6033: Race when opening downloaded files (boo#1077571) - CVE-2018-6034: Integer overflow in Blink (boo#1077571) - CVE-2018-6035: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571) - CVE-2018-6037: Insufficient user gesture requirements in autofill (boo#1077571) - CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571) - CVE-2018-6039: XSS in DevTools (boo#1077571) - CVE-2018-6040: Content security policy bypass (boo#1077571) - CVE-2018-6041: URL spoof in Navigation (boo#1077571) - CVE-2018-6042: URL spoof in OmniBox (boo#1077571) - CVE-2018-6043: Insufficient escaping with external URL handlers (boo#1077571) - CVE-2018-6045: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6046: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571) - CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571) - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571) - CVE-2018-6049: UI spoof in Permissions (boo#1077571) - CVE-2018-6050: URL spoof in OmniBox (boo#1077571) - CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571) - CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571) - CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571) - CVE-2018-6054: Use after free in WebUI (boo#1077571) Re was updated to version 2018-01-01 (boo#1073323) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-106=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libre2-0-20180101-5.1 libre2-0-debuginfo-20180101-5.1 re2-debugsource-20180101-5.1 re2-devel-20180101-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-64.0.3282.119-46.2 chromium-64.0.3282.119-46.2 References: https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2018-6031.html https://www.suse.com/security/cve/CVE-2018-6032.html https://www.suse.com/security/cve/CVE-2018-6033.html https://www.suse.com/security/cve/CVE-2018-6034.html https://www.suse.com/security/cve/CVE-2018-6035.html https://www.suse.com/security/cve/CVE-2018-6036.html https://www.suse.com/security/cve/CVE-2018-6037.html https://www.suse.com/security/cve/CVE-2018-6038.html https://www.suse.com/security/cve/CVE-2018-6039.html https://www.suse.com/security/cve/CVE-2018-6040.html https://www.suse.com/security/cve/CVE-2018-6041.html https://www.suse.com/security/cve/CVE-2018-6042.html https://www.suse.com/security/cve/CVE-2018-6043.html https://www.suse.com/security/cve/CVE-2018-6045.html https://www.suse.com/security/cve/CVE-2018-6046.html https://www.suse.com/security/cve/CVE-2018-6047.html https://www.suse.com/security/cve/CVE-2018-6048.html https://www.suse.com/security/cve/CVE-2018-6049.html https://www.suse.com/security/cve/CVE-2018-6050.html https://www.suse.com/security/cve/CVE-2018-6051.html https://www.suse.com/security/cve/CVE-2018-6052.html https://www.suse.com/security/cve/CVE-2018-6053.html https://www.suse.com/security/cve/CVE-2018-6054.html https://bugzilla.suse.com/1073323 https://bugzilla.suse.com/1077571 https://bugzilla.suse.com/1077722

1 0

openSUSE-RU-2018:0312-1: moderate: Recommended update for irssi
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0312-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for irssi.openSUSE_Backports_SLE-12 fixes the following issues: Update to version 1.1.0 with multiple features implemented and bugs fixed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-107=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.0-39.1 irssi-devel-1.1.0-39.1 References:

1 0

openSUSE-RU-2018:0310-1: Recommended update for nvmetcli
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for nvmetcli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0310-1 Rating: low References: #1070533 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvmetcli provides the following fix: - Don't display bogus 'disabled' status for ports (bsc#1070533) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-105=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): nvmetcli-0.4-5.1 References: https://bugzilla.suse.com/1070533

1 0

openSUSE-SU-2018:0291-1: moderate: Recommended update for apache2
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

openSUSE Security Update: Recommended update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0291-1 Rating: moderate References: #1042037 #1045160 #1048575 #1057406 Cross-References: CVE-2017-7659 CVE-2017-9789 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for apache2 fixes several issues. These security issues were fixed: - CVE-2017-9789: When under stress (closing many connections) the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour (bsc#1048575). - CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process (bsc#1045160). These non-security issues were fixed: - Use the full path to a2enmod and a2dismod in the apache-22-24-upgrade script (bsc#1042037) - Fall back to 'localhost' as hostname in gensslcert (bsc#1057406) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-104=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-19.1 apache2-debuginfo-2.4.23-19.1 apache2-debugsource-2.4.23-19.1 apache2-devel-2.4.23-19.1 apache2-event-2.4.23-19.1 apache2-event-debuginfo-2.4.23-19.1 apache2-example-pages-2.4.23-19.1 apache2-prefork-2.4.23-19.1 apache2-prefork-debuginfo-2.4.23-19.1 apache2-utils-2.4.23-19.1 apache2-utils-debuginfo-2.4.23-19.1 apache2-worker-2.4.23-19.1 apache2-worker-debuginfo-2.4.23-19.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-19.1 References: https://www.suse.com/security/cve/CVE-2017-7659.html https://www.suse.com/security/cve/CVE-2017-9789.html https://bugzilla.suse.com/1042037 https://bugzilla.suse.com/1045160 https://bugzilla.suse.com/1048575 https://bugzilla.suse.com/1057406

1 0

openSUSE-SU-2018:0259-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0259-1 Rating: important References: #1073323 #1077571 #1077722 Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032 CVE-2018-6033 CVE-2018-6034 CVE-2018-6035 CVE-2018-6036 CVE-2018-6037 CVE-2018-6038 CVE-2018-6039 CVE-2018-6040 CVE-2018-6041 CVE-2018-6042 CVE-2018-6043 CVE-2018-6045 CVE-2018-6046 CVE-2018-6047 CVE-2018-6048 CVE-2018-6049 CVE-2018-6050 CVE-2018-6051 CVE-2018-6052 CVE-2018-6053 CVE-2018-6054 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium to 64.0.3282.119 fixes several issues. These security issues were fixed: - CVE-2018-6031: Use after free in PDFium (boo#1077571) - CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571) - CVE-2018-6033: Race when opening downloaded files (boo#1077571) - CVE-2018-6034: Integer overflow in Blink (boo#1077571) - CVE-2018-6035: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571) - CVE-2018-6037: Insufficient user gesture requirements in autofill (boo#1077571) - CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571) - CVE-2018-6039: XSS in DevTools (boo#1077571) - CVE-2018-6040: Content security policy bypass (boo#1077571) - CVE-2018-6041: URL spoof in Navigation (boo#1077571) - CVE-2018-6042: URL spoof in OmniBox (boo#1077571) - CVE-2018-6043: Insufficient escaping with external URL handlers (boo#1077571) - CVE-2018-6045: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6046: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571) - CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571) - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571) - CVE-2018-6049: UI spoof in Permissions (boo#1077571) - CVE-2018-6050: URL spoof in OmniBox (boo#1077571) - CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571) - CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571) - CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571) - CVE-2018-6054: Use after free in WebUI (boo#1077571) Re was updated to version 2018-01-01 (boo#1073323) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-103=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libre2-0-20180101-9.1 libre2-0-debuginfo-20180101-9.1 re2-debugsource-20180101-9.1 re2-devel-20180101-9.1 - openSUSE Leap 42.3 (x86_64): chromedriver-64.0.3282.119-135.1 chromedriver-debuginfo-64.0.3282.119-135.1 chromium-64.0.3282.119-135.1 chromium-debuginfo-64.0.3282.119-135.1 chromium-debugsource-64.0.3282.119-135.1 libre2-0-32bit-20180101-9.1 libre2-0-debuginfo-32bit-20180101-9.1 References: https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2018-6031.html https://www.suse.com/security/cve/CVE-2018-6032.html https://www.suse.com/security/cve/CVE-2018-6033.html https://www.suse.com/security/cve/CVE-2018-6034.html https://www.suse.com/security/cve/CVE-2018-6035.html https://www.suse.com/security/cve/CVE-2018-6036.html https://www.suse.com/security/cve/CVE-2018-6037.html https://www.suse.com/security/cve/CVE-2018-6038.html https://www.suse.com/security/cve/CVE-2018-6039.html https://www.suse.com/security/cve/CVE-2018-6040.html https://www.suse.com/security/cve/CVE-2018-6041.html https://www.suse.com/security/cve/CVE-2018-6042.html https://www.suse.com/security/cve/CVE-2018-6043.html https://www.suse.com/security/cve/CVE-2018-6045.html https://www.suse.com/security/cve/CVE-2018-6046.html https://www.suse.com/security/cve/CVE-2018-6047.html https://www.suse.com/security/cve/CVE-2018-6048.html https://www.suse.com/security/cve/CVE-2018-6049.html https://www.suse.com/security/cve/CVE-2018-6050.html https://www.suse.com/security/cve/CVE-2018-6051.html https://www.suse.com/security/cve/CVE-2018-6052.html https://www.suse.com/security/cve/CVE-2018-6053.html https://www.suse.com/security/cve/CVE-2018-6054.html https://bugzilla.suse.com/1073323 https://bugzilla.suse.com/1077571 https://bugzilla.suse.com/1077722

1 0

openSUSE-SU-2018:0258-1: important: Security update for clamav
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0258-1 Rating: important References: #1040662 #1049423 #1052448 #1052449 #1052466 #1077732 Cross-References: CVE-2017-11423 CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 CVE-2017-6418 CVE-2017-6419 CVE-2017-6420 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for clamav fixes the following issues: - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. - update upstream keys in the keyring - provide and obsolete clamav-nodb to trigger it's removal in Leap bsc#1040662 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-102=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.99.3-20.1 clamav-debuginfo-0.99.3-20.1 clamav-debugsource-0.99.3-20.1 References: https://www.suse.com/security/cve/CVE-2017-11423.html https://www.suse.com/security/cve/CVE-2017-12374.html https://www.suse.com/security/cve/CVE-2017-12375.html https://www.suse.com/security/cve/CVE-2017-12376.html https://www.suse.com/security/cve/CVE-2017-12377.html https://www.suse.com/security/cve/CVE-2017-12378.html https://www.suse.com/security/cve/CVE-2017-12379.html https://www.suse.com/security/cve/CVE-2017-12380.html https://www.suse.com/security/cve/CVE-2017-6418.html https://www.suse.com/security/cve/CVE-2017-6419.html https://www.suse.com/security/cve/CVE-2017-6420.html https://bugzilla.suse.com/1040662 https://bugzilla.suse.com/1049423 https://bugzilla.suse.com/1052448 https://bugzilla.suse.com/1052449 https://bugzilla.suse.com/1052466 https://bugzilla.suse.com/1077732

1 0

openSUSE-SU-2018:0257-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0257-1 Rating: important References: #1077291 Cross-References: CVE-2018-5089 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-101=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-52.6-56.2 MozillaThunderbird-buildsymbols-52.6-56.2 MozillaThunderbird-debuginfo-52.6-56.2 MozillaThunderbird-debugsource-52.6-56.2 MozillaThunderbird-devel-52.6-56.2 MozillaThunderbird-translations-common-52.6-56.2 MozillaThunderbird-translations-other-52.6-56.2 - openSUSE Leap 42.3 (i586): MozillaThunderbird-52.6-56.1 MozillaThunderbird-buildsymbols-52.6-56.1 MozillaThunderbird-debuginfo-52.6-56.1 MozillaThunderbird-debugsource-52.6-56.1 MozillaThunderbird-devel-52.6-56.1 MozillaThunderbird-translations-common-52.6-56.1 MozillaThunderbird-translations-other-52.6-56.1 References: https://www.suse.com/security/cve/CVE-2018-5089.html https://www.suse.com/security/cve/CVE-2018-5095.html https://www.suse.com/security/cve/CVE-2018-5096.html https://www.suse.com/security/cve/CVE-2018-5097.html https://www.suse.com/security/cve/CVE-2018-5098.html https://www.suse.com/security/cve/CVE-2018-5099.html https://www.suse.com/security/cve/CVE-2018-5102.html https://www.suse.com/security/cve/CVE-2018-5103.html https://www.suse.com/security/cve/CVE-2018-5104.html https://www.suse.com/security/cve/CVE-2018-5117.html https://bugzilla.suse.com/1077291

1 0

openSUSE-SU-2018:0256-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0256-1 Rating: important References: #1077291 Cross-References: CVE-2018-5089 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-101=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.6-54.1 MozillaThunderbird-buildsymbols-52.6-54.1 MozillaThunderbird-debuginfo-52.6-54.1 MozillaThunderbird-debugsource-52.6-54.1 MozillaThunderbird-devel-52.6-54.1 MozillaThunderbird-translations-common-52.6-54.1 MozillaThunderbird-translations-other-52.6-54.1 References: https://www.suse.com/security/cve/CVE-2018-5089.html https://www.suse.com/security/cve/CVE-2018-5095.html https://www.suse.com/security/cve/CVE-2018-5096.html https://www.suse.com/security/cve/CVE-2018-5097.html https://www.suse.com/security/cve/CVE-2018-5098.html https://www.suse.com/security/cve/CVE-2018-5099.html https://www.suse.com/security/cve/CVE-2018-5102.html https://www.suse.com/security/cve/CVE-2018-5103.html https://www.suse.com/security/cve/CVE-2018-5104.html https://www.suse.com/security/cve/CVE-2018-5117.html https://bugzilla.suse.com/1077291

1 0

openSUSE-SU-2018:0248-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 26 Jan '18

26 Jan '18

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0248-1 Rating: moderate References: #1076220 #1076391 Cross-References: CVE-2018-5711 CVE-2018-5712 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php5 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220) - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-99=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-99=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-91.2 apache2-mod_php5-debuginfo-5.5.14-91.2 php5-5.5.14-91.2 php5-bcmath-5.5.14-91.2 php5-bcmath-debuginfo-5.5.14-91.2 php5-bz2-5.5.14-91.2 php5-bz2-debuginfo-5.5.14-91.2 php5-calendar-5.5.14-91.2 php5-calendar-debuginfo-5.5.14-91.2 php5-ctype-5.5.14-91.2 php5-ctype-debuginfo-5.5.14-91.2 php5-curl-5.5.14-91.2 php5-curl-debuginfo-5.5.14-91.2 php5-dba-5.5.14-91.2 php5-dba-debuginfo-5.5.14-91.2 php5-debuginfo-5.5.14-91.2 php5-debugsource-5.5.14-91.2 php5-devel-5.5.14-91.2 php5-dom-5.5.14-91.2 php5-dom-debuginfo-5.5.14-91.2 php5-enchant-5.5.14-91.2 php5-enchant-debuginfo-5.5.14-91.2 php5-exif-5.5.14-91.2 php5-exif-debuginfo-5.5.14-91.2 php5-fastcgi-5.5.14-91.2 php5-fastcgi-debuginfo-5.5.14-91.2 php5-fileinfo-5.5.14-91.2 php5-fileinfo-debuginfo-5.5.14-91.2 php5-firebird-5.5.14-91.2 php5-firebird-debuginfo-5.5.14-91.2 php5-fpm-5.5.14-91.2 php5-fpm-debuginfo-5.5.14-91.2 php5-ftp-5.5.14-91.2 php5-ftp-debuginfo-5.5.14-91.2 php5-gd-5.5.14-91.2 php5-gd-debuginfo-5.5.14-91.2 php5-gettext-5.5.14-91.2 php5-gettext-debuginfo-5.5.14-91.2 php5-gmp-5.5.14-91.2 php5-gmp-debuginfo-5.5.14-91.2 php5-iconv-5.5.14-91.2 php5-iconv-debuginfo-5.5.14-91.2 php5-imap-5.5.14-91.2 php5-imap-debuginfo-5.5.14-91.2 php5-intl-5.5.14-91.2 php5-intl-debuginfo-5.5.14-91.2 php5-json-5.5.14-91.2 php5-json-debuginfo-5.5.14-91.2 php5-ldap-5.5.14-91.2 php5-ldap-debuginfo-5.5.14-91.2 php5-mbstring-5.5.14-91.2 php5-mbstring-debuginfo-5.5.14-91.2 php5-mcrypt-5.5.14-91.2 php5-mcrypt-debuginfo-5.5.14-91.2 php5-mssql-5.5.14-91.2 php5-mssql-debuginfo-5.5.14-91.2 php5-mysql-5.5.14-91.2 php5-mysql-debuginfo-5.5.14-91.2 php5-odbc-5.5.14-91.2 php5-odbc-debuginfo-5.5.14-91.2 php5-opcache-5.5.14-91.2 php5-opcache-debuginfo-5.5.14-91.2 php5-openssl-5.5.14-91.2 php5-openssl-debuginfo-5.5.14-91.2 php5-pcntl-5.5.14-91.2 php5-pcntl-debuginfo-5.5.14-91.2 php5-pdo-5.5.14-91.2 php5-pdo-debuginfo-5.5.14-91.2 php5-pgsql-5.5.14-91.2 php5-pgsql-debuginfo-5.5.14-91.2 php5-phar-5.5.14-91.2 php5-phar-debuginfo-5.5.14-91.2 php5-posix-5.5.14-91.2 php5-posix-debuginfo-5.5.14-91.2 php5-pspell-5.5.14-91.2 php5-pspell-debuginfo-5.5.14-91.2 php5-readline-5.5.14-91.2 php5-readline-debuginfo-5.5.14-91.2 php5-shmop-5.5.14-91.2 php5-shmop-debuginfo-5.5.14-91.2 php5-snmp-5.5.14-91.2 php5-snmp-debuginfo-5.5.14-91.2 php5-soap-5.5.14-91.2 php5-soap-debuginfo-5.5.14-91.2 php5-sockets-5.5.14-91.2 php5-sockets-debuginfo-5.5.14-91.2 php5-sqlite-5.5.14-91.2 php5-sqlite-debuginfo-5.5.14-91.2 php5-suhosin-5.5.14-91.2 php5-suhosin-debuginfo-5.5.14-91.2 php5-sysvmsg-5.5.14-91.2 php5-sysvmsg-debuginfo-5.5.14-91.2 php5-sysvsem-5.5.14-91.2 php5-sysvsem-debuginfo-5.5.14-91.2 php5-sysvshm-5.5.14-91.2 php5-sysvshm-debuginfo-5.5.14-91.2 php5-tidy-5.5.14-91.2 php5-tidy-debuginfo-5.5.14-91.2 php5-tokenizer-5.5.14-91.2 php5-tokenizer-debuginfo-5.5.14-91.2 php5-wddx-5.5.14-91.2 php5-wddx-debuginfo-5.5.14-91.2 php5-xmlreader-5.5.14-91.2 php5-xmlreader-debuginfo-5.5.14-91.2 php5-xmlrpc-5.5.14-91.2 php5-xmlrpc-debuginfo-5.5.14-91.2 php5-xmlwriter-5.5.14-91.2 php5-xmlwriter-debuginfo-5.5.14-91.2 php5-xsl-5.5.14-91.2 php5-xsl-debuginfo-5.5.14-91.2 php5-zip-5.5.14-91.2 php5-zip-debuginfo-5.5.14-91.2 php5-zlib-5.5.14-91.2 php5-zlib-debuginfo-5.5.14-91.2 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-91.2 - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php5-5.5.14-77.18.2 apache2-mod_php5-debuginfo-5.5.14-77.18.2 php5-5.5.14-77.18.2 php5-bcmath-5.5.14-77.18.2 php5-bcmath-debuginfo-5.5.14-77.18.2 php5-bz2-5.5.14-77.18.2 php5-bz2-debuginfo-5.5.14-77.18.2 php5-calendar-5.5.14-77.18.2 php5-calendar-debuginfo-5.5.14-77.18.2 php5-ctype-5.5.14-77.18.2 php5-ctype-debuginfo-5.5.14-77.18.2 php5-curl-5.5.14-77.18.2 php5-curl-debuginfo-5.5.14-77.18.2 php5-dba-5.5.14-77.18.2 php5-dba-debuginfo-5.5.14-77.18.2 php5-debuginfo-5.5.14-77.18.2 php5-debugsource-5.5.14-77.18.2 php5-devel-5.5.14-77.18.2 php5-dom-5.5.14-77.18.2 php5-dom-debuginfo-5.5.14-77.18.2 php5-enchant-5.5.14-77.18.2 php5-enchant-debuginfo-5.5.14-77.18.2 php5-exif-5.5.14-77.18.2 php5-exif-debuginfo-5.5.14-77.18.2 php5-fastcgi-5.5.14-77.18.2 php5-fastcgi-debuginfo-5.5.14-77.18.2 php5-fileinfo-5.5.14-77.18.2 php5-fileinfo-debuginfo-5.5.14-77.18.2 php5-firebird-5.5.14-77.18.2 php5-firebird-debuginfo-5.5.14-77.18.2 php5-fpm-5.5.14-77.18.2 php5-fpm-debuginfo-5.5.14-77.18.2 php5-ftp-5.5.14-77.18.2 php5-ftp-debuginfo-5.5.14-77.18.2 php5-gd-5.5.14-77.18.2 php5-gd-debuginfo-5.5.14-77.18.2 php5-gettext-5.5.14-77.18.2 php5-gettext-debuginfo-5.5.14-77.18.2 php5-gmp-5.5.14-77.18.2 php5-gmp-debuginfo-5.5.14-77.18.2 php5-iconv-5.5.14-77.18.2 php5-iconv-debuginfo-5.5.14-77.18.2 php5-imap-5.5.14-77.18.2 php5-imap-debuginfo-5.5.14-77.18.2 php5-intl-5.5.14-77.18.2 php5-intl-debuginfo-5.5.14-77.18.2 php5-json-5.5.14-77.18.2 php5-json-debuginfo-5.5.14-77.18.2 php5-ldap-5.5.14-77.18.2 php5-ldap-debuginfo-5.5.14-77.18.2 php5-mbstring-5.5.14-77.18.2 php5-mbstring-debuginfo-5.5.14-77.18.2 php5-mcrypt-5.5.14-77.18.2 php5-mcrypt-debuginfo-5.5.14-77.18.2 php5-mssql-5.5.14-77.18.2 php5-mssql-debuginfo-5.5.14-77.18.2 php5-mysql-5.5.14-77.18.2 php5-mysql-debuginfo-5.5.14-77.18.2 php5-odbc-5.5.14-77.18.2 php5-odbc-debuginfo-5.5.14-77.18.2 php5-opcache-5.5.14-77.18.2 php5-opcache-debuginfo-5.5.14-77.18.2 php5-openssl-5.5.14-77.18.2 php5-openssl-debuginfo-5.5.14-77.18.2 php5-pcntl-5.5.14-77.18.2 php5-pcntl-debuginfo-5.5.14-77.18.2 php5-pdo-5.5.14-77.18.2 php5-pdo-debuginfo-5.5.14-77.18.2 php5-pgsql-5.5.14-77.18.2 php5-pgsql-debuginfo-5.5.14-77.18.2 php5-phar-5.5.14-77.18.2 php5-phar-debuginfo-5.5.14-77.18.2 php5-posix-5.5.14-77.18.2 php5-posix-debuginfo-5.5.14-77.18.2 php5-pspell-5.5.14-77.18.2 php5-pspell-debuginfo-5.5.14-77.18.2 php5-readline-5.5.14-77.18.2 php5-readline-debuginfo-5.5.14-77.18.2 php5-shmop-5.5.14-77.18.2 php5-shmop-debuginfo-5.5.14-77.18.2 php5-snmp-5.5.14-77.18.2 php5-snmp-debuginfo-5.5.14-77.18.2 php5-soap-5.5.14-77.18.2 php5-soap-debuginfo-5.5.14-77.18.2 php5-sockets-5.5.14-77.18.2 php5-sockets-debuginfo-5.5.14-77.18.2 php5-sqlite-5.5.14-77.18.2 php5-sqlite-debuginfo-5.5.14-77.18.2 php5-suhosin-5.5.14-77.18.2 php5-suhosin-debuginfo-5.5.14-77.18.2 php5-sysvmsg-5.5.14-77.18.2 php5-sysvmsg-debuginfo-5.5.14-77.18.2 php5-sysvsem-5.5.14-77.18.2 php5-sysvsem-debuginfo-5.5.14-77.18.2 php5-sysvshm-5.5.14-77.18.2 php5-sysvshm-debuginfo-5.5.14-77.18.2 php5-tidy-5.5.14-77.18.2 php5-tidy-debuginfo-5.5.14-77.18.2 php5-tokenizer-5.5.14-77.18.2 php5-tokenizer-debuginfo-5.5.14-77.18.2 php5-wddx-5.5.14-77.18.2 php5-wddx-debuginfo-5.5.14-77.18.2 php5-xmlreader-5.5.14-77.18.2 php5-xmlreader-debuginfo-5.5.14-77.18.2 php5-xmlrpc-5.5.14-77.18.2 php5-xmlrpc-debuginfo-5.5.14-77.18.2 php5-xmlwriter-5.5.14-77.18.2 php5-xmlwriter-debuginfo-5.5.14-77.18.2 php5-xsl-5.5.14-77.18.2 php5-xsl-debuginfo-5.5.14-77.18.2 php5-zip-5.5.14-77.18.2 php5-zip-debuginfo-5.5.14-77.18.2 php5-zlib-5.5.14-77.18.2 php5-zlib-debuginfo-5.5.14-77.18.2 - openSUSE Leap 42.2 (noarch): php5-pear-5.5.14-77.18.2 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://www.suse.com/security/cve/CVE-2018-5712.html https://bugzilla.suse.com/1076220 https://bugzilla.suse.com/1076391

