January 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:0327-1: moderate: Recommended update for multipath-tools, rdma-core
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for multipath-tools, rdma-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0327-1 Rating: moderate References: #1033541 #1037533 #1038865 #1043027 #1045111 #1046092 #1047180 #1049515 #1053515 #1058504 #1058539 #1060413 #1063639 #1063642 #1063697 #1063698 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: This update for multipath-tools and rdma-core provides fixes and enhancements. multipath-tools: - Adjust kpartx.rules so that the link priority is not increased when DM_UDEV_LOW_PRIORITY_FLAG is set. (bsc#1047180) - Fix timeout caused by a deadlock when processing "add map" commands. (bsc#1053515) - Fix queue_if_no_path logic, avoiding warnings when conflicting configuration options are found. (bsc#1043027) - Ensure that option "no_path_retry" always takes precedence over "features queue_if_no_path", and fix respective log messages and documentation. (bsc#1043027) - Backport many fixes and enhancements for kpartx. (bsc#1037533, bsc#1033541) - Ensure strings printed are always null terminated. (bsc#1038865) - Fix syntax error in kpartx.rules. (bsc#1046092) - Default to running kpartx in sync mode, waiting until requested operation is finished. rdma-core: - Fix a byte order issue which causes ibacm to fail to join a multicast group on recent on recent kernels. (bsc#1063639, bsc#1063697) - Fix a segmentation fault of ibacm when a provider other than default is set. (bsc#1063642, bsc#1063698) - Add support for new Broadcom devices. (bsc#1060413) - Remove runtime dependency on dracut. (bsc#1058504) - Fix issue with umad when QSFP is not plugged in. (bsc#1058539) - Fix a problem with SRP daemon not handling subnet manager changes properly. (bsc#1049515) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-120=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ibacm-14-8.1 ibacm-debuginfo-14-8.1 iwpmd-14-8.1 iwpmd-debuginfo-14-8.1 kpartx-0.7.1+71+suse.632dbce970c0-6.1 kpartx-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 libdmmp-devel-0.7.1+71+suse.632dbce970c0-6.1 libdmmp0_1_0-0.7.1+71+suse.632dbce970c0-6.1 libdmmp0_1_0-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 libibcm1-14-8.1 libibcm1-debuginfo-14-8.1 libibumad3-14-8.1 libibumad3-debuginfo-14-8.1 libibverbs-14-8.1 libibverbs-debuginfo-14-8.1 libibverbs-utils-14-8.1 libibverbs-utils-debuginfo-14-8.1 libibverbs1-14-8.1 libibverbs1-debuginfo-14-8.1 libmlx5-1-14-8.1 libmlx5-1-debuginfo-14-8.1 librdmacm-utils-14-8.1 librdmacm-utils-debuginfo-14-8.1 librdmacm1-14-8.1 librdmacm1-debuginfo-14-8.1 multipath-tools-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-debugsource-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-devel-0.7.1+71+suse.632dbce970c0-6.1 rdma-core-14-8.1 rdma-core-debugsource-14-8.1 rdma-core-devel-14-8.1 rdma-ndd-14-8.1 rdma-ndd-debuginfo-14-8.1 rsocket-14-8.1 rsocket-debuginfo-14-8.1 srp_daemon-14-8.1 srp_daemon-debuginfo-14-8.1 - openSUSE Leap 42.3 (x86_64): libibcm1-32bit-14-8.1 libibcm1-debuginfo-32bit-14-8.1 libibumad3-32bit-14-8.1 libibumad3-debuginfo-32bit-14-8.1 libibverbs-32bit-14-8.1 libibverbs-debuginfo-32bit-14-8.1 libibverbs1-32bit-14-8.1 libibverbs1-debuginfo-32bit-14-8.1 libmlx5-1-32bit-14-8.1 libmlx5-1-debuginfo-32bit-14-8.1 librdmacm1-32bit-14-8.1 librdmacm1-debuginfo-32bit-14-8.1 rdma-core-devel-32bit-14-8.1 rsocket-32bit-14-8.1 rsocket-debuginfo-32bit-14-8.1 References: https://bugzilla.suse.com/1033541 https://bugzilla.suse.com/1037533 https://bugzilla.suse.com/1038865 https://bugzilla.suse.com/1043027 https://bugzilla.suse.com/1045111 https://bugzilla.suse.com/1046092 https://bugzilla.suse.com/1047180 https://bugzilla.suse.com/1049515 https://bugzilla.suse.com/1053515 https://bugzilla.suse.com/1058504 https://bugzilla.suse.com/1058539 https://bugzilla.suse.com/1060413 https://bugzilla.suse.com/1063639 https://bugzilla.suse.com/1063642 https://bugzilla.suse.com/1063697 https://bugzilla.suse.com/1063698