1 0

openSUSE-RU-2018:0247-1: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 26 Jan '18

26 Jan '18

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0247-1 Rating: low References: #1077656 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for release-notes-openSUSE adds an end-of-life note to the release notes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-100=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): release-notes-openSUSE-42.2.20180124-5.6.1 References: https://bugzilla.suse.com/1077656

1 0

openSUSE-SU-2018:0236-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 26 Jan '18

26 Jan '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0236-1 Rating: moderate References: #1077001 Cross-References: CVE-2018-1000007 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes one issues. This security issue was fixed: - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-98=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-98=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-30.1 curl-debuginfo-7.37.0-30.1 curl-debugsource-7.37.0-30.1 libcurl-devel-7.37.0-30.1 libcurl4-7.37.0-30.1 libcurl4-debuginfo-7.37.0-30.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-30.1 libcurl4-32bit-7.37.0-30.1 libcurl4-debuginfo-32bit-7.37.0-30.1 - openSUSE Leap 42.2 (i586 x86_64): curl-7.37.0-16.15.1 curl-debuginfo-7.37.0-16.15.1 curl-debugsource-7.37.0-16.15.1 libcurl-devel-7.37.0-16.15.1 libcurl4-7.37.0-16.15.1 libcurl4-debuginfo-7.37.0-16.15.1 - openSUSE Leap 42.2 (x86_64): libcurl-devel-32bit-7.37.0-16.15.1 libcurl4-32bit-7.37.0-16.15.1 libcurl4-debuginfo-32bit-7.37.0-16.15.1 References: https://www.suse.com/security/cve/CVE-2018-1000007.html https://bugzilla.suse.com/1077001

1 0

openSUSE-SU-2018:0229-1: important: Security update for newsbeuter
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for newsbeuter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0229-1 Rating: important References: #1059057 Cross-References: CVE-2017-14500 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for newsbeuter fixes one issues. This security issue was fixed: - CVE-2017-14500: Improper Neutralization of special elements allowed remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure that includes shell metacharacters in its filename (bsc#1059057). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-92=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-92=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): newsbeuter-2.9-8.1 newsbeuter-debuginfo-2.9-8.1 newsbeuter-debugsource-2.9-8.1 - openSUSE Leap 42.3 (noarch): newsbeuter-lang-2.9-8.1 - openSUSE Leap 42.2 (noarch): newsbeuter-lang-2.9-2.6.1 - openSUSE Leap 42.2 (x86_64): newsbeuter-2.9-2.6.1 newsbeuter-debuginfo-2.9-2.6.1 newsbeuter-debugsource-2.9-2.6.1 References: https://www.suse.com/security/cve/CVE-2017-14500.html https://bugzilla.suse.com/1059057

1 0

openSUSE-SU-2018:0228-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0228-1 Rating: moderate References: #1061967 Cross-References: CVE-2017-15047 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis to version 4.0.6 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-15047: Buffer overflows occurring reading redis.conf (bsc#1061967) The following bugs are fixed: - Several PSYNC2 bugs could cause data corruption Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-93=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-93=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): redis-4.0.6-14.1 redis-debuginfo-4.0.6-14.1 redis-debugsource-4.0.6-14.1 - openSUSE Leap 42.2 (i586 x86_64): redis-4.0.6-8.6.1 redis-debuginfo-4.0.6-8.6.1 redis-debugsource-4.0.6-8.6.1 References: https://www.suse.com/security/cve/CVE-2017-15047.html https://bugzilla.suse.com/1061967

1 0

openSUSE-SU-2018:0227-1: moderate: Security update for mupdf
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0227-1 Rating: moderate References: #1063413 #1064027 #1074116 #1075936 #1077161 Cross-References: CVE-2017-15369 CVE-2017-15587 CVE-2017-17858 CVE-2017-17866 CVE-2018-5686 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for mupdf to version 1.12.0 fixes several issues. These security issues were fixed: - CVE-2018-5686: Prevent infinite loop in pdf_parse_array function because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file (bsc#1075936). - CVE-2017-15369: The build_filter_chain function in pdf/pdf-stream.c mishandled a case where a variable may reside in a register, which allowed remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document (bsc#1063413). - CVE-2017-15587: Prevent integer overflow in pdf_read_new_xref_section that allowed for DoS (bsc#1064027). - CVE-2017-17866: Fixed mishandling of length changes when a repair operation occured during a clean operation, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document (bsc#1074116). - CVE-2017-17858: Fixed a heap-based buffer overflow in the ensure_solid_xref function which allowed a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers were unrestricted (bsc#1077161). For non-security changes please refer to the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-89=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-89=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): mupdf-1.12.0-23.1 mupdf-devel-static-1.12.0-23.1 - openSUSE Leap 42.2 (i586 x86_64): mupdf-1.12.0-13.10.1 mupdf-devel-static-1.12.0-13.10.1 References: https://www.suse.com/security/cve/CVE-2017-15369.html https://www.suse.com/security/cve/CVE-2017-15587.html https://www.suse.com/security/cve/CVE-2017-17858.html https://www.suse.com/security/cve/CVE-2017-17866.html https://www.suse.com/security/cve/CVE-2018-5686.html https://bugzilla.suse.com/1063413 https://bugzilla.suse.com/1064027 https://bugzilla.suse.com/1074116 https://bugzilla.suse.com/1075936 https://bugzilla.suse.com/1077161

1 0

openSUSE-RU-2018:0226-1: moderate: Recommended update for kmozillahelper
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for kmozillahelper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0226-1 Rating: moderate References: #1067656 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmozillahelper fixes the following issues: - File dialogs could fail to deliver correct results under some circumstances, occasionally preventing Thunderbird from saving attachments (boo#1067656) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-97=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): kmozillahelper-5.0.2-3.1 kmozillahelper-debuginfo-5.0.2-3.1 kmozillahelper-debugsource-5.0.2-3.1 References: https://bugzilla.suse.com/1067656

1 0

openSUSE-SU-2018:0225-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0225-1 Rating: moderate References: #1061967 Cross-References: CVE-2017-15047 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis to version 4.0.6 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-15047: Buffer overflows occurring reading redis.conf (bsc#1061967) The following bugs are fixed: - Several PSYNC2 bugs could cause data corruption Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-93=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): redis-4.0.6-12.1 redis-debuginfo-4.0.6-12.1 redis-debugsource-4.0.6-12.1 References: https://www.suse.com/security/cve/CVE-2017-15047.html https://bugzilla.suse.com/1061967

1 0

openSUSE-RU-2018:0224-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0224-1 Rating: moderate References: #1077177 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner contains the following fixes and changes (boo#1077177) - Allow changelog-year specification via cmdline - Add groups for rust - Fix bug in otherprovides removal Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-96=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): spec-cleaner-1.0.2-40.1 spec-cleaner-format_spec_file-1.0.2-40.1 References: https://bugzilla.suse.com/1077177

1 0

openSUSE-SU-2018:0223-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0223-1 Rating: important References: #1076369 Cross-References: CVE-2017-3737 CVE-2018-2562 CVE-2018-2573 CVE-2018-2583 CVE-2018-2590 CVE-2018-2591 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2645 CVE-2018-2647 CVE-2018-2665 CVE-2018-2668 CVE-2018-2696 CVE-2018-2703 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for mysql-community-server to version 5.6.39 fixes several issues. These security issues were fixed: - CVE-2018-2622: Vulnerability in the subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2562: Vulnerability in the subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1076369). - CVE-2018-2640: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2665: Vulnerability in the subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2668: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2696: Vulnerability in the subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2583: Vulnerability in the subcomponent: Stored Procedure. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2612: Vulnerability in the subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2703: Vulnerability in the subcomponent: Server : Security : Privileges. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2573: Vulnerability in the subcomponent: Server: GIS. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2017-3737: OpenSSL introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it did not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error - CVE-2018-2647: Vulnerability in the subcomponent: Server: Replication. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1076369). - CVE-2018-2591: Vulnerability in the subcomponent: Server : Partition. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2590: Vulnerability in the subcomponent: Server: Performance Schema. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369). - CVE-2018-2645: Vulnerability in the subcomponent: Server: Performance Schema. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data (bsc#1076369). For additional details please see http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-39.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-90=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-90=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.39-33.1 libmysql56client18-debuginfo-5.6.39-33.1 libmysql56client_r18-5.6.39-33.1 mysql-community-server-5.6.39-33.1 mysql-community-server-bench-5.6.39-33.1 mysql-community-server-bench-debuginfo-5.6.39-33.1 mysql-community-server-client-5.6.39-33.1 mysql-community-server-client-debuginfo-5.6.39-33.1 mysql-community-server-debuginfo-5.6.39-33.1 mysql-community-server-debugsource-5.6.39-33.1 mysql-community-server-test-5.6.39-33.1 mysql-community-server-test-debuginfo-5.6.39-33.1 mysql-community-server-tools-5.6.39-33.1 mysql-community-server-tools-debuginfo-5.6.39-33.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.39-33.1 libmysql56client18-debuginfo-32bit-5.6.39-33.1 libmysql56client_r18-32bit-5.6.39-33.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.39-33.1 - openSUSE Leap 42.2 (i586 x86_64): libmysql56client18-5.6.39-24.15.1 libmysql56client18-debuginfo-5.6.39-24.15.1 libmysql56client_r18-5.6.39-24.15.1 mysql-community-server-5.6.39-24.15.1 mysql-community-server-bench-5.6.39-24.15.1 mysql-community-server-bench-debuginfo-5.6.39-24.15.1 mysql-community-server-client-5.6.39-24.15.1 mysql-community-server-client-debuginfo-5.6.39-24.15.1 mysql-community-server-debuginfo-5.6.39-24.15.1 mysql-community-server-debugsource-5.6.39-24.15.1 mysql-community-server-test-5.6.39-24.15.1 mysql-community-server-test-debuginfo-5.6.39-24.15.1 mysql-community-server-tools-5.6.39-24.15.1 mysql-community-server-tools-debuginfo-5.6.39-24.15.1 - openSUSE Leap 42.2 (noarch): mysql-community-server-errormessages-5.6.39-24.15.1 - openSUSE Leap 42.2 (x86_64): libmysql56client18-32bit-5.6.39-24.15.1 libmysql56client18-debuginfo-32bit-5.6.39-24.15.1 libmysql56client_r18-32bit-5.6.39-24.15.1 References: https://www.suse.com/security/cve/CVE-2017-3737.html https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2573.html https://www.suse.com/security/cve/CVE-2018-2583.html https://www.suse.com/security/cve/CVE-2018-2590.html https://www.suse.com/security/cve/CVE-2018-2591.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2645.html https://www.suse.com/security/cve/CVE-2018-2647.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://www.suse.com/security/cve/CVE-2018-2696.html https://www.suse.com/security/cve/CVE-2018-2703.html https://bugzilla.suse.com/1076369

1 0

openSUSE-SU-2018:0222-1: moderate: Security update for tre
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for tre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0222-1 Rating: moderate References: #1005483 Cross-References: CVE-2016-8859 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tre fixes one issue. This security issue was fixed: - CVE-2016-8859: Fixed multiple integer overflows which allowed attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggered an out-of-bounds write (boo#1005483) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-91=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-91=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): agrep-0.8.0_git201402282055-10.1 agrep-debuginfo-0.8.0_git201402282055-10.1 libtre5-0.8.0_git201402282055-10.1 libtre5-debuginfo-0.8.0_git201402282055-10.1 python-tre-0.8.0_git201402282055-10.1 python-tre-debuginfo-0.8.0_git201402282055-10.1 tre-0.8.0_git201402282055-10.1 tre-debugsource-0.8.0_git201402282055-10.1 tre-devel-0.8.0_git201402282055-10.1 - openSUSE Leap 42.3 (noarch): tre-lang-0.8.0_git201402282055-10.1 - openSUSE Leap 42.2 (i586 x86_64): agrep-0.8.0_git201402282055-7.3.1 agrep-debuginfo-0.8.0_git201402282055-7.3.1 libtre5-0.8.0_git201402282055-7.3.1 libtre5-debuginfo-0.8.0_git201402282055-7.3.1 python-tre-0.8.0_git201402282055-7.3.1 python-tre-debuginfo-0.8.0_git201402282055-7.3.1 tre-0.8.0_git201402282055-7.3.1 tre-debugsource-0.8.0_git201402282055-7.3.1 tre-devel-0.8.0_git201402282055-7.3.1 - openSUSE Leap 42.2 (noarch): tre-lang-0.8.0_git201402282055-7.3.1 References: https://www.suse.com/security/cve/CVE-2016-8859.html https://bugzilla.suse.com/1005483

1 0

openSUSE-RU-2018:0221-1: Recommended update for yast2-fcoe-client
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for yast2-fcoe-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0221-1 Rating: low References: #1043419 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-fcoe-client provides the following fix: - Make sure the interface gets correctly named when using auto_vlan=yes. (bsc#1043419) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-94=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-94=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): yast2-fcoe-client-3.1.15-5.1 - openSUSE Leap 42.2 (noarch): yast2-fcoe-client-3.1.15-2.3.1 References: https://bugzilla.suse.com/1043419

1 0

openSUSE-SU-2018:0220-1: moderate: Security update for libevent
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for libevent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0220-1 Rating: moderate References: #1022917 #1022918 #1022919 Cross-References: CVE-2016-10195 CVE-2016-10196 CVE-2016-10197 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libevent fixes the following security issues: - CVE-2016-10195: DNS remote stack overread vulnerability (bsc#1022917) - CVE-2016-10196: stack/buffer overflow in evutil_parse_sockaddr_port() (bsc#1022918) - CVE-2016-10197: out-of-bounds read in search_make_new() (bsc#1022919) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-95=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-95=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libevent-2_0-5-2.0.21-10.1 libevent-2_0-5-debuginfo-2.0.21-10.1 libevent-debugsource-2.0.21-10.1 libevent-devel-2.0.21-10.1 - openSUSE Leap 42.3 (x86_64): libevent-2_0-5-32bit-2.0.21-10.1 libevent-2_0-5-debuginfo-32bit-2.0.21-10.1 - openSUSE Leap 42.2 (i586 x86_64): libevent-2_0-5-2.0.21-7.3.1 libevent-2_0-5-debuginfo-2.0.21-7.3.1 libevent-debugsource-2.0.21-7.3.1 libevent-devel-2.0.21-7.3.1 - openSUSE Leap 42.2 (x86_64): libevent-2_0-5-32bit-2.0.21-7.3.1 libevent-2_0-5-debuginfo-32bit-2.0.21-7.3.1 References: https://www.suse.com/security/cve/CVE-2016-10195.html https://www.suse.com/security/cve/CVE-2016-10196.html https://www.suse.com/security/cve/CVE-2016-10197.html https://bugzilla.suse.com/1022917 https://bugzilla.suse.com/1022918 https://bugzilla.suse.com/1022919

1 0

openSUSE-SU-2018:0218-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0218-1 Rating: moderate References: #1043353 #1043354 #1051442 #1052708 #1052717 #1052777 #1054600 #1055374 #1055455 #1057000 #1062752 Cross-References: CVE-2017-11750 CVE-2017-12641 CVE-2017-12673 CVE-2017-12676 CVE-2017-12935 CVE-2017-13142 CVE-2017-13147 CVE-2017-14103 CVE-2017-15218 CVE-2017-9261 CVE-2017-9262 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2017-9262: The ReadJNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043353) - CVE-2017-9261: The ReadMNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043354) - CVE-2017-11750: The ReadOneJNGImage function in coders/png.c allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1051442) - CVE-2017-12676: Prevent memory leak in the function ReadOneJNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052708) - CVE-2017-12673: Prevent memory leak in the function ReadOneMNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052717) - CVE-2017-12641: Prevent a memory leak vulnerability in ReadOneJNGImage in coders\png.c (bsc#1052777) - CVE-2017-12935: The ReadMNGImage function in coders/png.c mishandled large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c (bsc#1054600) - CVE-2017-13147: Prevent allocation failure in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value (bsc#1055374) - CVE-2017-13142: Added additional checks for short files to prevent a crafted PNG file from triggering a crash (bsc#1055455) - CVE-2017-14103: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c did not properly manage image pointers after certain error conditions, which allowed remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call (bsc#1057000) - CVE-2017-15218: Prevent memory leak in ReadOneJNGImage in coders/png.c (bsc#1062752) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-88=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-88=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-60.1 GraphicsMagick-debuginfo-1.3.25-60.1 GraphicsMagick-debugsource-1.3.25-60.1 GraphicsMagick-devel-1.3.25-60.1 libGraphicsMagick++-Q16-12-1.3.25-60.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-60.1 libGraphicsMagick++-devel-1.3.25-60.1 libGraphicsMagick-Q16-3-1.3.25-60.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-60.1 libGraphicsMagick3-config-1.3.25-60.1 libGraphicsMagickWand-Q16-2-1.3.25-60.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-60.1 perl-GraphicsMagick-1.3.25-60.1 perl-GraphicsMagick-debuginfo-1.3.25-60.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.63.1 GraphicsMagick-debuginfo-1.3.25-11.63.1 GraphicsMagick-debugsource-1.3.25-11.63.1 GraphicsMagick-devel-1.3.25-11.63.1 libGraphicsMagick++-Q16-12-1.3.25-11.63.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.63.1 libGraphicsMagick++-devel-1.3.25-11.63.1 libGraphicsMagick-Q16-3-1.3.25-11.63.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.63.1 libGraphicsMagick3-config-1.3.25-11.63.1 libGraphicsMagickWand-Q16-2-1.3.25-11.63.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.63.1 perl-GraphicsMagick-1.3.25-11.63.1 perl-GraphicsMagick-debuginfo-1.3.25-11.63.1 References: https://www.suse.com/security/cve/CVE-2017-11750.html https://www.suse.com/security/cve/CVE-2017-12641.html https://www.suse.com/security/cve/CVE-2017-12673.html https://www.suse.com/security/cve/CVE-2017-12676.html https://www.suse.com/security/cve/CVE-2017-12935.html https://www.suse.com/security/cve/CVE-2017-13142.html https://www.suse.com/security/cve/CVE-2017-13147.html https://www.suse.com/security/cve/CVE-2017-14103.html https://www.suse.com/security/cve/CVE-2017-15218.html https://www.suse.com/security/cve/CVE-2017-9261.html https://www.suse.com/security/cve/CVE-2017-9262.html https://bugzilla.suse.com/1043353 https://bugzilla.suse.com/1043354 https://bugzilla.suse.com/1051442 https://bugzilla.suse.com/1052708 https://bugzilla.suse.com/1052717 https://bugzilla.suse.com/1052777 https://bugzilla.suse.com/1054600 https://bugzilla.suse.com/1055374 https://bugzilla.suse.com/1055455 https://bugzilla.suse.com/1057000 https://bugzilla.suse.com/1062752

1 0

openSUSE-SU-2018:0211-1: moderate: Security update for libexif
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for libexif ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0211-1 Rating: moderate References: #1055857 #1059893 Cross-References: CVE-2016-6328 CVE-2017-7544 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libexif fixes several issues. These security issues were fixed: - CVE-2016-6328: Fixed integer overflow in parsing MNOTE entry data of the input file (bsc#1055857) - CVE-2017-7544: Fixed out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure (bsc#1059893) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-86=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-86=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libexif-debugsource-0.6.21-15.1 libexif-devel-0.6.21-15.1 libexif12-0.6.21-15.1 libexif12-debuginfo-0.6.21-15.1 - openSUSE Leap 42.3 (x86_64): libexif12-32bit-0.6.21-15.1 libexif12-debuginfo-32bit-0.6.21-15.1 - openSUSE Leap 42.2 (i586 x86_64): libexif-debugsource-0.6.21-12.3.1 libexif-devel-0.6.21-12.3.1 libexif12-0.6.21-12.3.1 libexif12-debuginfo-0.6.21-12.3.1 - openSUSE Leap 42.2 (x86_64): libexif12-32bit-0.6.21-12.3.1 libexif12-debuginfo-32bit-0.6.21-12.3.1 References: https://www.suse.com/security/cve/CVE-2016-6328.html https://www.suse.com/security/cve/CVE-2017-7544.html https://bugzilla.suse.com/1055857 https://bugzilla.suse.com/1059893

1 0

openSUSE-SU-2018:0210-1: moderate: Security update for libvpx
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for libvpx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0210-1 Rating: moderate References: #1075992 Cross-References: CVE-2017-13194 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvpx fixes one issues. This security issue was fixed: - CVE-2017-13194: Fixed incorrect memory allocation related to odd frame width (bsc#1075992). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-87=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-87=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvpx-debugsource-1.3.0-8.1 libvpx-devel-1.3.0-8.1 libvpx1-1.3.0-8.1 libvpx1-debuginfo-1.3.0-8.1 vpx-tools-1.3.0-8.1 vpx-tools-debuginfo-1.3.0-8.1 - openSUSE Leap 42.3 (x86_64): libvpx1-32bit-1.3.0-8.1 libvpx1-debuginfo-32bit-1.3.0-8.1 - openSUSE Leap 42.2 (i586 x86_64): libvpx-debugsource-1.3.0-5.3.1 libvpx-devel-1.3.0-5.3.1 libvpx1-1.3.0-5.3.1 libvpx1-debuginfo-1.3.0-5.3.1 vpx-tools-1.3.0-5.3.1 vpx-tools-debuginfo-1.3.0-5.3.1 - openSUSE Leap 42.2 (x86_64): libvpx1-32bit-1.3.0-5.3.1 libvpx1-debuginfo-32bit-1.3.0-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-13194.html https://bugzilla.suse.com/1075992

1 0

openSUSE-RU-2018:0209-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0209-1 Rating: moderate References: #1069777 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - The KDE Plasma workspace may have crashed after switching activities (boo#1069777) - Auto-hide panels containing the global menu would not be visible on menu activation (kde#384861) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-78=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): drkonqi5-5.8.7-5.1 drkonqi5-debuginfo-5.8.7-5.1 plasma5-workspace-5.8.7-5.1 plasma5-workspace-debuginfo-5.8.7-5.1 plasma5-workspace-debugsource-5.8.7-5.1 plasma5-workspace-devel-5.8.7-5.1 plasma5-workspace-libs-5.8.7-5.1 plasma5-workspace-libs-debuginfo-5.8.7-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-workspace-lang-5.8.7-5.1 References: https://bugzilla.suse.com/1069777

1 0

openSUSE-RU-2018:0208-1: Recommended update for yast2-firstboot
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for yast2-firstboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0208-1 Rating: low References: #1028371 #1070388 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-firstboot provides the following fix: - Bring back HostnameDialog adding it into firstboot_hostname once it was removed from yast2-network (bsc#1028371, bsc#1070388) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-79=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-79=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): yast2-firstboot-3.1.18-5.1 - openSUSE Leap 42.2 (noarch): yast2-firstboot-3.1.18-2.3.1 References: https://bugzilla.suse.com/1028371 https://bugzilla.suse.com/1070388

1 0

openSUSE-RU-2018:0207-1: moderate: Recommended update for libisds, datovka, shigofumi
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for libisds, datovka, shigofumi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0207-1 Rating: moderate References: #1077294 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains updated support for the Czech Data Box Information System (Informační systém datových schránek). Changes in libisds: * Add OVM_FO, OVM_PFO, OVM_PO, PFO_AUDITOR box types * Add RECEIVER and GUARDIAN user types. * Correct user identification issues * translation and documentation updates Changes in datovka: * Can now encrypt passwords via master password * Better support for screen readers * Add support for new data-box and user types * Add API and support for sending messages into records management services * Translation updates to avoid confusion between legal terms in Czech * Various UI and behavior bug fixes * Add full-text data box search * Add forward message action Changes in shigofumi: * rebuild with libisds * translation updates Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-84=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): datovka-4.10.1-5.1 datovka-debuginfo-4.10.1-5.1 datovka-debugsource-4.10.1-5.1 libisds-debugsource-0.10.7-6.1 libisds-devel-0.10.7-6.1 libisds5-0.10.7-6.1 libisds5-debuginfo-0.10.7-6.1 - openSUSE Leap 42.3 (x86_64): shigofumi-0.8-7.1 shigofumi-debuginfo-0.8-7.1 shigofumi-debugsource-0.8-7.1 References: https://bugzilla.suse.com/1077294

1 0

openSUSE-RU-2018:0206-1: Recommended update for crash
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0206-1 Rating: low References: #1053915 #1068477 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crash provides the following fixes: - Adapt crash utility for analyzing dumps with updated hash page table geometry ("powerpc/mm/hash: Increase VA range to 128TB") (bsc#1068477) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-81=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): crash-7.1.8-4.1 crash-debuginfo-7.1.8-4.1 crash-debugsource-7.1.8-4.1 crash-devel-7.1.8-4.1 crash-doc-7.1.8-4.1 crash-eppic-7.1.8-4.1 crash-eppic-debuginfo-7.1.8-4.1 crash-gcore-7.1.8-4.1 crash-gcore-debuginfo-7.1.8-4.1 - openSUSE Leap 42.3 (x86_64): crash-kmp-default-7.1.8_k4.4.104_39-4.1 crash-kmp-default-debuginfo-7.1.8_k4.4.104_39-4.1 References: https://bugzilla.suse.com/1053915 https://bugzilla.suse.com/1068477

1 0

openSUSE-RU-2018:0205-1: Recommended update for open-iscsi
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0205-1 Rating: low References: #1028323 #1029364 #1055492 #1072312 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for open-iscsi provides the following fixes: - Start iscsi logins before remote filesystems, so that the shutdown order is also changed to prevent hanging. (bsc#1028323) - Add missing coreutils dependency for initrd macros.(bsc#1055492) - Clear errno before calling strtoull in iscsiadm. (bsc#1029364) - Fix some vulnerabilities in iscsiuio reported by Qualys. (bsc#1072312) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-82=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): iscsiuio-0.7.8.2-53.1 iscsiuio-debuginfo-0.7.8.2-53.1 open-iscsi-2.0.874-53.1 open-iscsi-debuginfo-2.0.874-53.1 open-iscsi-debugsource-2.0.874-53.1 References: https://bugzilla.suse.com/1028323 https://bugzilla.suse.com/1029364 https://bugzilla.suse.com/1055492 https://bugzilla.suse.com/1072312

1 0

openSUSE-RU-2018:0204-1: Recommended update for ovmf
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0204-1 Rating: low References: #1073537 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ovmf provides the following fix: - Add support for virtual machines with more than 1TB of memory. (bsc#1073537) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-80=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-4.1 ovmf-tools-2017+git1492060560.b6d11d7c46-4.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-4.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-4.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-4.1 References: https://bugzilla.suse.com/1073537

1 0

openSUSE-SU-2018:0203-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0203-1 Rating: important References: #1077291 Cross-References: CVE-2018-5089 CVE-2018-5091 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - update to Firefox 52.6esr (boo#1077291) MFSA 2018-01 * Speculative execution side-channel attack ("Spectre") MFSA 2018-03 * CVE-2018-5091 (bmo#1423086) Use-after-free with DTMF timers * CVE-2018-5095 (bmo#1418447) Integer overflow in Skia library during edge builder allocation * CVE-2018-5096 (bmo#1418922) Use-after-free while editing form elements * CVE-2018-5097 (bmo#1387427) Use-after-free when source document is manipulated during XSLT * CVE-2018-5098 (bmo#1399400) Use-after-free while manipulating form input elements * CVE-2018-5099 (bmo#1416878) Use-after-free with widget listener * CVE-2018-5102 (bmo#1419363) Use-after-free in HTML media elements * CVE-2018-5103 (bmo#1423159) Use-after-free during mouse event handling * CVE-2018-5104 (bmo#1425000) Use-after-free during font face manipulation * CVE-2018-5117 (bmo#1395508) URL spoofing with right-to-left text aligned left-to-right * CVE-2018-5089 Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6 - Added additional patches and configurations to fix builds on s390 and PowerPC. * Added firefox-glibc-getrandom.patch effecting builds on s390 and PowerPC * Added mozilla-s390-bigendian.patch along with icudt58b.dat bigendian ICU data file for running Firefox on bigendian architectures (bmo#1322212 and bmo#1264836) * Added mozilla-s390-nojit.patch to enable atomic operations used by the JS engine when JIT is disabled on s390 * Build configuration options specific to s390 * Requires NSS >= 3.29.5 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-85=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-85=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.6-75.1 MozillaFirefox-branding-upstream-52.6-75.1 MozillaFirefox-buildsymbols-52.6-75.1 MozillaFirefox-debuginfo-52.6-75.1 MozillaFirefox-debugsource-52.6-75.1 MozillaFirefox-devel-52.6-75.1 MozillaFirefox-translations-common-52.6-75.1 MozillaFirefox-translations-other-52.6-75.1 - openSUSE Leap 42.2 (x86_64): MozillaFirefox-52.6-57.30.1 MozillaFirefox-branding-upstream-52.6-57.30.1 MozillaFirefox-buildsymbols-52.6-57.30.1 MozillaFirefox-debuginfo-52.6-57.30.1 MozillaFirefox-debugsource-52.6-57.30.1 MozillaFirefox-devel-52.6-57.30.1 MozillaFirefox-translations-common-52.6-57.30.1 MozillaFirefox-translations-other-52.6-57.30.1 References: https://www.suse.com/security/cve/CVE-2018-5089.html https://www.suse.com/security/cve/CVE-2018-5091.html https://www.suse.com/security/cve/CVE-2018-5095.html https://www.suse.com/security/cve/CVE-2018-5096.html https://www.suse.com/security/cve/CVE-2018-5097.html https://www.suse.com/security/cve/CVE-2018-5098.html https://www.suse.com/security/cve/CVE-2018-5099.html https://www.suse.com/security/cve/CVE-2018-5102.html https://www.suse.com/security/cve/CVE-2018-5103.html https://www.suse.com/security/cve/CVE-2018-5104.html https://www.suse.com/security/cve/CVE-2018-5117.html https://bugzilla.suse.com/1077291

1 0

openSUSE-RU-2018:0202-1: Recommended update for makedumpfile
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for makedumpfile ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0202-1 Rating: low References: #1068485 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for makedumpfile provides the following fix: - Adapt makedumpfile tool for filtering dumps with updated hash page table geometry ("powerpc/mm/hash: Increase VA range to 128TB") (bsc#1068485) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-83=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): makedumpfile-1.6.1-3.1 makedumpfile-debuginfo-1.6.1-3.1 makedumpfile-debugsource-1.6.1-3.1 References: https://bugzilla.suse.com/1068485

1 0

openSUSE-RU-2018:0201-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 25 Jan '18

25 Jan '18

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0201-1 Rating: moderate References: #1069777 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - The KDE Plasma workspace may have crashed after switching activities (boo#1069777) - Auto-hide panels containing the global menu would not be visible on menu activation (kde#384861) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-78=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): plasma5-workspace-lang-5.8.7-8.1 - openSUSE Leap 42.3 (x86_64): drkonqi5-5.8.7-8.1 drkonqi5-debuginfo-5.8.7-8.1 plasma5-workspace-5.8.7-8.1 plasma5-workspace-debuginfo-5.8.7-8.1 plasma5-workspace-debugsource-5.8.7-8.1 plasma5-workspace-devel-5.8.7-8.1 plasma5-workspace-libs-5.8.7-8.1 plasma5-workspace-libs-debuginfo-5.8.7-8.1 References: https://bugzilla.suse.com/1069777

1 0

openSUSE-OU-2018:0194-1: moderate: Optional update adding fio to the SUSE PackageHub
by maintenance＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Optional Update: Optional update adding fio to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0194-1 Rating: moderate References: #783876 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds fio to the SUSE PackageHub. Fio is an I/O benchmark and stress testing tool. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-77=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): fio-3.3-2.1 gfio-3.3-2.1 References: https://bugzilla.suse.com/783876

1 0

openSUSE-SU-2018:0190-1: moderate: Security update for clamav-database
by opensuse-security＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Security Update: Security update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0190-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav-database updates the database. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-76=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201801220009-54.133.1 References:

1 0

openSUSE-RU-2018:0189-1: moderate: Recommended update for xfce4-settings
by maintenance＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Recommended Update: Recommended update for xfce4-settings ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0189-1 Rating: moderate References: #1026976 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xfce4-settings fixes the following issues: - libinput support was missing in XFCE (boo#1026976) The 4.12.1 release also fixes a number of minor display and stability bugs. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-73=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-73=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): xfce4-settings-4.12.1-7.1 xfce4-settings-debuginfo-4.12.1-7.1 xfce4-settings-debugsource-4.12.1-7.1 - openSUSE Leap 42.3 (noarch): xfce4-settings-branding-openSUSE-4.12.0-10.1 xfce4-settings-branding-upstream-4.12.1-7.1 xfce4-settings-lang-4.12.1-7.1 - openSUSE Leap 42.2 (noarch): xfce4-settings-branding-openSUSE-4.12.0-6.4.1 xfce4-settings-branding-upstream-4.12.1-4.3.1 xfce4-settings-lang-4.12.1-4.3.1 - openSUSE Leap 42.2 (x86_64): xfce4-settings-4.12.1-4.3.1 xfce4-settings-debuginfo-4.12.1-4.3.1 xfce4-settings-debugsource-4.12.1-4.3.1 References: https://bugzilla.suse.com/1026976

1 0

openSUSE-RU-2018:0188-1: moderate: Recommended update for scout
by maintenance＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Recommended Update: Recommended update for scout ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0188-1 Rating: moderate References: #1037101 #980393 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for scout fixes the following issues: - command-not-found (cnf) would be unable to find packages after a repository rename (boo#980393) - command-not-found (cnf) would not work until repositories are configured (boo#1037101) The following upstream changes are included: - allow for multiple repos to be in one .repo file - update translations Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-71=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-71=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): command-not-found-0.1.1+20180103.0595254-6.1 scout-0.1.1+20180103.0595254-6.1 - openSUSE Leap 42.2 (noarch): command-not-found-0.1.1+20180103.0595254-3.3.1 scout-0.1.1+20180103.0595254-3.3.1 References: https://bugzilla.suse.com/1037101 https://bugzilla.suse.com/980393

1 0

openSUSE-SU-2018:0187-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0187-1 Rating: important References: #1068032 #1076372 Cross-References: CVE-2017-5715 CVE-2018-2676 CVE-2018-2685 CVE-2018-2686 CVE-2018-2687 CVE-2018-2688 CVE-2018-2689 CVE-2018-2690 CVE-2018-2693 CVE-2018-2694 CVE-2018-2698 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for virtualbox to version 5.1.32 fixes the following issues: The following vulnerabilities were fixed (boo#1076372): - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, also known as "Spectre", bsc#1068032. - CVE-2018-2676: Local authenticated attacker may gain elevated privileges - CVE-2018-2685: Local authenticated attacker may gain elevated privileges - CVE-2018-2686: Local authenticated attacker may gain elevated privileges - CVE-2018-2687: Local authenticated attacker may gain elevated privileges - CVE-2018-2688: Local authenticated attacker may gain elevated privileges - CVE-2018-2689: Local authenticated attacker may gain elevated privileges - CVE-2018-2690: Local authenticated attacker may gain elevated privileges - CVE-2018-2693: Local authenticated attacker may gain elevated privileges via guest additions - CVE-2018-2694: Local authenticated attacker may gain elevated privileges - CVE-2018-2698: Local authenticated attacker may gain elevated privileges The following bug fixes are included: - fix occasional screen corruption when host screen resolution is changed - increase proposed disk size when creating new VMs for Windows 7 and newer - fix broken communication with certain devices on Linux hosts - Fix problems using 256MB VRAM in raw-mode VMs - add HDA support for more exotic guests (e.g. Haiku) - fix playback with ALSA backend (5.1.28 regression) - fix a problem where OHCI emulation might sporadically drop data transfers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-75=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-75=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): python-virtualbox-5.1.32-42.1 python-virtualbox-debuginfo-5.1.32-42.1 virtualbox-5.1.32-42.1 virtualbox-debuginfo-5.1.32-42.1 virtualbox-debugsource-5.1.32-42.1 virtualbox-devel-5.1.32-42.1 virtualbox-guest-kmp-default-5.1.32_k4.4.104_39-42.1 virtualbox-guest-kmp-default-debuginfo-5.1.32_k4.4.104_39-42.1 virtualbox-guest-tools-5.1.32-42.1 virtualbox-guest-tools-debuginfo-5.1.32-42.1 virtualbox-guest-x11-5.1.32-42.1 virtualbox-guest-x11-debuginfo-5.1.32-42.1 virtualbox-host-kmp-default-5.1.32_k4.4.104_39-42.1 virtualbox-host-kmp-default-debuginfo-5.1.32_k4.4.104_39-42.1 virtualbox-qt-5.1.32-42.1 virtualbox-qt-debuginfo-5.1.32-42.1 virtualbox-vnc-5.1.32-42.1 virtualbox-websrv-5.1.32-42.1 virtualbox-websrv-debuginfo-5.1.32-42.1 - openSUSE Leap 42.3 (noarch): virtualbox-guest-desktop-icons-5.1.32-42.1 virtualbox-guest-source-5.1.32-42.1 virtualbox-host-source-5.1.32-42.1 - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.32-19.49.1 virtualbox-guest-source-5.1.32-19.49.1 virtualbox-host-source-5.1.32-19.49.1 - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.32-19.49.1 python-virtualbox-debuginfo-5.1.32-19.49.1 virtualbox-5.1.32-19.49.1 virtualbox-debuginfo-5.1.32-19.49.1 virtualbox-debugsource-5.1.32-19.49.1 virtualbox-devel-5.1.32-19.49.1 virtualbox-guest-kmp-default-5.1.32_k4.4.104_18.44-19.49.1 virtualbox-guest-kmp-default-debuginfo-5.1.32_k4.4.104_18.44-19.49.1 virtualbox-guest-tools-5.1.32-19.49.1 virtualbox-guest-tools-debuginfo-5.1.32-19.49.1 virtualbox-guest-x11-5.1.32-19.49.1 virtualbox-guest-x11-debuginfo-5.1.32-19.49.1 virtualbox-host-kmp-default-5.1.32_k4.4.104_18.44-19.49.1 virtualbox-host-kmp-default-debuginfo-5.1.32_k4.4.104_18.44-19.49.1 virtualbox-qt-5.1.32-19.49.1 virtualbox-qt-debuginfo-5.1.32-19.49.1 virtualbox-vnc-5.1.32-19.49.1 virtualbox-websrv-5.1.32-19.49.1 virtualbox-websrv-debuginfo-5.1.32-19.49.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-2676.html https://www.suse.com/security/cve/CVE-2018-2685.html https://www.suse.com/security/cve/CVE-2018-2686.html https://www.suse.com/security/cve/CVE-2018-2687.html https://www.suse.com/security/cve/CVE-2018-2688.html https://www.suse.com/security/cve/CVE-2018-2689.html https://www.suse.com/security/cve/CVE-2018-2690.html https://www.suse.com/security/cve/CVE-2018-2693.html https://www.suse.com/security/cve/CVE-2018-2694.html https://www.suse.com/security/cve/CVE-2018-2698.html https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1076372

1 0

openSUSE-RU-2018:0186-1: moderate: Recommended update for tigervnc
by maintenance＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0186-1 Rating: moderate References: #1075403 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tigervnc fixes the following issues: - Windows browsers with 16 bit color depth configured would be eunable to connect using the java viewer (boo#1075403) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-72=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libXvnc-devel-1.6.0-16.20.1 libXvnc1-1.6.0-16.20.1 libXvnc1-debuginfo-1.6.0-16.20.1 tigervnc-1.6.0-16.20.1 tigervnc-debuginfo-1.6.0-16.20.1 tigervnc-debugsource-1.6.0-16.20.1 xorg-x11-Xvnc-1.6.0-16.20.1 xorg-x11-Xvnc-debuginfo-1.6.0-16.20.1 References: https://bugzilla.suse.com/1075403

1 0

openSUSE-RU-2018:0185-1: moderate: Recommended update for python3-websocket-client
by maintenance＠opensuse.org 24 Jan '18

24 Jan '18

openSUSE Recommended Update: Recommended update for python3-websocket-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0185-1 Rating: moderate References: #1076519 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-websocket-client fixes the following issues: - The library did not contain a CA bundle and the system CAs had to be manually specified. Make it use the systems ca bundle file by default (boo#1076519) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-74=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-74=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-websocket-client-0.37.0-5.1 python3-websocket-client-test-0.37.0-5.1 - openSUSE Leap 42.2 (noarch): python3-websocket-client-0.37.0-2.3.1 python3-websocket-client-test-0.37.0-2.3.1 References: https://bugzilla.suse.com/1076519

1 0

openSUSE-RU-2018:0168-1: moderate: Recommended update for gcc48
by maintenance＠opensuse.org 22 Jan '18