1 0

openSUSE-SU-2018:0326-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0326-1 Rating: important References: #1020950 #1024749 #1050469 #1066892 #1069925 #1073654 #1075419 Cross-References: CVE-2016-4692 CVE-2016-4743 CVE-2016-7586 CVE-2016-7587 CVE-2016-7589 CVE-2016-7592 CVE-2016-7598 CVE-2016-7599 CVE-2016-7610 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 CVE-2017-13788 CVE-2017-13798 CVE-2017-13803 CVE-2017-13856 CVE-2017-13866 CVE-2017-13870 CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 CVE-2017-2496 CVE-2017-2510 CVE-2017-2539 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-7006 CVE-2017-7011 CVE-2017-7012 CVE-2017-7018 CVE-2017-7019 CVE-2017-7020 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7038 CVE-2017-7039 CVE-2017-7040 CVE-2017-7041 CVE-2017-7042 CVE-2017-7043 CVE-2017-7046 CVE-2017-7048 CVE-2017-7049 CVE-2017-7052 CVE-2017-7055 CVE-2017-7056 CVE-2017-7059 CVE-2017-7061 CVE-2017-7064 CVE-2017-7081 CVE-2017-7087 CVE-2017-7089 CVE-2017-7090 CVE-2017-7091 CVE-2017-7092 CVE-2017-7093 CVE-2017-7094 CVE-2017-7095 CVE-2017-7096 CVE-2017-7098 CVE-2017-7099 CVE-2017-7100 CVE-2017-7102 CVE-2017-7104 CVE-2017-7107 CVE-2017-7109 CVE-2017-7111 CVE-2017-7117 CVE-2017-7120 CVE-2017-7142 CVE-2017-7156 CVE-2017-7157 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 89 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5: + Disable SharedArrayBuffers from Web API. + Reduce the precision of "high" resolution time to 1ms. + bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4: + Make WebDriver implementation more spec compliant. + Fix a bug when trying to remove cookies before a web process is spawned. + WebKitWebDriver process no longer links to libjavascriptcoregtk. + Fix several memory leaks in GStreamer media backend. + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3: + Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. + Fix handling of null capabilities in WebDriver implementation. + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2: + Fix rendering of arabic text. + Fix a crash in the web process when decoding GIF images. + Fix rendering of wind in Windy.com. + Fix several crashes and rendering issues. Update to version 2.18.1: + Improve performance of GIF animations. + Fix garbled display in GMail. + Fix rendering of several material design icons when using the web font. + Fix flickering when resizing the window in Wayland. + Prevent default kerberos authentication credentials from being used in ephemeral sessions. + Fix a crash when webkit_web_resource_get_data() is cancelled. + Correctly handle touchmove and touchend events in WebKitWebView. + Fix the build with enchant 2.1.1. + Fix the build in HPPA and Alpha. + Fix several crashes and rendering issues. + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142. - Enable gold linker on s390/s390x on SLE15/Tumbleweed. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-8.1 libwebkit2gtk-4_0-37-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-2.18.5-8.1 typelib-1_0-JavaScriptCore-4_0-2.18.5-8.1 typelib-1_0-WebKit2-4_0-2.18.5-8.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.5-8.1 webkit-jsc-4-2.18.5-8.1 webkit-jsc-4-debuginfo-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-8.1 webkit2gtk3-debugsource-2.18.5-8.1 webkit2gtk3-devel-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.5-8.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.5-8.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.18.5-8.1 References: https://www.suse.com/security/cve/CVE-2016-4692.html https://www.suse.com/security/cve/CVE-2016-4743.html https://www.suse.com/security/cve/CVE-2016-7586.html https://www.suse.com/security/cve/CVE-2016-7587.html https://www.suse.com/security/cve/CVE-2016-7589.html https://www.suse.com/security/cve/CVE-2016-7592.html https://www.suse.com/security/cve/CVE-2016-7598.html https://www.suse.com/security/cve/CVE-2016-7599.html https://www.suse.com/security/cve/CVE-2016-7610.html https://www.suse.com/security/cve/CVE-2016-7623.html https://www.suse.com/security/cve/CVE-2016-7632.html https://www.suse.com/security/cve/CVE-2016-7635.html https://www.suse.com/security/cve/CVE-2016-7639.html https://www.suse.com/security/cve/CVE-2016-7641.html https://www.suse.com/security/cve/CVE-2016-7645.html https://www.suse.com/security/cve/CVE-2016-7652.html https://www.suse.com/security/cve/CVE-2016-7654.html https://www.suse.com/security/cve/CVE-2016-7656.html https://www.suse.com/security/cve/CVE-2017-13788.html https://www.suse.com/security/cve/CVE-2017-13798.html https://www.suse.com/security/cve/CVE-2017-13803.html https://www.suse.com/security/cve/CVE-2017-13856.html https://www.suse.com/security/cve/CVE-2017-13866.html https://www.suse.com/security/cve/CVE-2017-13870.html https://www.suse.com/security/cve/CVE-2017-2350.html https://www.suse.com/security/cve/CVE-2017-2354.html https://www.suse.com/security/cve/CVE-2017-2355.html https://www.suse.com/security/cve/CVE-2017-2356.html https://www.suse.com/security/cve/CVE-2017-2362.html https://www.suse.com/security/cve/CVE-2017-2363.html https://www.suse.com/security/cve/CVE-2017-2364.html https://www.suse.com/security/cve/CVE-2017-2365.html https://www.suse.com/security/cve/CVE-2017-2366.html https://www.suse.com/security/cve/CVE-2017-2369.html https://www.suse.com/security/cve/CVE-2017-2371.html https://www.suse.com/security/cve/CVE-2017-2373.html https://www.suse.com/security/cve/CVE-2017-2496.html https://www.suse.com/security/cve/CVE-2017-2510.html https://www.suse.com/security/cve/CVE-2017-2539.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-7006.html https://www.suse.com/security/cve/CVE-2017-7011.html https://www.suse.com/security/cve/CVE-2017-7012.html https://www.suse.com/security/cve/CVE-2017-7018.html https://www.suse.com/security/cve/CVE-2017-7019.html https://www.suse.com/security/cve/CVE-2017-7020.html https://www.suse.com/security/cve/CVE-2017-7030.html https://www.suse.com/security/cve/CVE-2017-7034.html https://www.suse.com/security/cve/CVE-2017-7037.html https://www.suse.com/security/cve/CVE-2017-7038.html https://www.suse.com/security/cve/CVE-2017-7039.html https://www.suse.com/security/cve/CVE-2017-7040.html https://www.suse.com/security/cve/CVE-2017-7041.html https://www.suse.com/security/cve/CVE-2017-7042.html https://www.suse.com/security/cve/CVE-2017-7043.html https://www.suse.com/security/cve/CVE-2017-7046.html https://www.suse.com/security/cve/CVE-2017-7048.html https://www.suse.com/security/cve/CVE-2017-7049.html https://www.suse.com/security/cve/CVE-2017-7052.html https://www.suse.com/security/cve/CVE-2017-7055.html https://www.suse.com/security/cve/CVE-2017-7056.html https://www.suse.com/security/cve/CVE-2017-7059.html https://www.suse.com/security/cve/CVE-2017-7061.html https://www.suse.com/security/cve/CVE-2017-7064.html https://www.suse.com/security/cve/CVE-2017-7081.html https://www.suse.com/security/cve/CVE-2017-7087.html https://www.suse.com/security/cve/CVE-2017-7089.html https://www.suse.com/security/cve/CVE-2017-7090.html https://www.suse.com/security/cve/CVE-2017-7091.html https://www.suse.com/security/cve/CVE-2017-7092.html https://www.suse.com/security/cve/CVE-2017-7093.html https://www.suse.com/security/cve/CVE-2017-7094.html https://www.suse.com/security/cve/CVE-2017-7095.html https://www.suse.com/security/cve/CVE-2017-7096.html https://www.suse.com/security/cve/CVE-2017-7098.html https://www.suse.com/security/cve/CVE-2017-7099.html https://www.suse.com/security/cve/CVE-2017-7100.html https://www.suse.com/security/cve/CVE-2017-7102.html https://www.suse.com/security/cve/CVE-2017-7104.html https://www.suse.com/security/cve/CVE-2017-7107.html https://www.suse.com/security/cve/CVE-2017-7109.html https://www.suse.com/security/cve/CVE-2017-7111.html https://www.suse.com/security/cve/CVE-2017-7117.html https://www.suse.com/security/cve/CVE-2017-7120.html https://www.suse.com/security/cve/CVE-2017-7142.html https://www.suse.com/security/cve/CVE-2017-7156.html https://www.suse.com/security/cve/CVE-2017-7157.html https://bugzilla.suse.com/1020950 https://bugzilla.suse.com/1024749 https://bugzilla.suse.com/1050469 https://bugzilla.suse.com/1066892 https://bugzilla.suse.com/1069925 https://bugzilla.suse.com/1073654 https://bugzilla.suse.com/1075419

1 0

openSUSE-RU-2018:0325-1: Recommended update for k3b
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0325-1 Rating: low References: #1077728 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for k3b contains the following fix: - build with libmad, lame and ffmpeg, no longer show a warning that libmap is not available (boo#1077728) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-110=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): k3b-lang-17.04.2-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): k3b-17.04.2-8.1 k3b-debuginfo-17.04.2-8.1 k3b-debugsource-17.04.2-8.1 k3b-devel-17.04.2-8.1 References: https://bugzilla.suse.com/1077728

1 0

openSUSE-SU-2018:0324-1: moderate: Security update for libtasn1
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0324-1 Rating: moderate References: #1076832 Cross-References: CVE-2018-6003 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtasn1 fixes one issue. This security issue was fixed: - CVE-2018-6003: Prevent a stack exhaustion in _asn1_decode_simple_ber (lib/decoding.c) when decoding BER encoded structure allowed for DoS (bsc#1076832). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-112=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libtasn1-4.9-3.1 libtasn1-6-4.9-3.1 libtasn1-6-debuginfo-4.9-3.1 libtasn1-debuginfo-4.9-3.1 libtasn1-debugsource-4.9-3.1 libtasn1-devel-4.9-3.1 - openSUSE Leap 42.3 (x86_64): libtasn1-6-32bit-4.9-3.1 libtasn1-6-debuginfo-32bit-4.9-3.1 libtasn1-devel-32bit-4.9-3.1 References: https://www.suse.com/security/cve/CVE-2018-6003.html https://bugzilla.suse.com/1076832