22 Jan '18

openSUSE Recommended Update: Recommended update for gcc48 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0168-1 Rating: moderate References: #1074621 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gcc48 fixes the following issues: Added support for generation of retpolines on x86_64. [bnc#1074621] This support is used for building the Linux Kernel with retpoline support to mitigate the Spectre Variant 2 attack. New compiler options have been added to specify specific code generation: * -mindirect-branch=keep * -mindirect-branch=thunk * -mindirect-branch=thunk-extern * -mindirect-branch=thunk-inline * -mindirect-branch-register * -mfunction-return=keep * -mfunction-return=thunk * -mfunction-return=thunk-extern * -mfunction-return=thunk-inline This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-69=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): cpp48-4.8.5-23.9.2 cpp48-debuginfo-4.8.5-23.9.2 gcc48-4.8.5-23.9.2 gcc48-ada-4.8.5-23.9.2 gcc48-ada-debuginfo-4.8.5-23.9.2 gcc48-c++-4.8.5-23.9.2 gcc48-c++-debuginfo-4.8.5-23.9.2 gcc48-debuginfo-4.8.5-23.9.2 gcc48-debugsource-4.8.5-23.9.2 gcc48-fortran-4.8.5-23.9.2 gcc48-fortran-debuginfo-4.8.5-23.9.2 gcc48-gij-4.8.5-23.9.2 gcc48-gij-debuginfo-4.8.5-23.9.2 gcc48-java-4.8.5-23.9.2 gcc48-java-debuginfo-4.8.5-23.9.2 gcc48-locale-4.8.5-23.9.2 gcc48-obj-c++-4.8.5-23.9.2 gcc48-obj-c++-debuginfo-4.8.5-23.9.2 gcc48-objc-4.8.5-23.9.2 gcc48-objc-debuginfo-4.8.5-23.9.2 gcc48-testresults-4.8.5-23.9.2 libada48-4.8.5-23.9.2 libada48-debuginfo-4.8.5-23.9.2 libasan0-4.8.5-23.9.2 libasan0-debuginfo-4.8.5-23.9.2 libffi4-gcc48-4.8.5-23.9.1 libffi4-gcc48-debuginfo-4.8.5-23.9.1 libffi48-debugsource-4.8.5-23.9.1 libffi48-devel-4.8.5-23.9.1 libgcj48-4.8.5-23.9.2 libgcj48-debuginfo-4.8.5-23.9.2 libgcj48-debugsource-4.8.5-23.9.2 libgcj48-devel-4.8.5-23.9.2 libgcj48-devel-debuginfo-4.8.5-23.9.2 libgcj48-jar-4.8.5-23.9.2 libgcj_bc1-gcc48-4.8.5-23.9.2 libobjc4-4.8.5-23.9.2 libobjc4-debuginfo-4.8.5-23.9.2 libstdc++48-devel-4.8.5-23.9.2 - openSUSE Leap 42.2 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.5-23.9.2 cross-armv6hl-gcc48-icecream-backend-4.8.5-23.9.2 cross-armv7hl-gcc48-icecream-backend-4.8.5-23.9.2 cross-i386-gcc48-icecream-backend-4.8.5-23.9.2 cross-ia64-gcc48-icecream-backend-4.8.5-23.9.2 cross-ppc-gcc48-icecream-backend-4.8.5-23.9.2 cross-ppc64-gcc48-icecream-backend-4.8.5-23.9.2 cross-ppc64le-gcc48-icecream-backend-4.8.5-23.9.2 cross-s390-gcc48-icecream-backend-4.8.5-23.9.2 cross-s390x-gcc48-icecream-backend-4.8.5-23.9.2 gcc48-32bit-4.8.5-23.9.2 gcc48-ada-32bit-4.8.5-23.9.2 gcc48-fortran-32bit-4.8.5-23.9.2 gcc48-gij-32bit-4.8.5-23.9.2 gcc48-gij-debuginfo-32bit-4.8.5-23.9.2 gcc48-objc-32bit-4.8.5-23.9.2 libada48-32bit-4.8.5-23.9.2 libada48-32bit-debuginfo-4.8.5-23.9.2 libasan0-32bit-4.8.5-23.9.2 libasan0-32bit-debuginfo-4.8.5-23.9.2 libffi4-gcc48-32bit-4.8.5-23.9.1 libffi4-gcc48-32bit-debuginfo-4.8.5-23.9.1 libffi48-devel-32bit-4.8.5-23.9.1 libgcj48-32bit-4.8.5-23.9.2 libgcj48-debuginfo-32bit-4.8.5-23.9.2 libgcj48-devel-32bit-4.8.5-23.9.2 libgcj48-devel-debuginfo-32bit-4.8.5-23.9.2 libobjc4-32bit-4.8.5-23.9.2 libobjc4-32bit-debuginfo-4.8.5-23.9.2 libstdc++48-devel-32bit-4.8.5-23.9.2 - openSUSE Leap 42.2 (noarch): gcc48-info-4.8.5-23.9.2 libstdc++48-doc-4.8.5-23.9.2 References: https://bugzilla.suse.com/1074621

1 0

openSUSE-RU-2018:0167-1: moderate: Recommended update for gcc48
by maintenance＠opensuse.org 22 Jan '18

22 Jan '18

openSUSE Recommended Update: Recommended update for gcc48 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0167-1 Rating: moderate References: #1074621 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gcc48 fixes the following issues: Added support for generation of retpolines on x86_64. [bnc#1074621] This support is used for building the Linux Kernel with retpoline support to mitigate the Spectre Variant 2 attack. New compiler options have been added to specify specific code generation: * -mindirect-branch=keep * -mindirect-branch=thunk * -mindirect-branch=thunk-extern * -mindirect-branch=thunk-inline * -mindirect-branch-register * -mfunction-return=keep * -mfunction-return=thunk * -mfunction-return=thunk-extern * -mfunction-return=thunk-inline This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-70=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp48-4.8.5-32.1 cpp48-debuginfo-4.8.5-32.1 gcc48-4.8.5-32.1 gcc48-ada-4.8.5-32.1 gcc48-ada-debuginfo-4.8.5-32.1 gcc48-c++-4.8.5-32.1 gcc48-c++-debuginfo-4.8.5-32.1 gcc48-debuginfo-4.8.5-32.1 gcc48-debugsource-4.8.5-32.1 gcc48-fortran-4.8.5-32.1 gcc48-fortran-debuginfo-4.8.5-32.1 gcc48-gij-4.8.5-32.1 gcc48-gij-debuginfo-4.8.5-32.1 gcc48-java-4.8.5-32.1 gcc48-java-debuginfo-4.8.5-32.1 gcc48-locale-4.8.5-32.1 gcc48-obj-c++-4.8.5-32.1 gcc48-obj-c++-debuginfo-4.8.5-32.1 gcc48-objc-4.8.5-32.1 gcc48-objc-debuginfo-4.8.5-32.1 gcc48-testresults-4.8.5-32.1 libada48-4.8.5-32.1 libada48-debuginfo-4.8.5-32.1 libasan0-4.8.5-32.1 libasan0-debuginfo-4.8.5-32.1 libffi4-gcc48-4.8.5-32.1 libffi4-gcc48-debuginfo-4.8.5-32.1 libffi48-debugsource-4.8.5-32.1 libffi48-devel-4.8.5-32.1 libgcj48-4.8.5-32.1 libgcj48-debuginfo-4.8.5-32.1 libgcj48-debugsource-4.8.5-32.1 libgcj48-devel-4.8.5-32.1 libgcj48-devel-debuginfo-4.8.5-32.1 libgcj48-jar-4.8.5-32.1 libgcj_bc1-4.8.5-32.1 libobjc4-4.8.5-32.1 libobjc4-debuginfo-4.8.5-32.1 libstdc++48-devel-4.8.5-32.1 - openSUSE Leap 42.3 (noarch): gcc48-info-4.8.5-32.1 libstdc++48-doc-4.8.5-32.1 - openSUSE Leap 42.3 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.5-32.1 cross-armv6hl-gcc48-icecream-backend-4.8.5-32.1 cross-armv7hl-gcc48-icecream-backend-4.8.5-32.1 cross-i386-gcc48-icecream-backend-4.8.5-32.1 cross-ia64-gcc48-icecream-backend-4.8.5-32.1 cross-ppc-gcc48-icecream-backend-4.8.5-32.1 cross-ppc64-gcc48-icecream-backend-4.8.5-32.1 cross-ppc64le-gcc48-icecream-backend-4.8.5-32.1 cross-s390-gcc48-icecream-backend-4.8.5-32.1 cross-s390x-gcc48-icecream-backend-4.8.5-32.1 gcc48-32bit-4.8.5-32.1 gcc48-ada-32bit-4.8.5-32.1 gcc48-fortran-32bit-4.8.5-32.1 gcc48-gij-32bit-4.8.5-32.1 gcc48-gij-debuginfo-32bit-4.8.5-32.1 gcc48-objc-32bit-4.8.5-32.1 libada48-32bit-4.8.5-32.1 libada48-32bit-debuginfo-4.8.5-32.1 libasan0-32bit-4.8.5-32.1 libasan0-32bit-debuginfo-4.8.5-32.1 libffi4-gcc48-32bit-4.8.5-32.1 libffi4-gcc48-32bit-debuginfo-4.8.5-32.1 libffi48-devel-32bit-4.8.5-32.1 libgcj48-32bit-4.8.5-32.1 libgcj48-debuginfo-32bit-4.8.5-32.1 libgcj48-devel-32bit-4.8.5-32.1 libgcj48-devel-debuginfo-32bit-4.8.5-32.1 libobjc4-32bit-4.8.5-32.1 libobjc4-32bit-debuginfo-4.8.5-32.1 libstdc++48-devel-32bit-4.8.5-32.1 References: https://bugzilla.suse.com/1074621

1 0

openSUSE-SU-2018:0166-1: important: Security update for newsbeuter
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for newsbeuter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0166-1 Rating: important References: #1054578 Cross-References: CVE-2017-12904 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for newsbeuter fixes one issues. This security issue was fixed: - CVE-2017-12904: Improper neutralization of special elements allowed remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL (bsc#1054578). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-62=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-62=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): newsbeuter-2.9-5.1 newsbeuter-debuginfo-2.9-5.1 newsbeuter-debugsource-2.9-5.1 - openSUSE Leap 42.3 (noarch): newsbeuter-lang-2.9-5.1 - openSUSE Leap 42.2 (noarch): newsbeuter-lang-2.9-2.3.1 - openSUSE Leap 42.2 (x86_64): newsbeuter-2.9-2.3.1 newsbeuter-debuginfo-2.9-2.3.1 newsbeuter-debugsource-2.9-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-12904.html https://bugzilla.suse.com/1054578

1 0

openSUSE-RU-2018:0165-1: Recommended update for libvirt-cim
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for libvirt-cim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0165-1 Rating: low References: #1002028 #1076418 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libvirt-cim provides the following fixes: - Fix a number of memory leaks detected while running xml_parse_test under valgrind. - Fix some asprintf related memory leaks. (bsc#1002028) - Don't unregister providers on upgrade. (bsc#1076418) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-68=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-68=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): libvirt-cim-0.6.3-6.1 libvirt-cim-debuginfo-0.6.3-6.1 libvirt-cim-debugsource-0.6.3-6.1 - openSUSE Leap 42.2 (x86_64): libvirt-cim-0.6.3-3.3.1 libvirt-cim-debuginfo-0.6.3-3.3.1 libvirt-cim-debugsource-0.6.3-3.3.1 References: https://bugzilla.suse.com/1002028 https://bugzilla.suse.com/1076418

1 0

openSUSE-RU-2018:0164-1: Recommended update for lvm2
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0164-1 Rating: low References: #1063051 #1067312 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for lvm2 provides the following fix: - Backport various upstream fixes for clvmd. (bsc#1063051) - Don't print error messages on testing the connection to the daemon. (bsc#1063051) - Fix handling of udev CHANGE events with systemd. (bsc#1067312) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-59=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-59=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): device-mapper-1.02.97-80.1 device-mapper-debuginfo-1.02.97-80.1 device-mapper-devel-1.02.97-80.1 lvm2-2.02.120-80.1 lvm2-clvm-2.02.120-80.1 lvm2-clvm-debuginfo-2.02.120-80.1 lvm2-cmirrord-2.02.120-80.1 lvm2-cmirrord-debuginfo-2.02.120-80.1 lvm2-debuginfo-2.02.120-80.1 lvm2-debugsource-2.02.120-80.1 lvm2-devel-2.02.120-80.1 - openSUSE Leap 42.3 (x86_64): device-mapper-32bit-1.02.97-80.1 device-mapper-debuginfo-32bit-1.02.97-80.1 device-mapper-devel-32bit-1.02.97-80.1 - openSUSE Leap 42.2 (i586 x86_64): device-mapper-1.02.97-73.9.1 device-mapper-debuginfo-1.02.97-73.9.1 device-mapper-devel-1.02.97-73.9.1 lvm2-2.02.120-73.9.1 lvm2-clvm-2.02.120-73.9.1 lvm2-clvm-debuginfo-2.02.120-73.9.1 lvm2-cmirrord-2.02.120-73.9.1 lvm2-cmirrord-debuginfo-2.02.120-73.9.1 lvm2-debuginfo-2.02.120-73.9.1 lvm2-debugsource-2.02.120-73.9.1 lvm2-devel-2.02.120-73.9.1 - openSUSE Leap 42.2 (x86_64): device-mapper-32bit-1.02.97-73.9.1 device-mapper-debuginfo-32bit-1.02.97-73.9.1 device-mapper-devel-32bit-1.02.97-73.9.1 References: https://bugzilla.suse.com/1063051 https://bugzilla.suse.com/1067312

1 0

openSUSE-RU-2018:0163-1: Recommended update for perf
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0163-1 Rating: low References: #1056756 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perf provides the following fix: - Add perf scripting support for ppc64le (bsc#1056756) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-54=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): perf-4.4.104-44.2 perf-debuginfo-4.4.104-44.2 perf-debugsource-4.4.104-44.2 References: https://bugzilla.suse.com/1056756

1 0

openSUSE-RU-2018:0162-1: Recommended update for ovmf
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0162-1 Rating: low References: #1072241 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ovmf provides the following fix: - Add support for virtual machines with more than 1TB of memory. (bsc#1072241) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-66=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ovmf-2015+git1462940744.321151f-12.6.1 ovmf-tools-2015+git1462940744.321151f-12.6.1 - openSUSE Leap 42.2 (noarch): qemu-ovmf-ia32-2015+git1462940744.321151f-12.6.1 qemu-ovmf-x86_64-2015+git1462940744.321151f-12.6.1 - openSUSE Leap 42.2 (x86_64): qemu-ovmf-x86_64-debug-2015+git1462940744.321151f-12.6.1 References: https://bugzilla.suse.com/1072241

1 0

openSUSE-SU-2018:0161-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0161-1 Rating: moderate References: #1069222 #1069226 Cross-References: CVE-2017-8816 CVE-2017-8817 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2017-8816: Buffer overrun flaw in the NTLM authentication code (bsc#1069226). - CVE-2017-8817: Read out of bounds flaw in the FTP wildcard function (bsc#1069222). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-56=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-56=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-27.1 curl-debuginfo-7.37.0-27.1 curl-debugsource-7.37.0-27.1 libcurl-devel-7.37.0-27.1 libcurl4-7.37.0-27.1 libcurl4-debuginfo-7.37.0-27.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-27.1 libcurl4-32bit-7.37.0-27.1 libcurl4-debuginfo-32bit-7.37.0-27.1 - openSUSE Leap 42.2 (i586 x86_64): curl-7.37.0-16.12.1 curl-debuginfo-7.37.0-16.12.1 curl-debugsource-7.37.0-16.12.1 libcurl-devel-7.37.0-16.12.1 libcurl4-7.37.0-16.12.1 libcurl4-debuginfo-7.37.0-16.12.1 - openSUSE Leap 42.2 (x86_64): libcurl-devel-32bit-7.37.0-16.12.1 libcurl4-32bit-7.37.0-16.12.1 libcurl4-debuginfo-32bit-7.37.0-16.12.1 References: https://www.suse.com/security/cve/CVE-2017-8816.html https://www.suse.com/security/cve/CVE-2017-8817.html https://bugzilla.suse.com/1069222 https://bugzilla.suse.com/1069226

1 0

openSUSE-RU-2018:0160-1: moderate: Recommended update for neovim
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0160-1 Rating: moderate References: #1075614 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for neovim fixes the following issues: - neovim did not open files from file managers if the path contained spaces (boo#1075614) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-58=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-58=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): neovim-lang-0.2.0-3.1 - openSUSE Leap 42.3 (x86_64): neovim-0.2.0-3.1 neovim-debuginfo-0.2.0-3.1 neovim-debugsource-0.2.0-3.1 - openSUSE Leap 42.2 (x86_64): neovim-0.1.4-2.3.1 neovim-debuginfo-0.1.4-2.3.1 neovim-debugsource-0.1.4-2.3.1 References: https://bugzilla.suse.com/1075614

1 0

openSUSE-SU-2018:0159-1: moderate: Security update for ncurses
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0159-1 Rating: moderate References: #1056127 #1056128 #1056129 #1056131 #1056132 #1056136 Cross-References: CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-13728: Fix infinite loop in the next_char function in comp_scan.c (bsc#1056136). - CVE-2017-13730: Fix illegal address access in the function _nc_read_entry_source() (bsc#1056131). - CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127). - CVE-2017-13729: Fix illegal address access in the _nc_save_str (bsc#1056132). - CVE-2017-13732: Fix illegal address access in the function dump_uses() (bsc#1056128). - CVE-2017-13731: Fix illegal address access in the function postprocess_termcap() (bsc#1056129). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-55=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-55=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libncurses5-5.9-62.1 libncurses5-debuginfo-5.9-62.1 libncurses6-5.9-62.1 libncurses6-debuginfo-5.9-62.1 ncurses-debugsource-5.9-62.1 ncurses-devel-5.9-62.1 ncurses-devel-debuginfo-5.9-62.1 ncurses-utils-5.9-62.1 ncurses-utils-debuginfo-5.9-62.1 tack-5.9-62.1 tack-debuginfo-5.9-62.1 terminfo-5.9-62.1 terminfo-base-5.9-62.1 - openSUSE Leap 42.3 (x86_64): libncurses5-32bit-5.9-62.1 libncurses5-debuginfo-32bit-5.9-62.1 libncurses6-32bit-5.9-62.1 libncurses6-debuginfo-32bit-5.9-62.1 ncurses-devel-32bit-5.9-62.1 ncurses-devel-debuginfo-32bit-5.9-62.1 - openSUSE Leap 42.2 (i586 x86_64): libncurses5-5.9-55.9.1 libncurses5-debuginfo-5.9-55.9.1 libncurses6-5.9-55.9.1 libncurses6-debuginfo-5.9-55.9.1 ncurses-debugsource-5.9-55.9.1 ncurses-devel-5.9-55.9.1 ncurses-devel-debuginfo-5.9-55.9.1 ncurses-utils-5.9-55.9.1 ncurses-utils-debuginfo-5.9-55.9.1 tack-5.9-55.9.1 tack-debuginfo-5.9-55.9.1 terminfo-5.9-55.9.1 terminfo-base-5.9-55.9.1 - openSUSE Leap 42.2 (x86_64): libncurses5-32bit-5.9-55.9.1 libncurses5-debuginfo-32bit-5.9-55.9.1 libncurses6-32bit-5.9-55.9.1 libncurses6-debuginfo-32bit-5.9-55.9.1 ncurses-devel-32bit-5.9-55.9.1 ncurses-devel-debuginfo-32bit-5.9-55.9.1 References: https://www.suse.com/security/cve/CVE-2017-13728.html https://www.suse.com/security/cve/CVE-2017-13729.html https://www.suse.com/security/cve/CVE-2017-13730.html https://www.suse.com/security/cve/CVE-2017-13731.html https://www.suse.com/security/cve/CVE-2017-13732.html https://www.suse.com/security/cve/CVE-2017-13733.html https://bugzilla.suse.com/1056127 https://bugzilla.suse.com/1056128 https://bugzilla.suse.com/1056129 https://bugzilla.suse.com/1056131 https://bugzilla.suse.com/1056132 https://bugzilla.suse.com/1056136

1 0

openSUSE-SU-2018:0158-1: important: Security update for xmltooling
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for xmltooling ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0158-1 Rating: important References: #1075975 Cross-References: CVE-2018-0486 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xmltooling fixes the following issues: - CVE-2018-0486: Fixed a security bug when xmltooling mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD (bsc#1075975) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-65=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-65=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): libxmltooling-devel-1.5.6-6.1 libxmltooling6-1.5.6-6.1 libxmltooling6-debuginfo-1.5.6-6.1 xmltooling-debugsource-1.5.6-6.1 xmltooling-schemas-1.5.6-6.1 - openSUSE Leap 42.2 (x86_64): libxmltooling-devel-1.5.6-3.3.1 libxmltooling6-1.5.6-3.3.1 libxmltooling6-debuginfo-1.5.6-3.3.1 xmltooling-debugsource-1.5.6-3.3.1 xmltooling-schemas-1.5.6-3.3.1 References: https://www.suse.com/security/cve/CVE-2018-0486.html https://bugzilla.suse.com/1075975

1 0

openSUSE-RU-2018:0157-1: moderate: Recommended update for krusader
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for krusader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0157-1 Rating: moderate References: #1075690 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for krusader fixes the following issue: - the "Create New" context menu did not work when the '..' entry was selected (boo#1075690) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-52=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): kio_iso-2.6.0-3.1 kio_iso-debuginfo-2.6.0-3.1 krusader-2.6.0-3.1 krusader-debuginfo-2.6.0-3.1 krusader-debugsource-2.6.0-3.1 krusader-doc-2.6.0-3.1 References: https://bugzilla.suse.com/1075690

1 0

openSUSE-RU-2018:0156-1: moderate: Recommended update for scummvm
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for scummvm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0156-1 Rating: moderate References: #1073248 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for scummvm fixes the following issues: Scummvm was updated to version 2.0.0: - New Games: * Added support for Full Pipe. * Added support for Hi-Res Adventure #3: Cranston Manor. * Added support for Hi-Res Adventure #4: Ulysses and the Golden Fleece. * Added support for Hi-Res Adventure #5: Time Zone. * Added support for Hi-Res Adventure #6: The Dark Crystal. * Added support for Riven. * Added support for Starship Titanic English & German. - New Games (Sierra SCI2 - SCI3): * Added support for Gabriel Knight. * Added support for Gabriel Knight 2. * Added support for King's Quest VII. * Added support for King's Questions. * Added support for Leisure Suit Larry 6 (hires). * Added support for Leisure Suit Larry 7. * Added support for Lighthouse. * Added support for Mixed-Up Mother Goose Deluxe. * Added support for Phantasmagoria. * Added support for Phantasmagoria 2. * Added support for Police Quest 4. * Added support for RAMA. * Added support for Shivers. * Added support for Space Quest 6. * Added support for Torin's Passage. - General: * Added bilinear filtering option for SDL2 fullscreen mode. * Fixed a bug that caused a crash in the options dialog of the GUI. * Added a command-line option to automatically scan for supported games in the current or a specified directory. * Added possibility to apply changes in the options dialog without closing the dialog. * Added support for on-the-fly GUI language switching. * Updated Munt MT-32 emulation code to version 2.0.3. * Improved handling of joysticks. * Improved audio latency. * Improved management of the ScummVM window in games that switch display modes. * Fixed list view drawing over text above it (for example in the save dialog). * Changed location where screenshot are saved. This fixes issues when scummvm is installed in a read*only directory. Also added setting to allow changing this location. * Changed screenshot format to png. * Fixed multithreading issue that could cause a crash in games using MP3 audio. - CVE-2017-17528: Also fixed a possible code execution via the BROWSER environment variable. (boo#1073248) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-53=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-53=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): scummvm-2.0.0-5.1 scummvm-debuginfo-2.0.0-5.1 scummvm-debugsource-2.0.0-5.1 scummvm-extra-2.0.0-5.1 scummvm-extra-debuginfo-2.0.0-5.1 - openSUSE Leap 42.2 (i586 x86_64): scummvm-2.0.0-2.3.1 scummvm-debuginfo-2.0.0-2.3.1 scummvm-debugsource-2.0.0-2.3.1 scummvm-extra-2.0.0-2.3.1 scummvm-extra-debuginfo-2.0.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-17528.html https://bugzilla.suse.com/1073248