1 0

openSUSE-SU-2018:0323-1: important: Security update for bind
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0323-1 Rating: important References: #1040039 #1047184 #1076118 Cross-References: CVE-2017-3145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes several issues. This security issue was fixed: - CVE-2017-3145: Improper sequencing during cleanup could have lead to a use-after-free error that triggered an assertion failure and crash in named (bsc#1076118). These non-security issues were fixed: - Updated named.root file (bsc#1040039) - Update bind.keys for DNSSEC root KSK rollover (bsc#1047184) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-114=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-devel-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-lwresd-9.9.9P1-53.1 bind-lwresd-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - openSUSE Leap 42.3 (x86_64): bind-libs-32bit-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 - openSUSE Leap 42.3 (noarch): bind-doc-9.9.9P1-53.1 References: https://www.suse.com/security/cve/CVE-2017-3145.html https://bugzilla.suse.com/1040039 https://bugzilla.suse.com/1047184 https://bugzilla.suse.com/1076118

1 0

openSUSE-SU-2018:0322-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0322-1 Rating: moderate References: #1035442 #1052825 #1062571 #1062760 #1064947 #1065766 #1070130 #1072887 #1073973 #1076500 Cross-References: CVE-2018-5748 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 9 fixes is now available. Description: This update for libvirt provides several fixes. This security issue was fixed: - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead() method which allowed to cause DoS (bsc#1076500). These security issues were fixed: - Add a qemu hook script providing functionality similar to Xen's block-dmmd script. (fate#324177) - schema: Make disk driver name attribute optional. (bsc#1073973) - virt-create-rootfs: Handle all SLE 12 versions. (bsc#1072887) - libvirt-guests: Fix the 'stop' operation when action is 'suspend'. (bsc#1070130) - s390: Fix missing host cpu model info. (bsc#1065766) - cpu: Add new EPYC CPU model. (bsc#1052825, fate#324038) - pci: Fix the detection of the link's maximum speed. (bsc#1064947) - nodedev: Increase the netlink socket buffer size. (bsc#1035442) - storage: Fix a race between the volume creation and the pool refresh. (bsc#1062571) - daemon: Drop the minsize directive from hypervisor logrotate files. (bsc#1062760) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-115=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-12.1 libvirt-admin-3.3.0-12.1 libvirt-admin-debuginfo-3.3.0-12.1 libvirt-client-3.3.0-12.1 libvirt-client-debuginfo-3.3.0-12.1 libvirt-daemon-3.3.0-12.1 libvirt-daemon-config-network-3.3.0-12.1 libvirt-daemon-config-nwfilter-3.3.0-12.1 libvirt-daemon-debuginfo-3.3.0-12.1 libvirt-daemon-driver-interface-3.3.0-12.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-12.1 libvirt-daemon-driver-lxc-3.3.0-12.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-12.1 libvirt-daemon-driver-network-3.3.0-12.1 libvirt-daemon-driver-network-debuginfo-3.3.0-12.1 libvirt-daemon-driver-nodedev-3.3.0-12.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-12.1 libvirt-daemon-driver-nwfilter-3.3.0-12.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-12.1 libvirt-daemon-driver-qemu-3.3.0-12.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-12.1 libvirt-daemon-driver-secret-3.3.0-12.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-3.3.0-12.1 libvirt-daemon-driver-storage-core-3.3.0-12.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-disk-3.3.0-12.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-iscsi-3.3.0-12.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-logical-3.3.0-12.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-mpath-3.3.0-12.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-scsi-3.3.0-12.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-12.1 libvirt-daemon-driver-uml-3.3.0-12.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-12.1 libvirt-daemon-driver-vbox-3.3.0-12.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-12.1 libvirt-daemon-hooks-3.3.0-12.1 libvirt-daemon-lxc-3.3.0-12.1 libvirt-daemon-qemu-3.3.0-12.1 libvirt-daemon-uml-3.3.0-12.1 libvirt-daemon-vbox-3.3.0-12.1 libvirt-debugsource-3.3.0-12.1 libvirt-devel-3.3.0-12.1 libvirt-doc-3.3.0-12.1 libvirt-libs-3.3.0-12.1 libvirt-libs-debuginfo-3.3.0-12.1 libvirt-lock-sanlock-3.3.0-12.1 libvirt-lock-sanlock-debuginfo-3.3.0-12.1 libvirt-nss-3.3.0-12.1 libvirt-nss-debuginfo-3.3.0-12.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-12.1 libvirt-daemon-driver-libxl-3.3.0-12.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-rbd-3.3.0-12.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-12.1 libvirt-daemon-xen-3.3.0-12.1 libvirt-devel-32bit-3.3.0-12.1 References: https://www.suse.com/security/cve/CVE-2018-5748.html https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1052825 https://bugzilla.suse.com/1062571 https://bugzilla.suse.com/1062760 https://bugzilla.suse.com/1064947 https://bugzilla.suse.com/1065766 https://bugzilla.suse.com/1070130 https://bugzilla.suse.com/1072887 https://bugzilla.suse.com/1073973 https://bugzilla.suse.com/1076500

1 0

openSUSE-RU-2018:0321-1: Recommended update for dmraid
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for dmraid ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0321-1 Rating: low References: #1060551 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dmraid provides the following fixes: - Remove partitions with O_RDONLY: it's not necessary to use O_RDWR to use BLKPG_DEL_PARTITION. It's actually harmful, because closing the device will cause an IN_CLOSE_WRITE inotify event, which will trigger a BLKRRPART from systemd, which will reinstate all partitions just deleted. (bsc#1060551) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-113=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): dmraid-1.0.0.rc16-42.1 dmraid-debuginfo-1.0.0.rc16-42.1 dmraid-debugsource-1.0.0.rc16-42.1 References: https://bugzilla.suse.com/1060551

1 0

openSUSE-SU-2018:0320-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0320-1 Rating: moderate References: #1048510 #1065276 #1066156 #1068251 #1070428 #1071558 #1074254 #1075724 #1076308 #897422 Cross-References: CVE-2017-15908 CVE-2018-1049 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update for systemd fixes several issues. This security issue was fixed: - CVE-2018-1049: Prevent race that can lead to DoS when using automounts (bsc#1076308). These non-security issues were fixed: - core: don't choke if a unit another unit triggers vanishes during reload - delta: don't ignore PREFIX when the given argument is PREFIX/SUFFIX - delta: extend skip logic to work on full directory paths (prefix+suffix) (bsc#1070428) - delta: check if a prefix needs to be skipped only once - delta: skip symlink paths when split-usr is enabled (#4591) - sysctl: use raw file descriptor in sysctl_write (#7753) - sd-netlink: don't take possesion of netlink fd from caller on failure (bsc#1074254) - Fix the regexp used to detect broken by-id symlinks in /etc/crypttab It was missing the following case: "/dev/disk/by-id/cr_-xxx". - sysctl: disable buffer while writing to /proc (bsc#1071558) - Use read_line() and LONG_LINE_MAX to read values configuration files. (bsc#1071558) - sysctl: no need to check for eof twice - def: add new constant LONG_LINE_MAX - fileio: add new helper call read_line() as bounded getline() replacement - service: Don't stop unneeded units needed by restarted service (#7526) (bsc#1066156) - gpt-auto-generator: fix the handling of the value returned by fstab_has_fstype() in add_swap() (#6280) - gpt-auto-generator: disable gpt auto logic for swaps if at least one is defined in fstab (bsc#897422) - fstab-util: introduce fstab_has_fstype() helper - fstab-generator: ignore root=/dev/nfs (#3591) - fstab-generator: don't process root= if it happens to be "gpt-auto" (#3452) - virt: use XENFEAT_dom0 to detect the hardware domain (#6442, #6662) (#7581) (bsc#1048510) - analyze: replace --no-man with --man=no in the man page (bsc#1068251) - udev: net_setup_link: don't error out when we couldn't apply link config (#7328) - Add missing /etc/systemd/network directory - Fix parsing of features in detect_vm_xen_dom0 (#7890) (bsc#1048510) - sd-bus: use -- when passing arguments to ssh (#6706) - systemctl: make sure we terminate the bus connection first, and then close the pager (#3550) - sd-bus: bump message queue size (bsc#1075724) - tmpfiles: downgrade warning about duplicate line This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-117=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-41.1 libsystemd0-debuginfo-228-41.1 libsystemd0-mini-228-41.1 libsystemd0-mini-debuginfo-228-41.1 libudev-devel-228-41.1 libudev-mini-devel-228-41.1 libudev-mini1-228-41.1 libudev-mini1-debuginfo-228-41.1 libudev1-228-41.1 libudev1-debuginfo-228-41.1 nss-myhostname-228-41.1 nss-myhostname-debuginfo-228-41.1 nss-mymachines-228-41.1 nss-mymachines-debuginfo-228-41.1 systemd-228-41.1 systemd-debuginfo-228-41.1 systemd-debugsource-228-41.1 systemd-devel-228-41.1 systemd-logger-228-41.1 systemd-mini-228-41.1 systemd-mini-debuginfo-228-41.1 systemd-mini-debugsource-228-41.1 systemd-mini-devel-228-41.1 systemd-mini-sysvinit-228-41.1 systemd-sysvinit-228-41.1 udev-228-41.1 udev-debuginfo-228-41.1 udev-mini-228-41.1 udev-mini-debuginfo-228-41.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-41.1 libsystemd0-debuginfo-32bit-228-41.1 libudev1-32bit-228-41.1 libudev1-debuginfo-32bit-228-41.1 nss-myhostname-32bit-228-41.1 nss-myhostname-debuginfo-32bit-228-41.1 systemd-32bit-228-41.1 systemd-debuginfo-32bit-228-41.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-41.1 systemd-mini-bash-completion-228-41.1 References: https://www.suse.com/security/cve/CVE-2017-15908.html https://www.suse.com/security/cve/CVE-2018-1049.html https://bugzilla.suse.com/1048510 https://bugzilla.suse.com/1065276 https://bugzilla.suse.com/1066156 https://bugzilla.suse.com/1068251 https://bugzilla.suse.com/1070428 https://bugzilla.suse.com/1071558 https://bugzilla.suse.com/1074254 https://bugzilla.suse.com/1075724 https://bugzilla.suse.com/1076308 https://bugzilla.suse.com/897422

1 0

openSUSE-RU-2018:0319-1: moderate: Recommended update for python-py2pack
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for python-py2pack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0319-1 Rating: moderate References: #1055632 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-py2pack fixes the following issues: - Run-time requirement on python-setuptools was missing (boo#1055632) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-111=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-py2pack-0.6.3-5.1 References: https://bugzilla.suse.com/1055632

1 0

openSUSE-SU-2018:0318-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0318-1 Rating: moderate References: #1076220 #1076391 Cross-References: CVE-2018-5711 CVE-2018-5712 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php7 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220). - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-28.1 apache2-mod_php7-debuginfo-7.0.7-28.1 php7-7.0.7-28.1 php7-bcmath-7.0.7-28.1 php7-bcmath-debuginfo-7.0.7-28.1 php7-bz2-7.0.7-28.1 php7-bz2-debuginfo-7.0.7-28.1 php7-calendar-7.0.7-28.1 php7-calendar-debuginfo-7.0.7-28.1 php7-ctype-7.0.7-28.1 php7-ctype-debuginfo-7.0.7-28.1 php7-curl-7.0.7-28.1 php7-curl-debuginfo-7.0.7-28.1 php7-dba-7.0.7-28.1 php7-dba-debuginfo-7.0.7-28.1 php7-debuginfo-7.0.7-28.1 php7-debugsource-7.0.7-28.1 php7-devel-7.0.7-28.1 php7-dom-7.0.7-28.1 php7-dom-debuginfo-7.0.7-28.1 php7-enchant-7.0.7-28.1 php7-enchant-debuginfo-7.0.7-28.1 php7-exif-7.0.7-28.1 php7-exif-debuginfo-7.0.7-28.1 php7-fastcgi-7.0.7-28.1 php7-fastcgi-debuginfo-7.0.7-28.1 php7-fileinfo-7.0.7-28.1 php7-fileinfo-debuginfo-7.0.7-28.1 php7-firebird-7.0.7-28.1 php7-firebird-debuginfo-7.0.7-28.1 php7-fpm-7.0.7-28.1 php7-fpm-debuginfo-7.0.7-28.1 php7-ftp-7.0.7-28.1 php7-ftp-debuginfo-7.0.7-28.1 php7-gd-7.0.7-28.1 php7-gd-debuginfo-7.0.7-28.1 php7-gettext-7.0.7-28.1 php7-gettext-debuginfo-7.0.7-28.1 php7-gmp-7.0.7-28.1 php7-gmp-debuginfo-7.0.7-28.1 php7-iconv-7.0.7-28.1 php7-iconv-debuginfo-7.0.7-28.1 php7-imap-7.0.7-28.1 php7-imap-debuginfo-7.0.7-28.1 php7-intl-7.0.7-28.1 php7-intl-debuginfo-7.0.7-28.1 php7-json-7.0.7-28.1 php7-json-debuginfo-7.0.7-28.1 php7-ldap-7.0.7-28.1 php7-ldap-debuginfo-7.0.7-28.1 php7-mbstring-7.0.7-28.1 php7-mbstring-debuginfo-7.0.7-28.1 php7-mcrypt-7.0.7-28.1 php7-mcrypt-debuginfo-7.0.7-28.1 php7-mysql-7.0.7-28.1 php7-mysql-debuginfo-7.0.7-28.1 php7-odbc-7.0.7-28.1 php7-odbc-debuginfo-7.0.7-28.1 php7-opcache-7.0.7-28.1 php7-opcache-debuginfo-7.0.7-28.1 php7-openssl-7.0.7-28.1 php7-openssl-debuginfo-7.0.7-28.1 php7-pcntl-7.0.7-28.1 php7-pcntl-debuginfo-7.0.7-28.1 php7-pdo-7.0.7-28.1 php7-pdo-debuginfo-7.0.7-28.1 php7-pgsql-7.0.7-28.1 php7-pgsql-debuginfo-7.0.7-28.1 php7-phar-7.0.7-28.1 php7-phar-debuginfo-7.0.7-28.1 php7-posix-7.0.7-28.1 php7-posix-debuginfo-7.0.7-28.1 php7-pspell-7.0.7-28.1 php7-pspell-debuginfo-7.0.7-28.1 php7-readline-7.0.7-28.1 php7-readline-debuginfo-7.0.7-28.1 php7-shmop-7.0.7-28.1 php7-shmop-debuginfo-7.0.7-28.1 php7-snmp-7.0.7-28.1 php7-snmp-debuginfo-7.0.7-28.1 php7-soap-7.0.7-28.1 php7-soap-debuginfo-7.0.7-28.1 php7-sockets-7.0.7-28.1 php7-sockets-debuginfo-7.0.7-28.1 php7-sqlite-7.0.7-28.1 php7-sqlite-debuginfo-7.0.7-28.1 php7-sysvmsg-7.0.7-28.1 php7-sysvmsg-debuginfo-7.0.7-28.1 php7-sysvsem-7.0.7-28.1 php7-sysvsem-debuginfo-7.0.7-28.1 php7-sysvshm-7.0.7-28.1 php7-sysvshm-debuginfo-7.0.7-28.1 php7-tidy-7.0.7-28.1 php7-tidy-debuginfo-7.0.7-28.1 php7-tokenizer-7.0.7-28.1 php7-tokenizer-debuginfo-7.0.7-28.1 php7-wddx-7.0.7-28.1 php7-wddx-debuginfo-7.0.7-28.1 php7-xmlreader-7.0.7-28.1 php7-xmlreader-debuginfo-7.0.7-28.1 php7-xmlrpc-7.0.7-28.1 php7-xmlrpc-debuginfo-7.0.7-28.1 php7-xmlwriter-7.0.7-28.1 php7-xmlwriter-debuginfo-7.0.7-28.1 php7-xsl-7.0.7-28.1 php7-xsl-debuginfo-7.0.7-28.1 php7-zip-7.0.7-28.1 php7-zip-debuginfo-7.0.7-28.1 php7-zlib-7.0.7-28.1 php7-zlib-debuginfo-7.0.7-28.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-28.1 php7-pear-Archive_Tar-7.0.7-28.1 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://www.suse.com/security/cve/CVE-2018-5712.html https://bugzilla.suse.com/1076220 https://bugzilla.suse.com/1076391