1 0

openSUSE-SU-2018:0155-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0155-1 Rating: moderate References: #1047044 #1047898 #1050120 #1050606 #1051446 #1052468 #1052550 #1052710 #1052720 #1052731 #1052732 #1055065 #1055323 #1055434 #1055855 #1058640 #1059751 #1074123 #1074969 #1074973 #1074975 Cross-References: CVE-2017-10800 CVE-2017-11141 CVE-2017-11529 CVE-2017-11644 CVE-2017-11724 CVE-2017-12434 CVE-2017-12564 CVE-2017-12667 CVE-2017-12670 CVE-2017-12672 CVE-2017-12675 CVE-2017-13060 CVE-2017-13146 CVE-2017-13648 CVE-2017-13658 CVE-2017-14326 CVE-2017-14533 CVE-2017-17881 CVE-2017-18022 CVE-2018-5246 CVE-2018-5247 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2018-5246: Fixed memory leak vulnerability in ReadPATTERNImage in coders/pattern.c (bsc#1074973) - CVE-2017-18022: Fixed memory leak vulnerability in MontageImageCommand in MagickWand/montage.c (bsc#1074975) - CVE-2018-5247: Fixed memory leak vulnerability in ReadRLAImage in coders/rla.c (bsc#1074969) - CVE-2017-12672: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service (bsc#1052720) - CVE-2017-13060: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service via a crafted file (bsc#1055065) - CVE-2017-11724: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c involving the quantum_info and clone_info data structures (bsc#1051446) - CVE-2017-12670: Added validation in coders/mat.c to prevent an assertion failure in the function DestroyImage in MagickCore/image.c, which allowed attackers to cause a denial of service (bsc#1052731) - CVE-2017-12667: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1052732) - CVE-2017-13146: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1055323) - CVE-2017-10800: Processing MATLAB images in coders/mat.c could have lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object was larger than the actual amount of data (bsc#1047044) - CVE-2017-13648: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1055434) - CVE-2017-11141: Fixed a memory leak vulnerability in the function ReadMATImage in coders\mat.c that could have caused memory exhaustion via a crafted MAT file, related to incorrect ordering of a SetImageExtent call (bsc#1047898) - CVE-2017-11529: The ReadMATImage function in coders/mat.c allowed remote attackers to cause a denial of service (memory leak) via a crafted file (bsc#1050120) - CVE-2017-12564: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service (bsc#1052468) - CVE-2017-12434: Added a missing NULL check in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c (bsc#1052550) - CVE-2017-12675: Added a missing check for multidimensional data coders/mat.c, that could have lead to a memory leak in the function ReadImage in MagickCore/constitute.c, which allowed attackers to cause a denial of service (bsc#1052710) - CVE-2017-14326: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service via a crafted file (bsc#1058640) - CVE-2017-11644: Processesing a crafted file in convert could have lead to a memory leak in the ReadMATImage() function in coders/mat.c (bsc#1050606) - CVE-2017-13658: Added a missing NULL check in the ReadMATImage function in coders/mat.c, which could have lead to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c (bsc#1055855) - CVE-2017-14533: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1059751) - CVE-2017-17881: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service via a crafted MAT image file (bsc#1074123) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-61=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-61=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-49.1 ImageMagick-debuginfo-6.8.8.1-49.1 ImageMagick-debugsource-6.8.8.1-49.1 ImageMagick-devel-6.8.8.1-49.1 ImageMagick-extra-6.8.8.1-49.1 ImageMagick-extra-debuginfo-6.8.8.1-49.1 libMagick++-6_Q16-3-6.8.8.1-49.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-49.1 libMagick++-devel-6.8.8.1-49.1 libMagickCore-6_Q16-1-6.8.8.1-49.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-49.1 libMagickWand-6_Q16-1-6.8.8.1-49.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-49.1 perl-PerlMagick-6.8.8.1-49.1 perl-PerlMagick-debuginfo-6.8.8.1-49.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-49.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-49.1 libMagick++-6_Q16-3-32bit-6.8.8.1-49.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-49.1 libMagick++-devel-32bit-6.8.8.1-49.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-49.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-49.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-49.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-49.1 - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-30.21.1 ImageMagick-debuginfo-6.8.8.1-30.21.1 ImageMagick-debugsource-6.8.8.1-30.21.1 ImageMagick-devel-6.8.8.1-30.21.1 ImageMagick-extra-6.8.8.1-30.21.1 ImageMagick-extra-debuginfo-6.8.8.1-30.21.1 libMagick++-6_Q16-3-6.8.8.1-30.21.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-30.21.1 libMagick++-devel-6.8.8.1-30.21.1 libMagickCore-6_Q16-1-6.8.8.1-30.21.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-30.21.1 libMagickWand-6_Q16-1-6.8.8.1-30.21.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-30.21.1 perl-PerlMagick-6.8.8.1-30.21.1 perl-PerlMagick-debuginfo-6.8.8.1-30.21.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-30.21.1 libMagick++-6_Q16-3-32bit-6.8.8.1-30.21.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-30.21.1 libMagick++-devel-32bit-6.8.8.1-30.21.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-30.21.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-30.21.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-30.21.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-30.21.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-30.21.1 References: https://www.suse.com/security/cve/CVE-2017-10800.html https://www.suse.com/security/cve/CVE-2017-11141.html https://www.suse.com/security/cve/CVE-2017-11529.html https://www.suse.com/security/cve/CVE-2017-11644.html https://www.suse.com/security/cve/CVE-2017-11724.html https://www.suse.com/security/cve/CVE-2017-12434.html https://www.suse.com/security/cve/CVE-2017-12564.html https://www.suse.com/security/cve/CVE-2017-12667.html https://www.suse.com/security/cve/CVE-2017-12670.html https://www.suse.com/security/cve/CVE-2017-12672.html https://www.suse.com/security/cve/CVE-2017-12675.html https://www.suse.com/security/cve/CVE-2017-13060.html https://www.suse.com/security/cve/CVE-2017-13146.html https://www.suse.com/security/cve/CVE-2017-13648.html https://www.suse.com/security/cve/CVE-2017-13658.html https://www.suse.com/security/cve/CVE-2017-14326.html https://www.suse.com/security/cve/CVE-2017-14533.html https://www.suse.com/security/cve/CVE-2017-17881.html https://www.suse.com/security/cve/CVE-2017-18022.html https://www.suse.com/security/cve/CVE-2018-5246.html https://www.suse.com/security/cve/CVE-2018-5247.html https://bugzilla.suse.com/1047044 https://bugzilla.suse.com/1047898 https://bugzilla.suse.com/1050120 https://bugzilla.suse.com/1050606 https://bugzilla.suse.com/1051446 https://bugzilla.suse.com/1052468 https://bugzilla.suse.com/1052550 https://bugzilla.suse.com/1052710 https://bugzilla.suse.com/1052720 https://bugzilla.suse.com/1052731 https://bugzilla.suse.com/1052732 https://bugzilla.suse.com/1055065 https://bugzilla.suse.com/1055323 https://bugzilla.suse.com/1055434 https://bugzilla.suse.com/1055855 https://bugzilla.suse.com/1058640 https://bugzilla.suse.com/1059751 https://bugzilla.suse.com/1074123 https://bugzilla.suse.com/1074969 https://bugzilla.suse.com/1074973 https://bugzilla.suse.com/1074975

1 0

openSUSE-RU-2018:0154-1: moderate: Recommended update for monit
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for monit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0154-1 Rating: moderate References: #1072692 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monit fixes the following issues: - monit was unable to start with the supplied scripts (boo#1072692) - Monit was updated to version 5.25.1, including all upstream fixes and improvements Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-50=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-50=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): monit-5.25.1-18.1 monit-debuginfo-5.25.1-18.1 monit-debugsource-5.25.1-18.1 - openSUSE Leap 42.3 (noarch): monit-doc-5.25.1-18.1 - openSUSE Leap 42.2 (i586 x86_64): monit-5.25.1-15.3.1 monit-debuginfo-5.25.1-15.3.1 monit-debugsource-5.25.1-15.3.1 - openSUSE Leap 42.2 (noarch): monit-doc-5.25.1-15.3.1 References: https://bugzilla.suse.com/1072692

1 0

openSUSE-SU-2018:0153-1: moderate: Security update for perl-XML-LibXML
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for perl-XML-LibXML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0153-1 Rating: moderate References: #1046848 Cross-References: CVE-2017-10672 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-XML-LibXML fixes the following issues: Security issue fixed: - CVE-2017-10672: Fix use-after-free that allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call (bsc#1046848). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-60=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-60=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): perl-XML-LibXML-2.0019-10.1 perl-XML-LibXML-debuginfo-2.0019-10.1 perl-XML-LibXML-debugsource-2.0019-10.1 - openSUSE Leap 42.2 (i586 x86_64): perl-XML-LibXML-2.0019-7.3.1 perl-XML-LibXML-debuginfo-2.0019-7.3.1 perl-XML-LibXML-debugsource-2.0019-7.3.1 References: https://www.suse.com/security/cve/CVE-2017-10672.html https://bugzilla.suse.com/1046848

1 0

openSUSE-RU-2018:0152-1: moderate: Recommended update for yast2-product-creator
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for yast2-product-creator ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0152-1 Rating: moderate References: #1071129 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-product-creator provides the following fix: - Fixed a crash when creating an image from the command line. (bsc#1071129) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-64=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): yast2-product-creator-3.2.1-3.1 References: https://bugzilla.suse.com/1071129

1 0

openSUSE-SU-2018:0151-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0151-1 Rating: moderate References: #1056993 Cross-References: CVE-2017-6362 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes one issues. This security issue was fixed: - CVE-2017-6362: Prevent double-free in gdImagePngPtr() that potentially allowed for DoS or remote code execution (bsc#1056993). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-63=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-63=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-21.1 gd-debuginfo-2.1.0-21.1 gd-debugsource-2.1.0-21.1 gd-devel-2.1.0-21.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-21.1 gd-debuginfo-32bit-2.1.0-21.1 - openSUSE Leap 42.2 (i586 x86_64): gd-2.1.0-18.3.1 gd-debuginfo-2.1.0-18.3.1 gd-debugsource-2.1.0-18.3.1 gd-devel-2.1.0-18.3.1 - openSUSE Leap 42.2 (x86_64): gd-32bit-2.1.0-18.3.1 gd-debuginfo-32bit-2.1.0-18.3.1 References: https://www.suse.com/security/cve/CVE-2017-6362.html https://bugzilla.suse.com/1056993

1 0

openSUSE-RU-2018:0150-1: Recommended update for python-rtslib-fb
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for python-rtslib-fb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0150-1 Rating: low References: #1042944 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rtslib-fb enables support for persistent reservations. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-67=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): python-rtslib-fb-2.1.63-3.1 - openSUSE Leap 42.3 (noarch): python-rtslib-fb-doc-2.1.63-3.1 References: https://bugzilla.suse.com/1042944

1 0

openSUSE-SU-2018:0149-1: moderate: Security update for lxterminal
by opensuse-security＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Security Update: Security update for lxterminal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0149-1 Rating: moderate References: #1038127 Cross-References: CVE-2016-10369 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lxterminal fixes the following security issue: - CVE-2016-10369: insecure /tmp usage for a socket file (boo#1038127) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-51=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-51=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): lxterminal-0.2.0-7.1 lxterminal-debuginfo-0.2.0-7.1 lxterminal-debugsource-0.2.0-7.1 - openSUSE Leap 42.3 (noarch): lxterminal-lang-0.2.0-7.1 - openSUSE Leap 42.2 (x86_64): lxterminal-0.2.0-4.3.1 lxterminal-debuginfo-0.2.0-4.3.1 lxterminal-debugsource-0.2.0-4.3.1 - openSUSE Leap 42.2 (noarch): lxterminal-lang-0.2.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2016-10369.html https://bugzilla.suse.com/1038127

1 0

openSUSE-OU-2018:0148-1: Optional update for nextcloud-client
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Optional Update: Optional update for nextcloud-client ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0148-1 Rating: low References: #1076244 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for nextcloud-client to version 2.3.3 contains various bug fixes (boo#1076244): - client and protocol bug fixes - GUI improvements and icon updates - fixes for client crashes - Improve compatibility with server 10.0 - owncloudcmd: Align process return value with sync return value Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-57=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): caja-extension-nextcloud-2.3.3-5.1 nautilus-extension-nextcloud-2.3.3-5.1 nemo-extension-nextcloud-2.3.3-5.1 nextcloud-client-doc-2.3.3-5.1 nextcloud-client-lang-2.3.3-5.1 - openSUSE Leap 42.3 (x86_64): libnextcloudsync-devel-2.3.3-5.1 libnextcloudsync0-2.3.3-5.1 libnextcloudsync0-debuginfo-2.3.3-5.1 nextcloud-client-2.3.3-5.1 nextcloud-client-debuginfo-2.3.3-5.1 nextcloud-client-debugsource-2.3.3-5.1 nextcloud-client-dolphin-2.3.3-5.1 nextcloud-client-dolphin-debuginfo-2.3.3-5.1 References: https://bugzilla.suse.com/1076244

1 0

openSUSE-RU-2018:0147-1: moderate: Recommended update for krusader
by maintenance＠opensuse.org 20 Jan '18

20 Jan '18

openSUSE Recommended Update: Recommended update for krusader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0147-1 Rating: moderate References: #1075690 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for krusader fixes the following issue: - the "Create New" context menu did not work when the '..' entry was selected (boo#1075690) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-52=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio_iso-2.6.0-5.1 kio_iso-debuginfo-2.6.0-5.1 krusader-2.6.0-5.1 krusader-debuginfo-2.6.0-5.1 krusader-debugsource-2.6.0-5.1 krusader-doc-2.6.0-5.1 References: https://bugzilla.suse.com/1075690

1 0

openSUSE-RU-2018:0128-1: moderate: Recommended update for OpenIPMI
by maintenance＠opensuse.org 18 Jan '18

18 Jan '18

openSUSE Recommended Update: Recommended update for OpenIPMI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0128-1 Rating: moderate References: #1060118 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for OpenIPMI provides the following fix: - Fix a crash at startup by making sure gui_winsys.py is properly installed. (bsc#1060118) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-47=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-47=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): OpenIPMI-2.0.21-11.1 OpenIPMI-debuginfo-2.0.21-11.1 OpenIPMI-debugsource-2.0.21-11.1 OpenIPMI-devel-2.0.21-11.1 OpenIPMI-python-2.0.21-11.1 OpenIPMI-python-debuginfo-2.0.21-11.1 - openSUSE Leap 42.2 (i586 x86_64): OpenIPMI-2.0.21-7.6.1 OpenIPMI-debuginfo-2.0.21-7.6.1 OpenIPMI-debugsource-2.0.21-7.6.1 OpenIPMI-devel-2.0.21-7.6.1 OpenIPMI-python-2.0.21-7.6.1 OpenIPMI-python-debuginfo-2.0.21-7.6.1 References: https://bugzilla.suse.com/1060118

1 0

openSUSE-RU-2018:0126-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 18 Jan '18

18 Jan '18

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0126-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: Changes in clamav-database: - database refresh Jan 15th This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-46=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201801150006-54.130.1 References:

1 0

openSUSE-RU-2018:0125-1: Recommended update for systemd-rpm-macros
by maintenance＠opensuse.org 18 Jan '18

18 Jan '18

openSUSE Recommended Update: Recommended update for systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0125-1 Rating: low References: #1059627 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for systemd-rpm-macros provides the following fix: - Make sure to clean up "new-in-upgrade" tag file (bsc#1059627) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-48=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-48=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): systemd-rpm-macros-3-6.1 - openSUSE Leap 42.2 (noarch): systemd-rpm-macros-3-3.3.1 References: https://bugzilla.suse.com/1059627

1 0

openSUSE-SU-2018:0109-1: moderate: Security update for syncthing
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for syncthing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0109-1 Rating: moderate References: #1074428 Cross-References: CVE-2017-1000420 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for syncthing brings a new version and fixes the following issues: - Update to version 0.14.42: * Discovering new files in a deleted directory does not resurrect the directory (gh#syncthing/syncthing#4475). * "Panic: interface conversion: *errors.errorString is not net.Error" after restart (gh#syncthing/syncthing#4561). * Auto-accept shared directories from trusted devices (gh#syncthing/syncthing#2299). * Empty directories in .stversions should be removed (gh#syncthing/syncthing#4406). * Human readable errors on attempted deletion of a non-empty directory (gh#syncthing/syncthing#4476). * Add confirmation on the Remove Folder / Device button (gh#syncthing/syncthing#4543). - Update to version 0.14.41: * Devices with ignored files stay "synchronising" forever (gh#syncthing/syncthing#623). * No Global Discovery without Synch Protocol Listen Address (gh#syncthing/syncthing#4418). * Local network classification doesn't always work (gh#syncthing/syncthing#4421). * Hashed GUI password should not be rehashed (gh#syncthing/syncthing#4458). * Pulls not triggered correctly on reconnection (gh#syncthing/syncthing#4504). * A symlink/file replacement doesn't work properly (gh#syncthing/syncthing#4505). * File/directory replacement doesn't work properly (gh#syncthing/syncthing#4506). * Logging at info level and above should always include context (gh#syncthing/syncthing#4510). * Panic in "pfilter" package on 32 bit architectures (gh#syncthing/syncthing#4537). * Allow synchronising read-only directories as "Master Directories" (gh#syncthing/syncthing#1126). * "Global Changes" button is confusing, retitle to "Recent Changes" (gh#syncthing/syncthing#4326). * Dial device addresses in parallel (gh#syncthing/syncthing#4456). * Avoid lots and lots of announced addresses in the presence of symmetric NAT (gh#syncthing/syncthing#4519). * Split transport usage reporting per stack (gh#syncthing/syncthing#4463). - Update to version 0.14.40: - Report more data part of the anonymous usage report (gh#syncthing/syncthing#3628) - Better report synchronisation errors (gh#syncthing/syncthing#4392). - Removing paused directories no longer causes a panic (gh#syncthing/syncthing#4405). - Make local IPv4 discovery more resilient against write failures (gh#syncthing/syncthing#4414). - Clearer logging around config failures at startup (gh#syncthing/syncthing#4431). - Do not complain about inability to fsync files (gh#syncthing/syncthing#4432). - Improve KCP connections (gh#syncthing/syncthing#4446). - Improve directory health checking (gh#syncthing/syncthing#4451). - Include built-in support for file system notifications, although it is disabled by default. - Enable by default the UDP based "KCP" protocol. - Update to version 0.14.39: * Removing paused directories no longer triggers a crash (gh#syncthing/syncthing#4357). * Add further security related HTTP headers (gh#syncthing/syncthing#4360). * Improve info level logging in some cases (gh#syncthing/syncthing#4375). * Improve GUI tooltips in chromium based browsers (gh#syncthing/syncthing#4377). * Add -device-id command line switch (gh#syncthing/syncthing#4387). * Failure to upgrade directory markers from file to directory type is no longer fatal. - Update to version 0.14.38: * KCP connections are now more stable (gh#syncthing/syncthing#4063, gh#syncthing/syncthing#4343) * Hashing benchmarks are skipped if a manual selection has been forced (gh#syncthing/syncthing#4348). * Relay server RAM usage has been reduced (gh#syncthing/syncthing#4245). - Update to version 0.14.37 (changes since 0.14.32): * Relative version paths are now correctly relative to the directory path (gh#syncthing/syncthing#4188). * Remote devices now show bytes remaining to synchronise (gh#syncthing/syncthing#4227). * Editing ignore patterns no longer incorrectly shows included patterns (gh#syncthing/syncthing#4249). * The new directory dialogue now suggests a default path. Adjustable via advanced config defaultFolderPath (gh#syncthing/syncthing#2157). * The build script no longer sets -installsuffix by default (gh#syncthing/syncthing#4272). * Prevent a vulnerability that allows file overwrite via versioned symlinks (CVE-2017-1000420, boo#1074428, gh#syncthing/syncthing#4286). * Symlinks are deleted from versioned directories on startup (gh#syncthing/syncthing#4288). * Directory paths are no longer reset when editing a directory without a label (gh#syncthing/syncthing#4297). * Better detect synchronisation conflicts that happen while synchronising (gh#syncthing/syncthing#3742, gh#syncthing/syncthing#4305). * Fix a crash related to a nil reference in ignore handling (gh#syncthing/syncthing#4300). - Stop requiring golang.org/x/net/context. - Update to version 0.14.32: * "Nearby devices" are now shown in the add device dialogue, avoiding the need to type their device ID (gh#syncthing/syncthing#4157). * Directories that were once ignored in a sharing request now actually work properly when later added manually (gh#syncthing/syncthing#4219). - Update to version 0.14.31 (changes since 0.14.29): * Correctly clear warning "path is a subdirectory of other folder" in directory dialogue (gh#syncthing/syncthing#3433). * Conflict copies filename now includes the ID of the last device to change the file (gh#syncthing/syncthing#3524). * Directories offered by other devices can now be ignored (gh#syncthing/syncthing#3993). * Changed device name takes effect with restart; device name is not sent to unknown devices (gh#syncthing/syncthing#4164). * Correctly show CPU usage when started with -no-restart option (gh#syncthing/syncthing#4183). * Icons and directory information in local device summary is consistent with that in directories (gh#syncthing/syncthing#4100). * Fix a data race in KCP & STUN (gh#syncthing/syncthing#4177). * Ignore patterns on newly accepted directories are no longer erroneously inherited from an earlier added directory (gh#syncthing/syncthing#4203). - Update to version 0.14.29: * The layout of the global changes dialogue is improved (gh#syncthing/syncthing#3895). * Running as root or SYSTEM now triggers a warning recommending against it (gh#syncthing/syncthing#4123). * Changing the theme no longer causes an HTTP error (gh#syncthing/syncthing#4127). - Update to version 0.14.28: * It is now possible to create custom event subscriptions via the REST API (gh#syncthing/syncthing#1879). * Removing large directories now uses less memory (gh#syncthing/syncthing#2250). * The minimum disc space (per directory and for the home drive) can now be set to an absolute value (gh#syncthing/syncthing#3307). * Pausing or reconfiguring a directory will no longer start extra scans. Pausing a directory stops scanning (gh#syncthing/syncthing#3965). * Ignore patterns can now be set at directory creation time, and for paused directories (gh#syncthing/syncthing#3996). * It is no longer possible to configure the GUI/API to listen on a privileged port using the standard settings dialogue (gh#syncthing/syncthing#4020). * The device allowed subnet list can now include negative ("!") entries to disallow subnets (gh#syncthing/syncthing#4096). * Doing "Override changes" now uses less memory (gh#syncthing/syncthing#4112). - Require golang.org/x/net/context on openSUSE older than openSUSE Leap 15.x. - Update to version 0.14.27: * Devices can now have a list of allowed subnets (advanced config) (gh#syncthing/syncthing#219). * The transfer rate units can now be changed by clicking on the value (gh#syncthing/syncthing#234). * UI text explaining "Introducer" is improved (gh#syncthing/syncthing#1819). * Advanced config editor can now edit lists of things (gh#syncthing/syncthing#2267). * Directories created for new directories now obey the user umask setting (gh#syncthing/syncthing#2519). * Incoming index updates are consistency checked better (gh#syncthing/syncthing#4053). - Update to version 0.14.26: * Discovery errors are more clearly displayed in the GUI (gh#syncthing/syncthing#2344). * The language dropdown menu in the GUI is now correctly sorted (gh#syncthing/syncthing#3913). * When there are items that could not be synced, their full path is displayed in the GUI. - Update to version 0.14.25: * Improve "Pause All"/"Resume All" icons (gh#syncthing/syncthing#4003). * There are now mips and mipsle builds by default (gh#syncthing/syncthing#3959). * The "overwriting protected files" warning now correctly handles relative paths to the config directory (gh#syncthing/syncthing#3183). * The experimental KCP protocol for transfers over UDP has been merged, although it's not currently enabled by default (gh#syncthing/syncthing#804). - Update to version 0.14.24: * lib/sync: Fix a race in unlocker logging (gh#syncthing/syncthing#3884). * Make links and log messages refer to https instead of http where possible (gh#syncthing/syncthing#3976). * The default number of parallel file processing routines per directory is now two (previously one), and the number of simultaneously outstanding network requests has been increased. * The UI now contains buttons to pause or resume all directories with a single action. - Update to version 0.14.23 (changes since 0.14.21): * Leading and trailing spaces are no longer stripped in the GUI password field (gh#syncthing/syncthing#3935) * The GUI shows remaining amount of data to sync per directory (gh#syncthing/syncthing#3908). * There should no longer be empty entries in the global log (gh#syncthing/syncthing#3933). * Weak hashing is now by default only enabled when it makes sense from a performance point of view (gh#syncthing/syncthing#3938). - Update to version 0.14.21 (changes since 0.14.19): * There is now a warning when adding a directory that is a parent of an existing directory (gh#syncthing/syncthing#3197). * Using -logfile flag together with -no-restart now causes an error instead of silently failing (gh#syncthing/syncthing#3912). * Weak hashing is now disabled completely when the threshold percentage is > 100 (gh#syncthing/syncthing#3891). * Rate limiting now actually works on ARM64 builds again (gh#syncthing/syncthing#3921). * Fix an issue where UPnP port allocations would be incorrect under some circumstances (gh#syncthing/syncthing#3924). * Weak hashing is a bit faster and allocates less memory. * The hashing performance reported at startup now includes weak hashing. * The GUI "network error" dialogue no longer shows up as easily in some scenarios when using Syncthing behind a reverse proxy. - Update to version 0.14.19: * Changing bandwidth rate limits now takes effect immediately without restart (gh#syncthing/syncthing#3846) * The event log (-audit) can now be directed to stderr for piping into an another application (gh#syncthing/syncthing#3859). * A panic on directory listing at startup has been fixed (gh#syncthing/syncthing#3584). * When a directory is deleted, the .stfolder marker is also removed. The ignore file and .stversions directory are retained, if present (gh#syncthing/syncthing#3857). * Several scenarios where a device would get stuck with 'not a directory' errors are now handled again (gh#syncthing/syncthing#3819). * Third party copyrights in the about box are now more up to date (gh#syncthing/syncthing#3839). * Hashing performance has been improved (gh#syncthing/syncthing#3861) - Update to version 0.14.18: * Fix connections to older Syncthing versions being no longer closed due to an unmarshalling message: 'proto: wrong wireType = 2 for field BlockIndexes' (gh#syncthing/syncthing#3855). - Update to version 0.14.17: * Panics caused by corrupt on disc database are now better explained in the panic message (gh#syncthing/syncthing#3689). * Statically configured device addresses without port number now correctly defaulted to port 22000 again (gh#syncthing/syncthing#3817). * Inotify clients no longer cause 'invalid subpath' errors to be displayed (gh#syncthing/syncthing#3829). * Directories can now be paused (gh#syncthing/syncthing#215). * "Master" directories are now called "send only" in order to standardise on a terminology of sending and receiving changes (gh#syncthing/syncthing#2679). * Pausing devices and directories now persists across restarts (gh#syncthing/syncthing#3407). * A rolling checksum is used to identify and reuse blocks that have moved within a file (gh#syncthing/syncthing#3527). * Syncthing allows setting the type-of-service field on outgoing packets, configured by the advanced setting "trafficClass" (gh#syncthing/syncthing#3790). * Which device introduced another device is now visible in the GUI (gh#syncthing/syncthing#3809). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-45=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-45=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): syncthing-0.14.42-3.1 - openSUSE Leap 42.2 (i586 x86_64): syncthing-0.14.42-7.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000420.html https://bugzilla.suse.com/1074428