1 0

openSUSE-RU-2018:0317-1: Recommended update for k3b
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0317-1 Rating: low References: #1077728 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for k3b contains the following fix: - build with libmad, lame and ffmpeg, no longer show a warning that libmap is not available (boo#1077728) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-110=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): k3b-lang-17.04.2-10.1 - openSUSE Leap 42.3 (x86_64): k3b-17.04.2-10.1 k3b-debuginfo-17.04.2-10.1 k3b-debugsource-17.04.2-10.1 k3b-devel-17.04.2-10.1 References: https://bugzilla.suse.com/1077728

1 0

openSUSE-SU-2018:0316-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0316-1 Rating: moderate References: #1076391 Cross-References: CVE-2018-5711 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes one issues. This security issue was fixed: - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-109=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-24.1 gd-debuginfo-2.1.0-24.1 gd-debugsource-2.1.0-24.1 gd-devel-2.1.0-24.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-24.1 gd-debuginfo-32bit-2.1.0-24.1 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://bugzilla.suse.com/1076391

1 0

openSUSE-SU-2018:0315-1: moderate: Security update for nodejs6
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0315-1 Rating: moderate References: #1056058 #1066242 #1072322 Cross-References: CVE-2017-14919 CVE-2017-15896 CVE-2017-3735 CVE-2017-3736 CVE-2017-3738 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs6 fixes the following issues: Security issues fixed: - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL (bsc#1072322). - CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value. - CVE-2017-3738: Embedded OpenSSL is vulnerable to rsaz_1024_mul_avx2 overflow bug on x86_64. - CVE-2017-3736: Embedded OpenSSL is vulnerable to bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242). - CVE-2017-3735: Embedded OpenSSL is vulnerable to malformed X.509 IPAdressFamily that could cause OOB read (bsc#1056058). Bug fixes: - Update to LTS release 6.12.2 (bsc#1072322): * https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ * https://nodejs.org/en/blog/release/v6.12.2/ * https://nodejs.org/en/blog/release/v6.12.1/ * https://nodejs.org/en/blog/release/v6.12.0/ * https://nodejs.org/en/blog/release/v6.11.5/ * https://nodejs.org/en/blog/release/v6.11.4/ * https://nodejs.org/en/blog/release/v6.11.3/ * https://nodejs.org/en/blog/release/v6.11.2/ This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-116=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs6-6.12.2-6.1 nodejs6-debuginfo-6.12.2-6.1 nodejs6-debugsource-6.12.2-6.1 nodejs6-devel-6.12.2-6.1 npm6-6.12.2-6.1 - openSUSE Leap 42.3 (noarch): nodejs6-docs-6.12.2-6.1 References: https://www.suse.com/security/cve/CVE-2017-14919.html https://www.suse.com/security/cve/CVE-2017-15896.html https://www.suse.com/security/cve/CVE-2017-3735.html https://www.suse.com/security/cve/CVE-2017-3736.html https://www.suse.com/security/cve/CVE-2017-3738.html https://bugzilla.suse.com/1056058 https://bugzilla.suse.com/1066242 https://bugzilla.suse.com/1072322

1 0

openSUSE-RU-2018:0314-1: moderate: Recommended update for mtr
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for mtr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0314-1 Rating: moderate References: #1020147 #1067511 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mtr fixes the following issues: Updates Requires/Requires(post) group(dialout) (boo#1067511). Fixes Requires so mtr-gtk installs properly Version update to mtr-0.92: * Loads of fixes all around see NEWS file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-108=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): mtr-0.92-5.1 mtr-gtk-0.92-5.1 References: https://bugzilla.suse.com/1020147 https://bugzilla.suse.com/1067511

1 0

openSUSE-SU-2018:0313-1: important: Security update for chromium
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0313-1 Rating: important References: #1073323 #1077571 #1077722 Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032 CVE-2018-6033 CVE-2018-6034 CVE-2018-6035 CVE-2018-6036 CVE-2018-6037 CVE-2018-6038 CVE-2018-6039 CVE-2018-6040 CVE-2018-6041 CVE-2018-6042 CVE-2018-6043 CVE-2018-6045 CVE-2018-6046 CVE-2018-6047 CVE-2018-6048 CVE-2018-6049 CVE-2018-6050 CVE-2018-6051 CVE-2018-6052 CVE-2018-6053 CVE-2018-6054 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium to 64.0.3282.119 fixes several issues. These security issues were fixed: - CVE-2018-6031: Use after free in PDFium (boo#1077571) - CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571) - CVE-2018-6033: Race when opening downloaded files (boo#1077571) - CVE-2018-6034: Integer overflow in Blink (boo#1077571) - CVE-2018-6035: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571) - CVE-2018-6037: Insufficient user gesture requirements in autofill (boo#1077571) - CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571) - CVE-2018-6039: XSS in DevTools (boo#1077571) - CVE-2018-6040: Content security policy bypass (boo#1077571) - CVE-2018-6041: URL spoof in Navigation (boo#1077571) - CVE-2018-6042: URL spoof in OmniBox (boo#1077571) - CVE-2018-6043: Insufficient escaping with external URL handlers (boo#1077571) - CVE-2018-6045: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6046: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571) - CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571) - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571) - CVE-2018-6049: UI spoof in Permissions (boo#1077571) - CVE-2018-6050: URL spoof in OmniBox (boo#1077571) - CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571) - CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571) - CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571) - CVE-2018-6054: Use after free in WebUI (boo#1077571) Re was updated to version 2018-01-01 (boo#1073323) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-106=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libre2-0-20180101-5.1 libre2-0-debuginfo-20180101-5.1 re2-debugsource-20180101-5.1 re2-devel-20180101-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-64.0.3282.119-46.2 chromium-64.0.3282.119-46.2 References: https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2018-6031.html https://www.suse.com/security/cve/CVE-2018-6032.html https://www.suse.com/security/cve/CVE-2018-6033.html https://www.suse.com/security/cve/CVE-2018-6034.html https://www.suse.com/security/cve/CVE-2018-6035.html https://www.suse.com/security/cve/CVE-2018-6036.html https://www.suse.com/security/cve/CVE-2018-6037.html https://www.suse.com/security/cve/CVE-2018-6038.html https://www.suse.com/security/cve/CVE-2018-6039.html https://www.suse.com/security/cve/CVE-2018-6040.html https://www.suse.com/security/cve/CVE-2018-6041.html https://www.suse.com/security/cve/CVE-2018-6042.html https://www.suse.com/security/cve/CVE-2018-6043.html https://www.suse.com/security/cve/CVE-2018-6045.html https://www.suse.com/security/cve/CVE-2018-6046.html https://www.suse.com/security/cve/CVE-2018-6047.html https://www.suse.com/security/cve/CVE-2018-6048.html https://www.suse.com/security/cve/CVE-2018-6049.html https://www.suse.com/security/cve/CVE-2018-6050.html https://www.suse.com/security/cve/CVE-2018-6051.html https://www.suse.com/security/cve/CVE-2018-6052.html https://www.suse.com/security/cve/CVE-2018-6053.html https://www.suse.com/security/cve/CVE-2018-6054.html https://bugzilla.suse.com/1073323 https://bugzilla.suse.com/1077571 https://bugzilla.suse.com/1077722

1 0

openSUSE-RU-2018:0312-1: moderate: Recommended update for irssi
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0312-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for irssi.openSUSE_Backports_SLE-12 fixes the following issues: Update to version 1.1.0 with multiple features implemented and bugs fixed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-107=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.0-39.1 irssi-devel-1.1.0-39.1 References:

1 0

openSUSE-RU-2018:0310-1: Recommended update for nvmetcli
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for nvmetcli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0310-1 Rating: low References: #1070533 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvmetcli provides the following fix: - Don't display bogus 'disabled' status for ports (bsc#1070533) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-105=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): nvmetcli-0.4-5.1 References: https://bugzilla.suse.com/1070533

1 0

openSUSE-SU-2018:0291-1: moderate: Recommended update for apache2
by opensuse-security＠opensuse.org 30 Jan '18

30 Jan '18

openSUSE Security Update: Recommended update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0291-1 Rating: moderate References: #1042037 #1045160 #1048575 #1057406 Cross-References: CVE-2017-7659 CVE-2017-9789 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for apache2 fixes several issues. These security issues were fixed: - CVE-2017-9789: When under stress (closing many connections) the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour (bsc#1048575). - CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process (bsc#1045160). These non-security issues were fixed: - Use the full path to a2enmod and a2dismod in the apache-22-24-upgrade script (bsc#1042037) - Fall back to 'localhost' as hostname in gensslcert (bsc#1057406) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-104=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-19.1 apache2-debuginfo-2.4.23-19.1 apache2-debugsource-2.4.23-19.1 apache2-devel-2.4.23-19.1 apache2-event-2.4.23-19.1 apache2-event-debuginfo-2.4.23-19.1 apache2-example-pages-2.4.23-19.1 apache2-prefork-2.4.23-19.1 apache2-prefork-debuginfo-2.4.23-19.1 apache2-utils-2.4.23-19.1 apache2-utils-debuginfo-2.4.23-19.1 apache2-worker-2.4.23-19.1 apache2-worker-debuginfo-2.4.23-19.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-19.1 References: https://www.suse.com/security/cve/CVE-2017-7659.html https://www.suse.com/security/cve/CVE-2017-9789.html https://bugzilla.suse.com/1042037 https://bugzilla.suse.com/1045160 https://bugzilla.suse.com/1048575 https://bugzilla.suse.com/1057406

1 0

openSUSE-SU-2018:0259-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0259-1 Rating: important References: #1073323 #1077571 #1077722 Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032 CVE-2018-6033 CVE-2018-6034 CVE-2018-6035 CVE-2018-6036 CVE-2018-6037 CVE-2018-6038 CVE-2018-6039 CVE-2018-6040 CVE-2018-6041 CVE-2018-6042 CVE-2018-6043 CVE-2018-6045 CVE-2018-6046 CVE-2018-6047 CVE-2018-6048 CVE-2018-6049 CVE-2018-6050 CVE-2018-6051 CVE-2018-6052 CVE-2018-6053 CVE-2018-6054 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium to 64.0.3282.119 fixes several issues. These security issues were fixed: - CVE-2018-6031: Use after free in PDFium (boo#1077571) - CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571) - CVE-2018-6033: Race when opening downloaded files (boo#1077571) - CVE-2018-6034: Integer overflow in Blink (boo#1077571) - CVE-2018-6035: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571) - CVE-2018-6037: Insufficient user gesture requirements in autofill (boo#1077571) - CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571) - CVE-2018-6039: XSS in DevTools (boo#1077571) - CVE-2018-6040: Content security policy bypass (boo#1077571) - CVE-2018-6041: URL spoof in Navigation (boo#1077571) - CVE-2018-6042: URL spoof in OmniBox (boo#1077571) - CVE-2018-6043: Insufficient escaping with external URL handlers (boo#1077571) - CVE-2018-6045: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6046: Insufficient isolation of devtools from extensions (boo#1077571) - CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571) - CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571) - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571) - CVE-2018-6049: UI spoof in Permissions (boo#1077571) - CVE-2018-6050: URL spoof in OmniBox (boo#1077571) - CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571) - CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571) - CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571) - CVE-2018-6054: Use after free in WebUI (boo#1077571) Re was updated to version 2018-01-01 (boo#1073323) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-103=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libre2-0-20180101-9.1 libre2-0-debuginfo-20180101-9.1 re2-debugsource-20180101-9.1 re2-devel-20180101-9.1 - openSUSE Leap 42.3 (x86_64): chromedriver-64.0.3282.119-135.1 chromedriver-debuginfo-64.0.3282.119-135.1 chromium-64.0.3282.119-135.1 chromium-debuginfo-64.0.3282.119-135.1 chromium-debugsource-64.0.3282.119-135.1 libre2-0-32bit-20180101-9.1 libre2-0-debuginfo-32bit-20180101-9.1 References: https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2018-6031.html https://www.suse.com/security/cve/CVE-2018-6032.html https://www.suse.com/security/cve/CVE-2018-6033.html https://www.suse.com/security/cve/CVE-2018-6034.html https://www.suse.com/security/cve/CVE-2018-6035.html https://www.suse.com/security/cve/CVE-2018-6036.html https://www.suse.com/security/cve/CVE-2018-6037.html https://www.suse.com/security/cve/CVE-2018-6038.html https://www.suse.com/security/cve/CVE-2018-6039.html https://www.suse.com/security/cve/CVE-2018-6040.html https://www.suse.com/security/cve/CVE-2018-6041.html https://www.suse.com/security/cve/CVE-2018-6042.html https://www.suse.com/security/cve/CVE-2018-6043.html https://www.suse.com/security/cve/CVE-2018-6045.html https://www.suse.com/security/cve/CVE-2018-6046.html https://www.suse.com/security/cve/CVE-2018-6047.html https://www.suse.com/security/cve/CVE-2018-6048.html https://www.suse.com/security/cve/CVE-2018-6049.html https://www.suse.com/security/cve/CVE-2018-6050.html https://www.suse.com/security/cve/CVE-2018-6051.html https://www.suse.com/security/cve/CVE-2018-6052.html https://www.suse.com/security/cve/CVE-2018-6053.html https://www.suse.com/security/cve/CVE-2018-6054.html https://bugzilla.suse.com/1073323 https://bugzilla.suse.com/1077571 https://bugzilla.suse.com/1077722

1 0

openSUSE-SU-2018:0258-1: important: Security update for clamav
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0258-1 Rating: important References: #1040662 #1049423 #1052448 #1052449 #1052466 #1077732 Cross-References: CVE-2017-11423 CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 CVE-2017-6418 CVE-2017-6419 CVE-2017-6420 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for clamav fixes the following issues: - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. - update upstream keys in the keyring - provide and obsolete clamav-nodb to trigger it's removal in Leap bsc#1040662 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-102=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.99.3-20.1 clamav-debuginfo-0.99.3-20.1 clamav-debugsource-0.99.3-20.1 References: https://www.suse.com/security/cve/CVE-2017-11423.html https://www.suse.com/security/cve/CVE-2017-12374.html https://www.suse.com/security/cve/CVE-2017-12375.html https://www.suse.com/security/cve/CVE-2017-12376.html https://www.suse.com/security/cve/CVE-2017-12377.html https://www.suse.com/security/cve/CVE-2017-12378.html https://www.suse.com/security/cve/CVE-2017-12379.html https://www.suse.com/security/cve/CVE-2017-12380.html https://www.suse.com/security/cve/CVE-2017-6418.html https://www.suse.com/security/cve/CVE-2017-6419.html https://www.suse.com/security/cve/CVE-2017-6420.html https://bugzilla.suse.com/1040662 https://bugzilla.suse.com/1049423 https://bugzilla.suse.com/1052448 https://bugzilla.suse.com/1052449 https://bugzilla.suse.com/1052466 https://bugzilla.suse.com/1077732