1 0

openSUSE-SU-2018:0108-1: moderate: Security update for python-openpyxl
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for python-openpyxl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0108-1 Rating: moderate References: #1025592 Cross-References: CVE-2017-5992 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-openpyxl fixes one issue. This security issue was fixed: - CVE-2017-5992: Prevent resolving external entities by default, which allowed remote attackers to conduct XXE attacks via a crafted .xlsx document (bsc#1025592). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-44=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-44=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-openpyxl-2.2.2-7.1 - openSUSE Leap 42.2 (noarch): python-openpyxl-2.2.2-4.5.1 References: https://www.suse.com/security/cve/CVE-2017-5992.html https://bugzilla.suse.com/1025592

1 0

openSUSE-SU-2018:0101-1: moderate: Security update for rsync
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0101-1 Rating: moderate References: #1028842 #1062063 #1066644 #1071459 #1071460 #915410 #999847 Cross-References: CVE-2014-9512 CVE-2017-16548 CVE-2017-17433 CVE-2017-17434 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has three fixes is now available. Description: This update for rsync fixes the several issues. These security issues were fixed: - CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also did not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allowed remote attackers to bypass intended access restrictions" (bsc#1071460). - CVE-2017-17433: The recv_files function in receiver.c in the daemon in rsync, proceeded with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allowed remote attackers to bypass intended access restrictions (bsc#1071459). - CVE-2017-16548: The receive_xattr function in xattrs.c in rsync did not check for a trailing '\\0' character in an xattr name, which allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon (bsc#1066644). - CVE-2014-9512: Prevent attackers to write to arbitrary files via a symlink attack on a file in the synchronization path (bsc#915410). These non-security issues were fixed: - Stop file upload after errors like a full disk (boo#1062063) - Ensure -X flag works even when setting owner/group (boo#1028842) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-34=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-34=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rsync-3.1.0-10.1 rsync-debuginfo-3.1.0-10.1 rsync-debugsource-3.1.0-10.1 - openSUSE Leap 42.2 (i586 x86_64): rsync-3.1.0-7.3.1 rsync-debuginfo-3.1.0-7.3.1 rsync-debugsource-3.1.0-7.3.1 References: https://www.suse.com/security/cve/CVE-2014-9512.html https://www.suse.com/security/cve/CVE-2017-16548.html https://www.suse.com/security/cve/CVE-2017-17433.html https://www.suse.com/security/cve/CVE-2017-17434.html https://bugzilla.suse.com/1028842 https://bugzilla.suse.com/1062063 https://bugzilla.suse.com/1066644 https://bugzilla.suse.com/1071459 https://bugzilla.suse.com/1071460 https://bugzilla.suse.com/915410 https://bugzilla.suse.com/999847

1 0

openSUSE-SU-2018:0099-1: moderate: Security update for libetpan
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for libetpan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0099-1 Rating: moderate References: #1038061 Cross-References: CVE-2017-8825 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libetpan fixes the following issues: - CVE-2017-8825: Segmentation faults in mime handling were fixed. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-41=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-41=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libetpan-debugsource-1.6-8.1 libetpan-devel-1.6-8.1 libetpan17-1.6-8.1 libetpan17-debuginfo-1.6-8.1 - openSUSE Leap 42.2 (i586 x86_64): libetpan-debugsource-1.6-5.3.1 libetpan-devel-1.6-5.3.1 libetpan17-1.6-5.3.1 libetpan17-debuginfo-1.6-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-8825.html https://bugzilla.suse.com/1038061

1 0

openSUSE-SU-2018:0098-1: moderate: Security update for pngcrush
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for pngcrush ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0098-1 Rating: moderate References: #1056770 Cross-References: CVE-2015-7700 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pngcrush fixes the following issues: - CVE-2015-7700: Fix for a double-free vulnerability in the sPLT chunk structure and png.c (boo#1056770) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-43=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-43=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): pngcrush-1.7.85-8.1 pngcrush-debuginfo-1.7.85-8.1 pngcrush-debugsource-1.7.85-8.1 - openSUSE Leap 42.2 (i586 x86_64): pngcrush-1.7.85-5.3.1 pngcrush-debuginfo-1.7.85-5.3.1 pngcrush-debugsource-1.7.85-5.3.1 References: https://www.suse.com/security/cve/CVE-2015-7700.html https://bugzilla.suse.com/1056770

1 0

openSUSE-SU-2018:0097-1: important: Security update for tiff
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0097-1 Rating: important References: #1017690 #1069213 #960341 #969783 #983436 Cross-References: CVE-2014-8128 CVE-2015-7554 CVE-2016-10095 CVE-2016-5318 CVE-2017-16232 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for tiff to version 4.0.9 fixes the following issues: Security issues fixed: - CVE-2014-8128: Fix out-of-bounds read with malformed TIFF image in multiple tools (bsc#969783). - CVE-2015-7554: Fix invalid write in tiffsplit / _TIFFVGetField (bsc#960341). - CVE-2016-10095: Fix stack-based buffer overflow in _TIFFVGetField (tif_dir.c) (bsc#1017690). - CVE-2016-5318: Fix stackoverflow in thumbnail (bsc#983436). - CVE-2017-16232: Fix memory-based DoS in tiff2bw (bsc#1069213). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-31=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-31=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-24.1 libtiff5-4.0.9-24.1 libtiff5-debuginfo-4.0.9-24.1 tiff-4.0.9-24.1 tiff-debuginfo-4.0.9-24.1 tiff-debugsource-4.0.9-24.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-24.1 libtiff5-32bit-4.0.9-24.1 libtiff5-debuginfo-32bit-4.0.9-24.1 - openSUSE Leap 42.2 (i586 x86_64): libtiff-devel-4.0.9-17.9.1 libtiff5-4.0.9-17.9.1 libtiff5-debuginfo-4.0.9-17.9.1 tiff-4.0.9-17.9.1 tiff-debuginfo-4.0.9-17.9.1 tiff-debugsource-4.0.9-17.9.1 - openSUSE Leap 42.2 (x86_64): libtiff-devel-32bit-4.0.9-17.9.1 libtiff5-32bit-4.0.9-17.9.1 libtiff5-debuginfo-32bit-4.0.9-17.9.1 References: https://www.suse.com/security/cve/CVE-2014-8128.html https://www.suse.com/security/cve/CVE-2015-7554.html https://www.suse.com/security/cve/CVE-2016-10095.html https://www.suse.com/security/cve/CVE-2016-5318.html https://www.suse.com/security/cve/CVE-2017-16232.html https://bugzilla.suse.com/1017690 https://bugzilla.suse.com/1069213 https://bugzilla.suse.com/960341 https://bugzilla.suse.com/969783 https://bugzilla.suse.com/983436

1 0

openSUSE-SU-2018:0096-1: moderate: Security update for gifsicle
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for gifsicle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0096-1 Rating: moderate References: Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gifsicle to version 1.91 fixes several issues. These security issues were fixed: - Prevent double free by setting last_name to NULL - Prevent NULL pointer dereference for crafted images This non-security issue was fixed: - Add thread support for resizing For other changes please see the upstream changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-42=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-42=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gifsicle-1.91-5.1 gifsicle-debuginfo-1.91-5.1 gifsicle-debugsource-1.91-5.1 - openSUSE Leap 42.2 (i586 x86_64): gifsicle-1.91-2.3.1 gifsicle-debuginfo-1.91-2.3.1 gifsicle-debugsource-1.91-2.3.1 References:

1 0

openSUSE-SU-2018:0095-1: moderate: Security update for postgresql94
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0095-1 Rating: moderate References: #1062538 #1067844 Cross-References: CVE-2017-12172 CVE-2017-15098 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql94 fixes the following issues: Security issues fixed: - CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844). - CVE-2017-12172: Start scripts permit database administrator to modify root-owned files. This issue did not affect SUSE (bsc#1062538). Bug fixes: - Update to version 9.4.15 * https://www.postgresql.org/docs/9.4/static/release-9-4-15.html * https://www.postgresql.org/docs/9.4/static/release-9-4-14.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-38=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-38=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.15-15.1 postgresql94-contrib-9.4.15-15.1 postgresql94-contrib-debuginfo-9.4.15-15.1 postgresql94-debuginfo-9.4.15-15.1 postgresql94-debugsource-9.4.15-15.1 postgresql94-devel-9.4.15-15.1 postgresql94-devel-debuginfo-9.4.15-15.1 postgresql94-libs-debugsource-9.4.15-15.1 postgresql94-plperl-9.4.15-15.1 postgresql94-plperl-debuginfo-9.4.15-15.1 postgresql94-plpython-9.4.15-15.1 postgresql94-plpython-debuginfo-9.4.15-15.1 postgresql94-pltcl-9.4.15-15.1 postgresql94-pltcl-debuginfo-9.4.15-15.1 postgresql94-server-9.4.15-15.1 postgresql94-server-debuginfo-9.4.15-15.1 postgresql94-test-9.4.15-15.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.15-15.1 - openSUSE Leap 42.2 (i586 x86_64): postgresql94-9.4.15-9.12.1 postgresql94-contrib-9.4.15-9.12.1 postgresql94-contrib-debuginfo-9.4.15-9.12.1 postgresql94-debuginfo-9.4.15-9.12.1 postgresql94-debugsource-9.4.15-9.12.1 postgresql94-devel-9.4.15-9.12.1 postgresql94-devel-debuginfo-9.4.15-9.12.1 postgresql94-libs-debugsource-9.4.15-9.12.1 postgresql94-plperl-9.4.15-9.12.1 postgresql94-plperl-debuginfo-9.4.15-9.12.1 postgresql94-plpython-9.4.15-9.12.1 postgresql94-plpython-debuginfo-9.4.15-9.12.1 postgresql94-pltcl-9.4.15-9.12.1 postgresql94-pltcl-debuginfo-9.4.15-9.12.1 postgresql94-server-9.4.15-9.12.1 postgresql94-server-debuginfo-9.4.15-9.12.1 postgresql94-test-9.4.15-9.12.1 - openSUSE Leap 42.2 (noarch): postgresql94-docs-9.4.15-9.12.1 References: https://www.suse.com/security/cve/CVE-2017-12172.html https://www.suse.com/security/cve/CVE-2017-15098.html https://bugzilla.suse.com/1062538 https://bugzilla.suse.com/1067844

1 0

openSUSE-SU-2018:0094-1: moderate: Security update for gwenhywfar
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for gwenhywfar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0094-1 Rating: moderate References: #958331 Cross-References: CVE-2015-7542 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gwenhywfar fixes the following issues: Security issue fixed: - CVE-2015-7542: Make use of the system's default trusted CAs. Also remove the upstream provided ca-bundle.crt file and require ca-certificates so the /etc/ssl/certs directory is populated (bsc#958331). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-37=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-37=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gwenhywfar-debugsource-4.9.0beta-11.1 gwenhywfar-devel-4.9.0beta-11.1 gwenhywfar-tools-4.9.0beta-11.1 gwenhywfar-tools-debuginfo-4.9.0beta-11.1 libgwengui-gtk2-0-4.9.0beta-11.1 libgwengui-gtk2-0-debuginfo-4.9.0beta-11.1 libgwengui-qt4-0-4.9.0beta-11.1 libgwengui-qt4-0-debuginfo-4.9.0beta-11.1 libgwenhywfar60-4.9.0beta-11.1 libgwenhywfar60-debuginfo-4.9.0beta-11.1 libgwenhywfar60-plugins-4.9.0beta-11.1 libgwenhywfar60-plugins-debuginfo-4.9.0beta-11.1 - openSUSE Leap 42.3 (noarch): gwenhywfar-lang-4.9.0beta-11.1 - openSUSE Leap 42.2 (i586 x86_64): gwenhywfar-debugsource-4.9.0beta-8.3.1 gwenhywfar-devel-4.9.0beta-8.3.1 gwenhywfar-tools-4.9.0beta-8.3.1 gwenhywfar-tools-debuginfo-4.9.0beta-8.3.1 libgwengui-gtk2-0-4.9.0beta-8.3.1 libgwengui-gtk2-0-debuginfo-4.9.0beta-8.3.1 libgwengui-qt4-0-4.9.0beta-8.3.1 libgwengui-qt4-0-debuginfo-4.9.0beta-8.3.1 libgwenhywfar60-4.9.0beta-8.3.1 libgwenhywfar60-debuginfo-4.9.0beta-8.3.1 libgwenhywfar60-plugins-4.9.0beta-8.3.1 libgwenhywfar60-plugins-debuginfo-4.9.0beta-8.3.1 - openSUSE Leap 42.2 (noarch): gwenhywfar-lang-4.9.0beta-8.3.1 References: https://www.suse.com/security/cve/CVE-2015-7542.html https://bugzilla.suse.com/958331

1 0

openSUSE-RU-2018:0093-1: Recommended update for at-spi2-core
by maintenance＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Recommended Update: Recommended update for at-spi2-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0093-1 Rating: low References: #1073027 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for at-spi2-core provides the following fix: - Fix a possible buffer overflow on reading dbus address in at-spi-bus-launcher. (bsc#1073027) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-39=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-39=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): at-spi2-core-2.20.2-8.1 at-spi2-core-debuginfo-2.20.2-8.1 at-spi2-core-debugsource-2.20.2-8.1 at-spi2-core-devel-2.20.2-8.1 libatspi0-2.20.2-8.1 libatspi0-debuginfo-2.20.2-8.1 typelib-1_0-Atspi-2_0-2.20.2-8.1 - openSUSE Leap 42.3 (x86_64): at-spi2-core-devel-32bit-2.20.2-8.1 libatspi0-32bit-2.20.2-8.1 libatspi0-debuginfo-32bit-2.20.2-8.1 - openSUSE Leap 42.3 (noarch): at-spi2-core-lang-2.20.2-8.1 - openSUSE Leap 42.2 (i586 x86_64): at-spi2-core-2.20.2-5.3.1 at-spi2-core-debuginfo-2.20.2-5.3.1 at-spi2-core-debugsource-2.20.2-5.3.1 at-spi2-core-devel-2.20.2-5.3.1 libatspi0-2.20.2-5.3.1 libatspi0-debuginfo-2.20.2-5.3.1 typelib-1_0-Atspi-2_0-2.20.2-5.3.1 - openSUSE Leap 42.2 (noarch): at-spi2-core-lang-2.20.2-5.3.1 - openSUSE Leap 42.2 (x86_64): at-spi2-core-devel-32bit-2.20.2-5.3.1 libatspi0-32bit-2.20.2-5.3.1 libatspi0-debuginfo-32bit-2.20.2-5.3.1 References: https://bugzilla.suse.com/1073027

1 0

openSUSE-SU-2018:0092-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0092-1 Rating: moderate References: #1042948 #1049373 #1051412 #1052252 #1052771 #1058082 #1072902 #1074122 #1074425 #1074610 Cross-References: CVE-2017-1000445 CVE-2017-1000476 CVE-2017-11449 CVE-2017-11751 CVE-2017-12430 CVE-2017-12642 CVE-2017-14249 CVE-2017-17680 CVE-2017-17882 CVE-2017-9409 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2017-1000476: A CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allowed attackers to cause a denial of service (bsc#1074610). - CVE-2017-9409: The ReadMPCImage function in mpc.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1042948). - CVE-2017-1000445: A NULL pointer dereference in the MagickCore component might have lead to denial of service (bsc#1074425). - CVE-2017-17680: Prevent a memory leak in the function ReadXPMImage in coders/xpm.c, which allowed attackers to cause a denial of service via a crafted XPM image file (a different vulnerability than CVE-2017-17882) (bsc#1072902). - CVE-2017-17882: Prevent a memory leak in the function ReadXPMImage in coders/xpm.c, which allowed attackers to cause a denial of service via a crafted XPM image file (a different vulnerability than CVE-2017-17680) (bsc#1074122). - CVE-2017-11449: coders/mpc did not enable seekable streams and thus could not validate blob sizes, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin (bsc#1049373). - CVE-2017-12430: A memory exhaustion in the function ReadMPCImage in coders/mpc.c allowed attackers to cause DoS (bsc#1052252). - CVE-2017-12642: Prevent a memory leak vulnerability in ReadMPCImage in coders\mpc.c via crafted file allowing for DoS (bsc#1052771). - CVE-2017-14249: A mishandled EOF check in ReadMPCImage in coders/mpc.c that lead to a division by zero in GetPixelCacheTileSize in MagickCore/cache.c allowed remote attackers to cause a denial of service via a crafted file (bsc#1058082). - Prevent memory leak via crafted file in pwp.c allowing for DoS (bsc#1051412) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-36=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-36=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-46.1 ImageMagick-debuginfo-6.8.8.1-46.1 ImageMagick-debugsource-6.8.8.1-46.1 ImageMagick-devel-6.8.8.1-46.1 ImageMagick-extra-6.8.8.1-46.1 ImageMagick-extra-debuginfo-6.8.8.1-46.1 libMagick++-6_Q16-3-6.8.8.1-46.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-46.1 libMagick++-devel-6.8.8.1-46.1 libMagickCore-6_Q16-1-6.8.8.1-46.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-46.1 libMagickWand-6_Q16-1-6.8.8.1-46.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-46.1 perl-PerlMagick-6.8.8.1-46.1 perl-PerlMagick-debuginfo-6.8.8.1-46.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-46.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-46.1 libMagick++-6_Q16-3-32bit-6.8.8.1-46.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-46.1 libMagick++-devel-32bit-6.8.8.1-46.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-46.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-46.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-46.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-46.1 - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-30.18.1 ImageMagick-debuginfo-6.8.8.1-30.18.1 ImageMagick-debugsource-6.8.8.1-30.18.1 ImageMagick-devel-6.8.8.1-30.18.1 ImageMagick-extra-6.8.8.1-30.18.1 ImageMagick-extra-debuginfo-6.8.8.1-30.18.1 libMagick++-6_Q16-3-6.8.8.1-30.18.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-30.18.1 libMagick++-devel-6.8.8.1-30.18.1 libMagickCore-6_Q16-1-6.8.8.1-30.18.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-30.18.1 libMagickWand-6_Q16-1-6.8.8.1-30.18.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-30.18.1 perl-PerlMagick-6.8.8.1-30.18.1 perl-PerlMagick-debuginfo-6.8.8.1-30.18.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-30.18.1 libMagick++-6_Q16-3-32bit-6.8.8.1-30.18.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-30.18.1 libMagick++-devel-32bit-6.8.8.1-30.18.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-30.18.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-30.18.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-30.18.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-30.18.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-30.18.1 References: https://www.suse.com/security/cve/CVE-2017-1000445.html https://www.suse.com/security/cve/CVE-2017-1000476.html https://www.suse.com/security/cve/CVE-2017-11449.html https://www.suse.com/security/cve/CVE-2017-11751.html https://www.suse.com/security/cve/CVE-2017-12430.html https://www.suse.com/security/cve/CVE-2017-12642.html https://www.suse.com/security/cve/CVE-2017-14249.html https://www.suse.com/security/cve/CVE-2017-17680.html https://www.suse.com/security/cve/CVE-2017-17882.html https://www.suse.com/security/cve/CVE-2017-9409.html https://bugzilla.suse.com/1042948 https://bugzilla.suse.com/1049373 https://bugzilla.suse.com/1051412 https://bugzilla.suse.com/1052252 https://bugzilla.suse.com/1052771 https://bugzilla.suse.com/1058082 https://bugzilla.suse.com/1072902 https://bugzilla.suse.com/1074122 https://bugzilla.suse.com/1074425 https://bugzilla.suse.com/1074610

1 0

openSUSE-RU-2018:0091-1: important: Recommended update for libxcb
by maintenance＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Recommended Update: Recommended update for libxcb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0091-1 Rating: important References: #1073996 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libxcb fixes the following issues: - Some applications had start-up issues with infinite loops related to X11 socket connections (boo#1073996) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-40=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-40=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libxcb-composite0-1.11.1-9.1 libxcb-composite0-debuginfo-1.11.1-9.1 libxcb-damage0-1.11.1-9.1 libxcb-damage0-debuginfo-1.11.1-9.1 libxcb-debugsource-1.11.1-9.1 libxcb-devel-1.11.1-9.1 libxcb-dpms0-1.11.1-9.1 libxcb-dpms0-debuginfo-1.11.1-9.1 libxcb-dri2-0-1.11.1-9.1 libxcb-dri2-0-debuginfo-1.11.1-9.1 libxcb-dri3-0-1.11.1-9.1 libxcb-dri3-0-debuginfo-1.11.1-9.1 libxcb-glx0-1.11.1-9.1 libxcb-glx0-debuginfo-1.11.1-9.1 libxcb-present0-1.11.1-9.1 libxcb-present0-debuginfo-1.11.1-9.1 libxcb-randr0-1.11.1-9.1 libxcb-randr0-debuginfo-1.11.1-9.1 libxcb-record0-1.11.1-9.1 libxcb-record0-debuginfo-1.11.1-9.1 libxcb-render0-1.11.1-9.1 libxcb-render0-debuginfo-1.11.1-9.1 libxcb-res0-1.11.1-9.1 libxcb-res0-debuginfo-1.11.1-9.1 libxcb-screensaver0-1.11.1-9.1 libxcb-screensaver0-debuginfo-1.11.1-9.1 libxcb-shape0-1.11.1-9.1 libxcb-shape0-debuginfo-1.11.1-9.1 libxcb-shm0-1.11.1-9.1 libxcb-shm0-debuginfo-1.11.1-9.1 libxcb-sync1-1.11.1-9.1 libxcb-sync1-debuginfo-1.11.1-9.1 libxcb-xevie0-1.11.1-9.1 libxcb-xevie0-debuginfo-1.11.1-9.1 libxcb-xf86dri0-1.11.1-9.1 libxcb-xf86dri0-debuginfo-1.11.1-9.1 libxcb-xfixes0-1.11.1-9.1 libxcb-xfixes0-debuginfo-1.11.1-9.1 libxcb-xinerama0-1.11.1-9.1 libxcb-xinerama0-debuginfo-1.11.1-9.1 libxcb-xkb1-1.11.1-9.1 libxcb-xkb1-debuginfo-1.11.1-9.1 libxcb-xprint0-1.11.1-9.1 libxcb-xprint0-debuginfo-1.11.1-9.1 libxcb-xtest0-1.11.1-9.1 libxcb-xtest0-debuginfo-1.11.1-9.1 libxcb-xv0-1.11.1-9.1 libxcb-xv0-debuginfo-1.11.1-9.1 libxcb-xvmc0-1.11.1-9.1 libxcb-xvmc0-debuginfo-1.11.1-9.1 libxcb1-1.11.1-9.1 libxcb1-debuginfo-1.11.1-9.1 - openSUSE Leap 42.3 (noarch): libxcb-devel-doc-1.11.1-9.1 - openSUSE Leap 42.3 (x86_64): libxcb-composite0-32bit-1.11.1-9.1 libxcb-composite0-debuginfo-32bit-1.11.1-9.1 libxcb-damage0-32bit-1.11.1-9.1 libxcb-damage0-debuginfo-32bit-1.11.1-9.1 libxcb-devel-32bit-1.11.1-9.1 libxcb-dpms0-32bit-1.11.1-9.1 libxcb-dpms0-debuginfo-32bit-1.11.1-9.1 libxcb-dri2-0-32bit-1.11.1-9.1 libxcb-dri2-0-debuginfo-32bit-1.11.1-9.1 libxcb-dri3-0-32bit-1.11.1-9.1 libxcb-dri3-0-debuginfo-32bit-1.11.1-9.1 libxcb-glx0-32bit-1.11.1-9.1 libxcb-glx0-debuginfo-32bit-1.11.1-9.1 libxcb-present0-32bit-1.11.1-9.1 libxcb-present0-debuginfo-32bit-1.11.1-9.1 libxcb-randr0-32bit-1.11.1-9.1 libxcb-randr0-debuginfo-32bit-1.11.1-9.1 libxcb-record0-32bit-1.11.1-9.1 libxcb-record0-debuginfo-32bit-1.11.1-9.1 libxcb-render0-32bit-1.11.1-9.1 libxcb-render0-debuginfo-32bit-1.11.1-9.1 libxcb-res0-32bit-1.11.1-9.1 libxcb-res0-debuginfo-32bit-1.11.1-9.1 libxcb-screensaver0-32bit-1.11.1-9.1 libxcb-screensaver0-debuginfo-32bit-1.11.1-9.1 libxcb-shape0-32bit-1.11.1-9.1 libxcb-shape0-debuginfo-32bit-1.11.1-9.1 libxcb-shm0-32bit-1.11.1-9.1 libxcb-shm0-debuginfo-32bit-1.11.1-9.1 libxcb-sync1-32bit-1.11.1-9.1 libxcb-sync1-debuginfo-32bit-1.11.1-9.1 libxcb-xevie0-32bit-1.11.1-9.1 libxcb-xevie0-debuginfo-32bit-1.11.1-9.1 libxcb-xf86dri0-32bit-1.11.1-9.1 libxcb-xf86dri0-debuginfo-32bit-1.11.1-9.1 libxcb-xfixes0-32bit-1.11.1-9.1 libxcb-xfixes0-debuginfo-32bit-1.11.1-9.1 libxcb-xinerama0-32bit-1.11.1-9.1 libxcb-xinerama0-debuginfo-32bit-1.11.1-9.1 libxcb-xkb1-32bit-1.11.1-9.1 libxcb-xkb1-debuginfo-32bit-1.11.1-9.1 libxcb-xprint0-32bit-1.11.1-9.1 libxcb-xprint0-debuginfo-32bit-1.11.1-9.1 libxcb-xtest0-32bit-1.11.1-9.1 libxcb-xtest0-debuginfo-32bit-1.11.1-9.1 libxcb-xv0-32bit-1.11.1-9.1 libxcb-xv0-debuginfo-32bit-1.11.1-9.1 libxcb-xvmc0-32bit-1.11.1-9.1 libxcb-xvmc0-debuginfo-32bit-1.11.1-9.1 libxcb1-32bit-1.11.1-9.1 libxcb1-debuginfo-32bit-1.11.1-9.1 - openSUSE Leap 42.2 (i586 x86_64): libxcb-composite0-1.11.1-3.7.1 libxcb-composite0-debuginfo-1.11.1-3.7.1 libxcb-damage0-1.11.1-3.7.1 libxcb-damage0-debuginfo-1.11.1-3.7.1 libxcb-debugsource-1.11.1-3.7.1 libxcb-devel-1.11.1-3.7.1 libxcb-dpms0-1.11.1-3.7.1 libxcb-dpms0-debuginfo-1.11.1-3.7.1 libxcb-dri2-0-1.11.1-3.7.1 libxcb-dri2-0-debuginfo-1.11.1-3.7.1 libxcb-dri3-0-1.11.1-3.7.1 libxcb-dri3-0-debuginfo-1.11.1-3.7.1 libxcb-glx0-1.11.1-3.7.1 libxcb-glx0-debuginfo-1.11.1-3.7.1 libxcb-present0-1.11.1-3.7.1 libxcb-present0-debuginfo-1.11.1-3.7.1 libxcb-randr0-1.11.1-3.7.1 libxcb-randr0-debuginfo-1.11.1-3.7.1 libxcb-record0-1.11.1-3.7.1 libxcb-record0-debuginfo-1.11.1-3.7.1 libxcb-render0-1.11.1-3.7.1 libxcb-render0-debuginfo-1.11.1-3.7.1 libxcb-res0-1.11.1-3.7.1 libxcb-res0-debuginfo-1.11.1-3.7.1 libxcb-screensaver0-1.11.1-3.7.1 libxcb-screensaver0-debuginfo-1.11.1-3.7.1 libxcb-shape0-1.11.1-3.7.1 libxcb-shape0-debuginfo-1.11.1-3.7.1 libxcb-shm0-1.11.1-3.7.1 libxcb-shm0-debuginfo-1.11.1-3.7.1 libxcb-sync1-1.11.1-3.7.1 libxcb-sync1-debuginfo-1.11.1-3.7.1 libxcb-xevie0-1.11.1-3.7.1 libxcb-xevie0-debuginfo-1.11.1-3.7.1 libxcb-xf86dri0-1.11.1-3.7.1 libxcb-xf86dri0-debuginfo-1.11.1-3.7.1 libxcb-xfixes0-1.11.1-3.7.1 libxcb-xfixes0-debuginfo-1.11.1-3.7.1 libxcb-xinerama0-1.11.1-3.7.1 libxcb-xinerama0-debuginfo-1.11.1-3.7.1 libxcb-xkb1-1.11.1-3.7.1 libxcb-xkb1-debuginfo-1.11.1-3.7.1 libxcb-xprint0-1.11.1-3.7.1 libxcb-xprint0-debuginfo-1.11.1-3.7.1 libxcb-xtest0-1.11.1-3.7.1 libxcb-xtest0-debuginfo-1.11.1-3.7.1 libxcb-xv0-1.11.1-3.7.1 libxcb-xv0-debuginfo-1.11.1-3.7.1 libxcb-xvmc0-1.11.1-3.7.1 libxcb-xvmc0-debuginfo-1.11.1-3.7.1 libxcb1-1.11.1-3.7.1 libxcb1-debuginfo-1.11.1-3.7.1 - openSUSE Leap 42.2 (x86_64): libxcb-composite0-32bit-1.11.1-3.7.1 libxcb-composite0-debuginfo-32bit-1.11.1-3.7.1 libxcb-damage0-32bit-1.11.1-3.7.1 libxcb-damage0-debuginfo-32bit-1.11.1-3.7.1 libxcb-devel-32bit-1.11.1-3.7.1 libxcb-dpms0-32bit-1.11.1-3.7.1 libxcb-dpms0-debuginfo-32bit-1.11.1-3.7.1 libxcb-dri2-0-32bit-1.11.1-3.7.1 libxcb-dri2-0-debuginfo-32bit-1.11.1-3.7.1 libxcb-dri3-0-32bit-1.11.1-3.7.1 libxcb-dri3-0-debuginfo-32bit-1.11.1-3.7.1 libxcb-glx0-32bit-1.11.1-3.7.1 libxcb-glx0-debuginfo-32bit-1.11.1-3.7.1 libxcb-present0-32bit-1.11.1-3.7.1 libxcb-present0-debuginfo-32bit-1.11.1-3.7.1 libxcb-randr0-32bit-1.11.1-3.7.1 libxcb-randr0-debuginfo-32bit-1.11.1-3.7.1 libxcb-record0-32bit-1.11.1-3.7.1 libxcb-record0-debuginfo-32bit-1.11.1-3.7.1 libxcb-render0-32bit-1.11.1-3.7.1 libxcb-render0-debuginfo-32bit-1.11.1-3.7.1 libxcb-res0-32bit-1.11.1-3.7.1 libxcb-res0-debuginfo-32bit-1.11.1-3.7.1 libxcb-screensaver0-32bit-1.11.1-3.7.1 libxcb-screensaver0-debuginfo-32bit-1.11.1-3.7.1 libxcb-shape0-32bit-1.11.1-3.7.1 libxcb-shape0-debuginfo-32bit-1.11.1-3.7.1 libxcb-shm0-32bit-1.11.1-3.7.1 libxcb-shm0-debuginfo-32bit-1.11.1-3.7.1 libxcb-sync1-32bit-1.11.1-3.7.1 libxcb-sync1-debuginfo-32bit-1.11.1-3.7.1 libxcb-xevie0-32bit-1.11.1-3.7.1 libxcb-xevie0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xf86dri0-32bit-1.11.1-3.7.1 libxcb-xf86dri0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xfixes0-32bit-1.11.1-3.7.1 libxcb-xfixes0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xinerama0-32bit-1.11.1-3.7.1 libxcb-xinerama0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xkb1-32bit-1.11.1-3.7.1 libxcb-xkb1-debuginfo-32bit-1.11.1-3.7.1 libxcb-xprint0-32bit-1.11.1-3.7.1 libxcb-xprint0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xtest0-32bit-1.11.1-3.7.1 libxcb-xtest0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xv0-32bit-1.11.1-3.7.1 libxcb-xv0-debuginfo-32bit-1.11.1-3.7.1 libxcb-xvmc0-32bit-1.11.1-3.7.1 libxcb-xvmc0-debuginfo-32bit-1.11.1-3.7.1 libxcb1-32bit-1.11.1-3.7.1 libxcb1-debuginfo-32bit-1.11.1-3.7.1 - openSUSE Leap 42.2 (noarch): libxcb-devel-doc-1.11.1-3.7.1 References: https://bugzilla.suse.com/1073996

1 0

openSUSE-SU-2018:0090-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0090-1 Rating: moderate References: #1074171 #1075737 #1075738 #1075739 #1075748 Cross-References: CVE-2017-17997 CVE-2018-5334 CVE-2018-5335 CVE-2018-5336 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for wireshark to version 2.2.12 fixes the following issues: - CVE-2018-5334: IxVeriWave file could crash (boo#1075737) - CVE-2018-5335: WCP dissector could crash (boo#1075738) - CVE-2018-5336: Multiple dissector crashes (boo#1075739) - CVE-2017-17997: MRDISC dissector could crash (boo#1074171) This release no longers enable the Linux kernel BPF JIT compiler via the net.core.bpf_jit_enable sysctl, as this would make systems more vulnerable to Spectre variant 1 CVE-2017-5753 - (boo#1075748) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.12.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-32=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-32=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.12-32.1 wireshark-debuginfo-2.2.12-32.1 wireshark-debugsource-2.2.12-32.1 wireshark-devel-2.2.12-32.1 wireshark-ui-gtk-2.2.12-32.1 wireshark-ui-gtk-debuginfo-2.2.12-32.1 wireshark-ui-qt-2.2.12-32.1 wireshark-ui-qt-debuginfo-2.2.12-32.1 - openSUSE Leap 42.2 (x86_64): wireshark-2.2.12-14.24.1 wireshark-debuginfo-2.2.12-14.24.1 wireshark-debugsource-2.2.12-14.24.1 wireshark-devel-2.2.12-14.24.1 wireshark-ui-gtk-2.2.12-14.24.1 wireshark-ui-gtk-debuginfo-2.2.12-14.24.1 wireshark-ui-qt-2.2.12-14.24.1 wireshark-ui-qt-debuginfo-2.2.12-14.24.1 References: https://www.suse.com/security/cve/CVE-2017-17997.html https://www.suse.com/security/cve/CVE-2018-5334.html https://www.suse.com/security/cve/CVE-2018-5335.html https://www.suse.com/security/cve/CVE-2018-5336.html https://bugzilla.suse.com/1074171 https://bugzilla.suse.com/1075737 https://bugzilla.suse.com/1075738 https://bugzilla.suse.com/1075739 https://bugzilla.suse.com/1075748

1 0

openSUSE-SU-2018:0089-1: important: Security update for glibc
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0089-1 Rating: important References: #1051042 #1053188 #1063675 #1064569 #1064580 #1064583 #1070905 #1071319 #1073231 #1074293 Cross-References: CVE-2017-1000408 CVE-2017-1000409 CVE-2017-15670 CVE-2017-15671 CVE-2017-15804 CVE-2017-16997 CVE-2018-1000001 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for glibc fixes the following issues: - A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293] - A memory leak and a buffer overflow in the dynamic ELF loader has been fixed. [CVE-2017-1000408, CVE-2017-1000409, bsc#1071319] - An issue in the code handling RPATHs was fixed that could have been exploited by an attacker to execute code loaded from arbitrary libraries. [CVE-2017-16997, bsc#1073231] - A potential crash caused by a use-after-free bug in pthread_create() has been fixed. [bsc#1053188] - A bug that prevented users to build shared objects which use the optimized libmvec.so API has been fixed. [bsc#1070905] - A memory leak in the glob() function has been fixed. [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804, bsc#1064569, bsc#1064580, bsc#1064583] - A bug that would lose the syscall error code value in case of crashes has been fixed. [bsc#1063675] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-30=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-30=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 i686 x86_64): glibc-2.22-10.1 glibc-debuginfo-2.22-10.1 glibc-debugsource-2.22-10.1 glibc-devel-2.22-10.1 glibc-devel-debuginfo-2.22-10.1 glibc-devel-static-2.22-10.1 glibc-locale-2.22-10.1 glibc-locale-debuginfo-2.22-10.1 glibc-profile-2.22-10.1 - openSUSE Leap 42.3 (i586 x86_64): glibc-extra-2.22-10.1 glibc-extra-debuginfo-2.22-10.1 glibc-utils-2.22-10.1 glibc-utils-debuginfo-2.22-10.1 glibc-utils-debugsource-2.22-10.1 nscd-2.22-10.1 nscd-debuginfo-2.22-10.1 - openSUSE Leap 42.3 (x86_64): glibc-32bit-2.22-10.1 glibc-debuginfo-32bit-2.22-10.1 glibc-devel-32bit-2.22-10.1 glibc-devel-debuginfo-32bit-2.22-10.1 glibc-devel-static-32bit-2.22-10.1 glibc-locale-32bit-2.22-10.1 glibc-locale-debuginfo-32bit-2.22-10.1 glibc-profile-32bit-2.22-10.1 glibc-utils-32bit-2.22-10.1 glibc-utils-debuginfo-32bit-2.22-10.1 - openSUSE Leap 42.3 (noarch): glibc-html-2.22-10.1 glibc-i18ndata-2.22-10.1 glibc-info-2.22-10.1 - openSUSE Leap 42.3 (i586): glibc-obsolete-2.22-10.1 glibc-obsolete-debuginfo-2.22-10.1 - openSUSE Leap 42.2 (i586 x86_64): glibc-2.22-4.12.1 glibc-debuginfo-2.22-4.12.1 glibc-debugsource-2.22-4.12.1 glibc-devel-2.22-4.12.1 glibc-devel-debuginfo-2.22-4.12.1 glibc-devel-static-2.22-4.12.1 glibc-extra-2.22-4.12.1 glibc-extra-debuginfo-2.22-4.12.1 glibc-locale-2.22-4.12.1 glibc-locale-debuginfo-2.22-4.12.1 glibc-profile-2.22-4.12.1 glibc-utils-2.22-4.12.1 glibc-utils-debuginfo-2.22-4.12.1 glibc-utils-debugsource-2.22-4.12.1 nscd-2.22-4.12.1 nscd-debuginfo-2.22-4.12.1 - openSUSE Leap 42.2 (noarch): glibc-html-2.22-4.12.1 glibc-i18ndata-2.22-4.12.1 glibc-info-2.22-4.12.1 - openSUSE Leap 42.2 (x86_64): glibc-utils-32bit-2.22-4.12.1 glibc-utils-debuginfo-32bit-2.22-4.12.1 - openSUSE Leap 42.2 (i586): glibc-obsolete-2.22-4.12.1 glibc-obsolete-debuginfo-2.22-4.12.1 References: https://www.suse.com/security/cve/CVE-2017-1000408.html https://www.suse.com/security/cve/CVE-2017-1000409.html https://www.suse.com/security/cve/CVE-2017-15670.html https://www.suse.com/security/cve/CVE-2017-15671.html https://www.suse.com/security/cve/CVE-2017-15804.html https://www.suse.com/security/cve/CVE-2017-16997.html https://www.suse.com/security/cve/CVE-2018-1000001.html https://bugzilla.suse.com/1051042 https://bugzilla.suse.com/1053188 https://bugzilla.suse.com/1063675 https://bugzilla.suse.com/1064569 https://bugzilla.suse.com/1064580 https://bugzilla.suse.com/1064583 https://bugzilla.suse.com/1070905 https://bugzilla.suse.com/1071319 https://bugzilla.suse.com/1073231 https://bugzilla.suse.com/1074293