1 0

openSUSE-SU-2018:0257-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0257-1 Rating: important References: #1077291 Cross-References: CVE-2018-5089 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-101=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-52.6-56.2 MozillaThunderbird-buildsymbols-52.6-56.2 MozillaThunderbird-debuginfo-52.6-56.2 MozillaThunderbird-debugsource-52.6-56.2 MozillaThunderbird-devel-52.6-56.2 MozillaThunderbird-translations-common-52.6-56.2 MozillaThunderbird-translations-other-52.6-56.2 - openSUSE Leap 42.3 (i586): MozillaThunderbird-52.6-56.1 MozillaThunderbird-buildsymbols-52.6-56.1 MozillaThunderbird-debuginfo-52.6-56.1 MozillaThunderbird-debugsource-52.6-56.1 MozillaThunderbird-devel-52.6-56.1 MozillaThunderbird-translations-common-52.6-56.1 MozillaThunderbird-translations-other-52.6-56.1 References: https://www.suse.com/security/cve/CVE-2018-5089.html https://www.suse.com/security/cve/CVE-2018-5095.html https://www.suse.com/security/cve/CVE-2018-5096.html https://www.suse.com/security/cve/CVE-2018-5097.html https://www.suse.com/security/cve/CVE-2018-5098.html https://www.suse.com/security/cve/CVE-2018-5099.html https://www.suse.com/security/cve/CVE-2018-5102.html https://www.suse.com/security/cve/CVE-2018-5103.html https://www.suse.com/security/cve/CVE-2018-5104.html https://www.suse.com/security/cve/CVE-2018-5117.html https://bugzilla.suse.com/1077291

1 0

openSUSE-SU-2018:0256-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jan '18

28 Jan '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0256-1 Rating: important References: #1077291 Cross-References: CVE-2018-5089 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-101=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.6-54.1 MozillaThunderbird-buildsymbols-52.6-54.1 MozillaThunderbird-debuginfo-52.6-54.1 MozillaThunderbird-debugsource-52.6-54.1 MozillaThunderbird-devel-52.6-54.1 MozillaThunderbird-translations-common-52.6-54.1 MozillaThunderbird-translations-other-52.6-54.1 References: https://www.suse.com/security/cve/CVE-2018-5089.html https://www.suse.com/security/cve/CVE-2018-5095.html https://www.suse.com/security/cve/CVE-2018-5096.html https://www.suse.com/security/cve/CVE-2018-5097.html https://www.suse.com/security/cve/CVE-2018-5098.html https://www.suse.com/security/cve/CVE-2018-5099.html https://www.suse.com/security/cve/CVE-2018-5102.html https://www.suse.com/security/cve/CVE-2018-5103.html https://www.suse.com/security/cve/CVE-2018-5104.html https://www.suse.com/security/cve/CVE-2018-5117.html https://bugzilla.suse.com/1077291

1 0

openSUSE-SU-2018:0248-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 26 Jan '18