1 0

openSUSE-SU-2018:0088-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0088-1 Rating: moderate References: #1039034 #1049399 #1049404 #1049417 #1054591 #1072665 Cross-References: CVE-2017-3636 CVE-2017-3641 CVE-2017-3653 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for mariadb fixes several issues. These security issues were fixed: - CVE-2017-3636: Client programs had an unspecified vulnerability that could lead to unauthorized access and denial of service (bsc#1049399) - CVE-2017-3641: DDL unspecified vulnerability could lead to denial of service (bsc#1049404) - CVE-2017-3653: DML Unspecified vulnerability could lead to unauthorized database access (bsc#1049417) These non-security issues were fixed: - Add ODBC support for Connect engine (bsc#1039034) - Relax required version for mariadb-errormessages (bsc#1072665) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-33=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-33=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysqlclient-devel-10.0.32-26.1 libmysqlclient18-10.0.32-26.1 libmysqlclient18-debuginfo-10.0.32-26.1 libmysqlclient_r18-10.0.32-26.1 libmysqld-devel-10.0.32-26.1 libmysqld18-10.0.32-26.1 libmysqld18-debuginfo-10.0.32-26.1 mariadb-10.0.32-26.1 mariadb-bench-10.0.32-26.1 mariadb-bench-debuginfo-10.0.32-26.1 mariadb-client-10.0.32-26.1 mariadb-client-debuginfo-10.0.32-26.1 mariadb-debuginfo-10.0.32-26.1 mariadb-debugsource-10.0.32-26.1 mariadb-errormessages-10.0.32-26.1 mariadb-test-10.0.32-26.1 mariadb-test-debuginfo-10.0.32-26.1 mariadb-tools-10.0.32-26.1 mariadb-tools-debuginfo-10.0.32-26.1 - openSUSE Leap 42.3 (x86_64): libmysqlclient18-32bit-10.0.32-26.1 libmysqlclient18-debuginfo-32bit-10.0.32-26.1 libmysqlclient_r18-32bit-10.0.32-26.1 - openSUSE Leap 42.2 (i586 x86_64): libmysqlclient-devel-10.0.32-20.10.1 libmysqlclient18-10.0.32-20.10.1 libmysqlclient18-debuginfo-10.0.32-20.10.1 libmysqlclient_r18-10.0.32-20.10.1 libmysqld-devel-10.0.32-20.10.1 libmysqld18-10.0.32-20.10.1 libmysqld18-debuginfo-10.0.32-20.10.1 mariadb-10.0.32-20.10.1 mariadb-bench-10.0.32-20.10.1 mariadb-bench-debuginfo-10.0.32-20.10.1 mariadb-client-10.0.32-20.10.1 mariadb-client-debuginfo-10.0.32-20.10.1 mariadb-debuginfo-10.0.32-20.10.1 mariadb-debugsource-10.0.32-20.10.1 mariadb-errormessages-10.0.32-20.10.1 mariadb-test-10.0.32-20.10.1 mariadb-test-debuginfo-10.0.32-20.10.1 mariadb-tools-10.0.32-20.10.1 mariadb-tools-debuginfo-10.0.32-20.10.1 - openSUSE Leap 42.2 (x86_64): libmysqlclient18-32bit-10.0.32-20.10.1 libmysqlclient18-debuginfo-32bit-10.0.32-20.10.1 libmysqlclient_r18-32bit-10.0.32-20.10.1 References: https://www.suse.com/security/cve/CVE-2017-3636.html https://www.suse.com/security/cve/CVE-2017-3641.html https://www.suse.com/security/cve/CVE-2017-3653.html https://bugzilla.suse.com/1039034 https://bugzilla.suse.com/1049399 https://bugzilla.suse.com/1049404 https://bugzilla.suse.com/1049417 https://bugzilla.suse.com/1054591 https://bugzilla.suse.com/1072665

1 0

openSUSE-SU-2018:0087-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 15 Jan '18

15 Jan '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0087-1 Rating: moderate References: #1047044 #1049373 #1050129 #1051412 #1052468 #1052710 #1052720 #1052731 #1055065 #1055434 #1058640 #1067177 #1074123 #1074975 Cross-References: CVE-2017-10800 CVE-2017-11449 CVE-2017-11532 CVE-2017-12564 CVE-2017-12670 CVE-2017-12672 CVE-2017-12675 CVE-2017-13060 CVE-2017-13648 CVE-2017-14326 CVE-2017-16547 CVE-2017-17881 CVE-2017-18022 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2017-12672: Memory leak vulnerability allowed DoS via MAT image files (bsc#1052720) - CVE-2017-13060: Memory leak vulnerability allowed DoS via MAT image files (bsc#1055065) - CVE-2017-12670: Specially crafted MAT images may lead to an assertion failure and DoS (bsc#1052731) - CVE-2017-10800: Specially crafted MAT images may lead to memory denial of service (bsc#1047044) - CVE-2017-13648: Memory leak vulnerability allowed DoS via MAT image files (bsc#1055434) - CVE-2017-12564: Memory leak vulnerability allowed DoS via MAT image files (bsc#1052468) - CVE-2017-12675: Memory leak vulnerability allowed DoS via MAT image files (bsc#1052710) - CVE-2017-14326: Memory leak vulnerability allowed DoS via MAT image files (bsc#1058640) - CVE-2017-17881: Memory leak vulnerability allowed DoS via MAT image files (bsc#1074123) - CVE-2017-11449: coders/mpc.c in ImageMagick before 7.0.6-1 remote denial of service (boo#1049373) - CVE-2017-11532: Memory Leak in WriteMPCImage() in coders/mpc.c (boo#1050129) - CVE-2017-16547: Incorrect memory management in DrawImage function in magick/render.c could lead to denial of service (boo#1067177) - CVE-2017-18022: Fixed memory leak vulnerability in MontageImageCommand in MagickWand/montage.c (bsc#1074975) - Memory leak in pwp.c (boo#1051412) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-35=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-35=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-57.1 GraphicsMagick-debuginfo-1.3.25-57.1 GraphicsMagick-debugsource-1.3.25-57.1 GraphicsMagick-devel-1.3.25-57.1 libGraphicsMagick++-Q16-12-1.3.25-57.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-57.1 libGraphicsMagick++-devel-1.3.25-57.1 libGraphicsMagick-Q16-3-1.3.25-57.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-57.1 libGraphicsMagick3-config-1.3.25-57.1 libGraphicsMagickWand-Q16-2-1.3.25-57.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-57.1 perl-GraphicsMagick-1.3.25-57.1 perl-GraphicsMagick-debuginfo-1.3.25-57.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.60.1 GraphicsMagick-debuginfo-1.3.25-11.60.1 GraphicsMagick-debugsource-1.3.25-11.60.1 GraphicsMagick-devel-1.3.25-11.60.1 libGraphicsMagick++-Q16-12-1.3.25-11.60.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.60.1 libGraphicsMagick++-devel-1.3.25-11.60.1 libGraphicsMagick-Q16-3-1.3.25-11.60.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.60.1 libGraphicsMagick3-config-1.3.25-11.60.1 libGraphicsMagickWand-Q16-2-1.3.25-11.60.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.60.1 perl-GraphicsMagick-1.3.25-11.60.1 perl-GraphicsMagick-debuginfo-1.3.25-11.60.1 References: https://www.suse.com/security/cve/CVE-2017-10800.html https://www.suse.com/security/cve/CVE-2017-11449.html https://www.suse.com/security/cve/CVE-2017-11532.html https://www.suse.com/security/cve/CVE-2017-12564.html https://www.suse.com/security/cve/CVE-2017-12670.html https://www.suse.com/security/cve/CVE-2017-12672.html https://www.suse.com/security/cve/CVE-2017-12675.html https://www.suse.com/security/cve/CVE-2017-13060.html https://www.suse.com/security/cve/CVE-2017-13648.html https://www.suse.com/security/cve/CVE-2017-14326.html https://www.suse.com/security/cve/CVE-2017-16547.html https://www.suse.com/security/cve/CVE-2017-17881.html https://www.suse.com/security/cve/CVE-2017-18022.html https://bugzilla.suse.com/1047044 https://bugzilla.suse.com/1049373 https://bugzilla.suse.com/1050129 https://bugzilla.suse.com/1051412 https://bugzilla.suse.com/1052468 https://bugzilla.suse.com/1052710 https://bugzilla.suse.com/1052720 https://bugzilla.suse.com/1052731 https://bugzilla.suse.com/1055065 https://bugzilla.suse.com/1055434 https://bugzilla.suse.com/1058640 https://bugzilla.suse.com/1067177 https://bugzilla.suse.com/1074123 https://bugzilla.suse.com/1074975

1 0

openSUSE-RU-2018:0086-1: Recommended update for kmod
by maintenance＠opensuse.org 14 Jan '18

14 Jan '18

openSUSE Recommended Update: Recommended update for kmod ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0086-1 Rating: low References: #1070209 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmod provides the following fix: - Fix resolving .TOC. in modules on 4.4 and older kernel (bsc#1070209) - Fix kernel master build for ppc64le (bsc#1070209) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-28=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-28=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): kmod-17-13.1 kmod-compat-17-13.1 kmod-debuginfo-17-13.1 kmod-debugsource-17-13.1 libkmod-devel-17-13.1 libkmod2-17-13.1 libkmod2-debuginfo-17-13.1 - openSUSE Leap 42.2 (i586 x86_64): kmod-17-10.3.1 kmod-compat-17-10.3.1 kmod-debuginfo-17-10.3.1 kmod-debugsource-17-10.3.1 libkmod-devel-17-10.3.1 libkmod2-17-10.3.1 libkmod2-debuginfo-17-10.3.1 References: https://bugzilla.suse.com/1070209

1 0

openSUSE-RU-2018:0085-1: moderate: Recommended update for ceph
by maintenance＠opensuse.org 14 Jan '18

14 Jan '18

openSUSE Recommended Update: Recommended update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0085-1 Rating: moderate References: #1053836 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ceph to version 12.2.0 provides the following fixes: - Fix a performance problem by writing only the dup entries that changed. (bsc#1053836) This update is source identical to SUSE:SLE-12-SP3:Update/ceph and future updates will follow this package. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-27=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.0+git.1504118058.706f78da1a-6.1 ceph-base-12.2.0+git.1504118058.706f78da1a-6.1 ceph-base-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-common-12.2.0+git.1504118058.706f78da1a-6.1 ceph-common-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-debugsource-12.2.0+git.1504118058.706f78da1a-6.1 ceph-fuse-12.2.0+git.1504118058.706f78da1a-6.1 ceph-fuse-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-mds-12.2.0+git.1504118058.706f78da1a-6.1 ceph-mds-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-mgr-12.2.0+git.1504118058.706f78da1a-6.1 ceph-mgr-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-mon-12.2.0+git.1504118058.706f78da1a-6.1 ceph-mon-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-osd-12.2.0+git.1504118058.706f78da1a-6.1 ceph-osd-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-radosgw-12.2.0+git.1504118058.706f78da1a-6.1 ceph-radosgw-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-resource-agents-12.2.0+git.1504118058.706f78da1a-6.1 ceph-test-12.2.0+git.1504118058.706f78da1a-6.1 ceph-test-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 ceph-test-debugsource-12.2.0+git.1504118058.706f78da1a-6.1 libcephfs-devel-12.2.0+git.1504118058.706f78da1a-6.1 libcephfs2-12.2.0+git.1504118058.706f78da1a-6.1 libcephfs2-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 librados-devel-12.2.0+git.1504118058.706f78da1a-6.1 librados-devel-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 librados2-12.2.0+git.1504118058.706f78da1a-6.1 librados2-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 libradosstriper-devel-12.2.0+git.1504118058.706f78da1a-6.1 libradosstriper1-12.2.0+git.1504118058.706f78da1a-6.1 libradosstriper1-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 librbd-devel-12.2.0+git.1504118058.706f78da1a-6.1 librbd1-12.2.0+git.1504118058.706f78da1a-6.1 librbd1-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 librgw-devel-12.2.0+git.1504118058.706f78da1a-6.1 librgw2-12.2.0+git.1504118058.706f78da1a-6.1 librgw2-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python-ceph-compat-12.2.0+git.1504118058.706f78da1a-6.1 python-cephfs-12.2.0+git.1504118058.706f78da1a-6.1 python-cephfs-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python-rados-12.2.0+git.1504118058.706f78da1a-6.1 python-rados-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python-rbd-12.2.0+git.1504118058.706f78da1a-6.1 python-rbd-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python-rgw-12.2.0+git.1504118058.706f78da1a-6.1 python-rgw-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python3-ceph-argparse-12.2.0+git.1504118058.706f78da1a-6.1 python3-cephfs-12.2.0+git.1504118058.706f78da1a-6.1 python3-cephfs-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python3-rados-12.2.0+git.1504118058.706f78da1a-6.1 python3-rados-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python3-rbd-12.2.0+git.1504118058.706f78da1a-6.1 python3-rbd-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 python3-rgw-12.2.0+git.1504118058.706f78da1a-6.1 python3-rgw-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 rados-objclass-devel-12.2.0+git.1504118058.706f78da1a-6.1 rbd-fuse-12.2.0+git.1504118058.706f78da1a-6.1 rbd-fuse-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 rbd-mirror-12.2.0+git.1504118058.706f78da1a-6.1 rbd-mirror-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 rbd-nbd-12.2.0+git.1504118058.706f78da1a-6.1 rbd-nbd-debuginfo-12.2.0+git.1504118058.706f78da1a-6.1 References: https://bugzilla.suse.com/1053836

1 0

openSUSE-RU-2018:0084-1: moderate: Recommended update for stunnel
by maintenance＠opensuse.org 14 Jan '18

14 Jan '18

openSUSE Recommended Update: Recommended update for stunnel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0084-1 Rating: moderate References: #1007272 #990797 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for stunnel fixes the following issue: - The stunnel service may not have worked after boot because it did not declare a dependency on network-online.target (boo#1007272, bsc#990797) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-29=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-29=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): stunnel-5.00-6.1 stunnel-debuginfo-5.00-6.1 stunnel-debugsource-5.00-6.1 - openSUSE Leap 42.2 (i586 x86_64): stunnel-5.00-3.3.1 stunnel-debuginfo-5.00-3.3.1 stunnel-debugsource-5.00-3.3.1 References: https://bugzilla.suse.com/1007272 https://bugzilla.suse.com/990797

1 0

openSUSE-OU-2018:0082-1: moderate: Optional update to add monit to the SUSE PackageHub
by maintenance＠opensuse.org 12 Jan '18

12 Jan '18

openSUSE Optional Update: Optional update to add monit to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0082-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds monit to the SUSE PackageHub. Monit is a Service Manager and Monitor system. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-26=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): monit-5.25.1-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): monit-doc-5.25.1-2.1 References:

1 0

openSUSE-RU-2018:0070-1: moderate: Recommended update for gcc48
by maintenance＠opensuse.org 12 Jan '18

12 Jan '18

openSUSE Recommended Update: Recommended update for gcc48 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0070-1 Rating: moderate References: #1059075 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gcc48 fixes the following issues with an earlier security fix: - Add support for zero-sized VLAs and allocas with -fstack-clash-protection. (bnc#1059075) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-25=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-25=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp48-4.8.5-29.1 cpp48-debuginfo-4.8.5-29.1 gcc48-4.8.5-29.1 gcc48-ada-4.8.5-29.1 gcc48-ada-debuginfo-4.8.5-29.1 gcc48-c++-4.8.5-29.1 gcc48-c++-debuginfo-4.8.5-29.1 gcc48-debuginfo-4.8.5-29.1 gcc48-debugsource-4.8.5-29.1 gcc48-fortran-4.8.5-29.1 gcc48-fortran-debuginfo-4.8.5-29.1 gcc48-gij-4.8.5-29.1 gcc48-gij-debuginfo-4.8.5-29.1 gcc48-java-4.8.5-29.1 gcc48-java-debuginfo-4.8.5-29.1 gcc48-locale-4.8.5-29.1 gcc48-obj-c++-4.8.5-29.1 gcc48-obj-c++-debuginfo-4.8.5-29.1 gcc48-objc-4.8.5-29.1 gcc48-objc-debuginfo-4.8.5-29.1 gcc48-testresults-4.8.5-29.2 libada48-4.8.5-29.1 libada48-debuginfo-4.8.5-29.1 libasan0-4.8.5-29.1 libasan0-debuginfo-4.8.5-29.1 libffi4-gcc48-4.8.5-29.1 libffi4-gcc48-debuginfo-4.8.5-29.1 libffi48-debugsource-4.8.5-29.1 libffi48-devel-4.8.5-29.1 libgcj48-4.8.5-29.1 libgcj48-debuginfo-4.8.5-29.1 libgcj48-debugsource-4.8.5-29.1 libgcj48-devel-4.8.5-29.1 libgcj48-devel-debuginfo-4.8.5-29.1 libgcj48-jar-4.8.5-29.1 libgcj_bc1-4.8.5-29.1 libobjc4-4.8.5-29.1 libobjc4-debuginfo-4.8.5-29.1 libstdc++48-devel-4.8.5-29.1 - openSUSE Leap 42.3 (noarch): gcc48-info-4.8.5-29.1 libstdc++48-doc-4.8.5-29.1 - openSUSE Leap 42.3 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.5-29.2 cross-armv6hl-gcc48-icecream-backend-4.8.5-29.2 cross-armv7hl-gcc48-icecream-backend-4.8.5-29.2 cross-i386-gcc48-icecream-backend-4.8.5-29.2 cross-ia64-gcc48-icecream-backend-4.8.5-29.2 cross-ppc-gcc48-icecream-backend-4.8.5-29.2 cross-ppc64-gcc48-icecream-backend-4.8.5-29.2 cross-ppc64le-gcc48-icecream-backend-4.8.5-29.2 cross-s390-gcc48-icecream-backend-4.8.5-29.2 cross-s390x-gcc48-icecream-backend-4.8.5-29.2 gcc48-32bit-4.8.5-29.1 gcc48-ada-32bit-4.8.5-29.1 gcc48-fortran-32bit-4.8.5-29.1 gcc48-gij-32bit-4.8.5-29.1 gcc48-gij-debuginfo-32bit-4.8.5-29.1 gcc48-objc-32bit-4.8.5-29.1 libada48-32bit-4.8.5-29.1 libada48-32bit-debuginfo-4.8.5-29.1 libasan0-32bit-4.8.5-29.1 libasan0-32bit-debuginfo-4.8.5-29.1 libffi4-gcc48-32bit-4.8.5-29.1 libffi4-gcc48-32bit-debuginfo-4.8.5-29.1 libffi48-devel-32bit-4.8.5-29.1 libgcj48-32bit-4.8.5-29.1 libgcj48-debuginfo-32bit-4.8.5-29.1 libgcj48-devel-32bit-4.8.5-29.1 libgcj48-devel-debuginfo-32bit-4.8.5-29.1 libobjc4-32bit-4.8.5-29.1 libobjc4-32bit-debuginfo-4.8.5-29.1 libstdc++48-devel-32bit-4.8.5-29.1 - openSUSE Leap 42.2 (i586 x86_64): cpp48-4.8.5-23.6.1 cpp48-debuginfo-4.8.5-23.6.1 gcc48-4.8.5-23.6.1 gcc48-ada-4.8.5-23.6.1 gcc48-ada-debuginfo-4.8.5-23.6.1 gcc48-c++-4.8.5-23.6.1 gcc48-c++-debuginfo-4.8.5-23.6.1 gcc48-debuginfo-4.8.5-23.6.1 gcc48-debugsource-4.8.5-23.6.1 gcc48-fortran-4.8.5-23.6.1 gcc48-fortran-debuginfo-4.8.5-23.6.1 gcc48-gij-4.8.5-23.6.1 gcc48-gij-debuginfo-4.8.5-23.6.1 gcc48-java-4.8.5-23.6.1 gcc48-java-debuginfo-4.8.5-23.6.1 gcc48-locale-4.8.5-23.6.1 gcc48-obj-c++-4.8.5-23.6.1 gcc48-obj-c++-debuginfo-4.8.5-23.6.1 gcc48-objc-4.8.5-23.6.1 gcc48-objc-debuginfo-4.8.5-23.6.1 gcc48-testresults-4.8.5-23.6.2 libada48-4.8.5-23.6.1 libada48-debuginfo-4.8.5-23.6.1 libasan0-4.8.5-23.6.1 libasan0-debuginfo-4.8.5-23.6.1 libffi4-gcc48-4.8.5-23.6.1 libffi4-gcc48-debuginfo-4.8.5-23.6.1 libffi48-debugsource-4.8.5-23.6.1 libffi48-devel-4.8.5-23.6.1 libgcj48-4.8.5-23.6.1 libgcj48-debuginfo-4.8.5-23.6.1 libgcj48-debugsource-4.8.5-23.6.1 libgcj48-devel-4.8.5-23.6.1 libgcj48-devel-debuginfo-4.8.5-23.6.1 libgcj48-jar-4.8.5-23.6.1 libgcj_bc1-gcc48-4.8.5-23.6.1 libobjc4-4.8.5-23.6.1 libobjc4-debuginfo-4.8.5-23.6.1 libstdc++48-devel-4.8.5-23.6.1 - openSUSE Leap 42.2 (noarch): gcc48-info-4.8.5-23.6.1 libstdc++48-doc-4.8.5-23.6.1 - openSUSE Leap 42.2 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.5-23.6.2 cross-armv6hl-gcc48-icecream-backend-4.8.5-23.6.2 cross-armv7hl-gcc48-icecream-backend-4.8.5-23.6.2 cross-i386-gcc48-icecream-backend-4.8.5-23.6.2 cross-ia64-gcc48-icecream-backend-4.8.5-23.6.2 cross-ppc-gcc48-icecream-backend-4.8.5-23.6.2 cross-ppc64-gcc48-icecream-backend-4.8.5-23.6.2 cross-ppc64le-gcc48-icecream-backend-4.8.5-23.6.2 cross-s390-gcc48-icecream-backend-4.8.5-23.6.2 cross-s390x-gcc48-icecream-backend-4.8.5-23.6.2 gcc48-32bit-4.8.5-23.6.1 gcc48-ada-32bit-4.8.5-23.6.1 gcc48-fortran-32bit-4.8.5-23.6.1 gcc48-gij-32bit-4.8.5-23.6.1 gcc48-gij-debuginfo-32bit-4.8.5-23.6.1 gcc48-objc-32bit-4.8.5-23.6.1 libada48-32bit-4.8.5-23.6.1 libada48-32bit-debuginfo-4.8.5-23.6.1 libasan0-32bit-4.8.5-23.6.1 libasan0-32bit-debuginfo-4.8.5-23.6.1 libffi4-gcc48-32bit-4.8.5-23.6.1 libffi4-gcc48-32bit-debuginfo-4.8.5-23.6.1 libffi48-devel-32bit-4.8.5-23.6.1 libgcj48-32bit-4.8.5-23.6.1 libgcj48-debuginfo-32bit-4.8.5-23.6.1 libgcj48-devel-32bit-4.8.5-23.6.1 libgcj48-devel-debuginfo-32bit-4.8.5-23.6.1 libobjc4-32bit-4.8.5-23.6.1 libobjc4-32bit-debuginfo-4.8.5-23.6.1 libstdc++48-devel-32bit-4.8.5-23.6.1 References: https://bugzilla.suse.com/1059075

1 0