26 Jan '18

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0248-1 Rating: moderate References: #1076220 #1076391 Cross-References: CVE-2018-5711 CVE-2018-5712 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php5 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220) - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-99=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-99=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-91.2 apache2-mod_php5-debuginfo-5.5.14-91.2 php5-5.5.14-91.2 php5-bcmath-5.5.14-91.2 php5-bcmath-debuginfo-5.5.14-91.2 php5-bz2-5.5.14-91.2 php5-bz2-debuginfo-5.5.14-91.2 php5-calendar-5.5.14-91.2 php5-calendar-debuginfo-5.5.14-91.2 php5-ctype-5.5.14-91.2 php5-ctype-debuginfo-5.5.14-91.2 php5-curl-5.5.14-91.2 php5-curl-debuginfo-5.5.14-91.2 php5-dba-5.5.14-91.2 php5-dba-debuginfo-5.5.14-91.2 php5-debuginfo-5.5.14-91.2 php5-debugsource-5.5.14-91.2 php5-devel-5.5.14-91.2 php5-dom-5.5.14-91.2 php5-dom-debuginfo-5.5.14-91.2 php5-enchant-5.5.14-91.2 php5-enchant-debuginfo-5.5.14-91.2 php5-exif-5.5.14-91.2 php5-exif-debuginfo-5.5.14-91.2 php5-fastcgi-5.5.14-91.2 php5-fastcgi-debuginfo-5.5.14-91.2 php5-fileinfo-5.5.14-91.2 php5-fileinfo-debuginfo-5.5.14-91.2 php5-firebird-5.5.14-91.2 php5-firebird-debuginfo-5.5.14-91.2 php5-fpm-5.5.14-91.2 php5-fpm-debuginfo-5.5.14-91.2 php5-ftp-5.5.14-91.2 php5-ftp-debuginfo-5.5.14-91.2 php5-gd-5.5.14-91.2 php5-gd-debuginfo-5.5.14-91.2 php5-gettext-5.5.14-91.2 php5-gettext-debuginfo-5.5.14-91.2 php5-gmp-5.5.14-91.2 php5-gmp-debuginfo-5.5.14-91.2 php5-iconv-5.5.14-91.2 php5-iconv-debuginfo-5.5.14-91.2 php5-imap-5.5.14-91.2 php5-imap-debuginfo-5.5.14-91.2 php5-intl-5.5.14-91.2 php5-intl-debuginfo-5.5.14-91.2 php5-json-5.5.14-91.2 php5-json-debuginfo-5.5.14-91.2 php5-ldap-5.5.14-91.2 php5-ldap-debuginfo-5.5.14-91.2 php5-mbstring-5.5.14-91.2 php5-mbstring-debuginfo-5.5.14-91.2 php5-mcrypt-5.5.14-91.2 php5-mcrypt-debuginfo-5.5.14-91.2 php5-mssql-5.5.14-91.2 php5-mssql-debuginfo-5.5.14-91.2 php5-mysql-5.5.14-91.2 php5-mysql-debuginfo-5.5.14-91.2 php5-odbc-5.5.14-91.2 php5-odbc-debuginfo-5.5.14-91.2 php5-opcache-5.5.14-91.2 php5-opcache-debuginfo-5.5.14-91.2 php5-openssl-5.5.14-91.2 php5-openssl-debuginfo-5.5.14-91.2 php5-pcntl-5.5.14-91.2 php5-pcntl-debuginfo-5.5.14-91.2 php5-pdo-5.5.14-91.2 php5-pdo-debuginfo-5.5.14-91.2 php5-pgsql-5.5.14-91.2 php5-pgsql-debuginfo-5.5.14-91.2 php5-phar-5.5.14-91.2 php5-phar-debuginfo-5.5.14-91.2 php5-posix-5.5.14-91.2 php5-posix-debuginfo-5.5.14-91.2 php5-pspell-5.5.14-91.2 php5-pspell-debuginfo-5.5.14-91.2 php5-readline-5.5.14-91.2 php5-readline-debuginfo-5.5.14-91.2 php5-shmop-5.5.14-91.2 php5-shmop-debuginfo-5.5.14-91.2 php5-snmp-5.5.14-91.2 php5-snmp-debuginfo-5.5.14-91.2 php5-soap-5.5.14-91.2 php5-soap-debuginfo-5.5.14-91.2 php5-sockets-5.5.14-91.2 php5-sockets-debuginfo-5.5.14-91.2 php5-sqlite-5.5.14-91.2 php5-sqlite-debuginfo-5.5.14-91.2 php5-suhosin-5.5.14-91.2 php5-suhosin-debuginfo-5.5.14-91.2 php5-sysvmsg-5.5.14-91.2 php5-sysvmsg-debuginfo-5.5.14-91.2 php5-sysvsem-5.5.14-91.2 php5-sysvsem-debuginfo-5.5.14-91.2 php5-sysvshm-5.5.14-91.2 php5-sysvshm-debuginfo-5.5.14-91.2 php5-tidy-5.5.14-91.2 php5-tidy-debuginfo-5.5.14-91.2 php5-tokenizer-5.5.14-91.2 php5-tokenizer-debuginfo-5.5.14-91.2 php5-wddx-5.5.14-91.2 php5-wddx-debuginfo-5.5.14-91.2 php5-xmlreader-5.5.14-91.2 php5-xmlreader-debuginfo-5.5.14-91.2 php5-xmlrpc-5.5.14-91.2 php5-xmlrpc-debuginfo-5.5.14-91.2 php5-xmlwriter-5.5.14-91.2 php5-xmlwriter-debuginfo-5.5.14-91.2 php5-xsl-5.5.14-91.2 php5-xsl-debuginfo-5.5.14-91.2 php5-zip-5.5.14-91.2 php5-zip-debuginfo-5.5.14-91.2 php5-zlib-5.5.14-91.2 php5-zlib-debuginfo-5.5.14-91.2 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-91.2 - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php5-5.5.14-77.18.2 apache2-mod_php5-debuginfo-5.5.14-77.18.2 php5-5.5.14-77.18.2 php5-bcmath-5.5.14-77.18.2 php5-bcmath-debuginfo-5.5.14-77.18.2 php5-bz2-5.5.14-77.18.2 php5-bz2-debuginfo-5.5.14-77.18.2 php5-calendar-5.5.14-77.18.2 php5-calendar-debuginfo-5.5.14-77.18.2 php5-ctype-5.5.14-77.18.2 php5-ctype-debuginfo-5.5.14-77.18.2 php5-curl-5.5.14-77.18.2 php5-curl-debuginfo-5.5.14-77.18.2 php5-dba-5.5.14-77.18.2 php5-dba-debuginfo-5.5.14-77.18.2 php5-debuginfo-5.5.14-77.18.2 php5-debugsource-5.5.14-77.18.2 php5-devel-5.5.14-77.18.2 php5-dom-5.5.14-77.18.2 php5-dom-debuginfo-5.5.14-77.18.2 php5-enchant-5.5.14-77.18.2 php5-enchant-debuginfo-5.5.14-77.18.2 php5-exif-5.5.14-77.18.2 php5-exif-debuginfo-5.5.14-77.18.2 php5-fastcgi-5.5.14-77.18.2 php5-fastcgi-debuginfo-5.5.14-77.18.2 php5-fileinfo-5.5.14-77.18.2 php5-fileinfo-debuginfo-5.5.14-77.18.2 php5-firebird-5.5.14-77.18.2 php5-firebird-debuginfo-5.5.14-77.18.2 php5-fpm-5.5.14-77.18.2 php5-fpm-debuginfo-5.5.14-77.18.2 php5-ftp-5.5.14-77.18.2 php5-ftp-debuginfo-5.5.14-77.18.2 php5-gd-5.5.14-77.18.2 php5-gd-debuginfo-5.5.14-77.18.2 php5-gettext-5.5.14-77.18.2 php5-gettext-debuginfo-5.5.14-77.18.2 php5-gmp-5.5.14-77.18.2 php5-gmp-debuginfo-5.5.14-77.18.2 php5-iconv-5.5.14-77.18.2 php5-iconv-debuginfo-5.5.14-77.18.2 php5-imap-5.5.14-77.18.2 php5-imap-debuginfo-5.5.14-77.18.2 php5-intl-5.5.14-77.18.2 php5-intl-debuginfo-5.5.14-77.18.2 php5-json-5.5.14-77.18.2 php5-json-debuginfo-5.5.14-77.18.2 php5-ldap-5.5.14-77.18.2 php5-ldap-debuginfo-5.5.14-77.18.2 php5-mbstring-5.5.14-77.18.2 php5-mbstring-debuginfo-5.5.14-77.18.2 php5-mcrypt-5.5.14-77.18.2 php5-mcrypt-debuginfo-5.5.14-77.18.2 php5-mssql-5.5.14-77.18.2 php5-mssql-debuginfo-5.5.14-77.18.2 php5-mysql-5.5.14-77.18.2 php5-mysql-debuginfo-5.5.14-77.18.2 php5-odbc-5.5.14-77.18.2 php5-odbc-debuginfo-5.5.14-77.18.2 php5-opcache-5.5.14-77.18.2 php5-opcache-debuginfo-5.5.14-77.18.2 php5-openssl-5.5.14-77.18.2 php5-openssl-debuginfo-5.5.14-77.18.2 php5-pcntl-5.5.14-77.18.2 php5-pcntl-debuginfo-5.5.14-77.18.2 php5-pdo-5.5.14-77.18.2 php5-pdo-debuginfo-5.5.14-77.18.2 php5-pgsql-5.5.14-77.18.2 php5-pgsql-debuginfo-5.5.14-77.18.2 php5-phar-5.5.14-77.18.2 php5-phar-debuginfo-5.5.14-77.18.2 php5-posix-5.5.14-77.18.2 php5-posix-debuginfo-5.5.14-77.18.2 php5-pspell-5.5.14-77.18.2 php5-pspell-debuginfo-5.5.14-77.18.2 php5-readline-5.5.14-77.18.2 php5-readline-debuginfo-5.5.14-77.18.2 php5-shmop-5.5.14-77.18.2 php5-shmop-debuginfo-5.5.14-77.18.2 php5-snmp-5.5.14-77.18.2 php5-snmp-debuginfo-5.5.14-77.18.2 php5-soap-5.5.14-77.18.2 php5-soap-debuginfo-5.5.14-77.18.2 php5-sockets-5.5.14-77.18.2 php5-sockets-debuginfo-5.5.14-77.18.2 php5-sqlite-5.5.14-77.18.2 php5-sqlite-debuginfo-5.5.14-77.18.2 php5-suhosin-5.5.14-77.18.2 php5-suhosin-debuginfo-5.5.14-77.18.2 php5-sysvmsg-5.5.14-77.18.2 php5-sysvmsg-debuginfo-5.5.14-77.18.2 php5-sysvsem-5.5.14-77.18.2 php5-sysvsem-debuginfo-5.5.14-77.18.2 php5-sysvshm-5.5.14-77.18.2 php5-sysvshm-debuginfo-5.5.14-77.18.2 php5-tidy-5.5.14-77.18.2 php5-tidy-debuginfo-5.5.14-77.18.2 php5-tokenizer-5.5.14-77.18.2 php5-tokenizer-debuginfo-5.5.14-77.18.2 php5-wddx-5.5.14-77.18.2 php5-wddx-debuginfo-5.5.14-77.18.2 php5-xmlreader-5.5.14-77.18.2 php5-xmlreader-debuginfo-5.5.14-77.18.2 php5-xmlrpc-5.5.14-77.18.2 php5-xmlrpc-debuginfo-5.5.14-77.18.2 php5-xmlwriter-5.5.14-77.18.2 php5-xmlwriter-debuginfo-5.5.14-77.18.2 php5-xsl-5.5.14-77.18.2 php5-xsl-debuginfo-5.5.14-77.18.2 php5-zip-5.5.14-77.18.2 php5-zip-debuginfo-5.5.14-77.18.2 php5-zlib-5.5.14-77.18.2 php5-zlib-debuginfo-5.5.14-77.18.2 - openSUSE Leap 42.2 (noarch): php5-pear-5.5.14-77.18.2 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://www.suse.com/security/cve/CVE-2018-5712.html https://bugzilla.suse.com/1076220 https://bugzilla.suse.com/1076391

1 0

openSUSE-RU-2018:0247-1: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 26 Jan '18

26 Jan '18

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0247-1 Rating: low References: #1077656 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for release-notes-openSUSE adds an end-of-life note to the release notes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-100=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): release-notes-openSUSE-42.2.20180124-5.6.1 References: https://bugzilla.suse.com/1077656

1 0

openSUSE-SU-2018:0236-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 26 Jan '18

26 Jan '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0236-1 Rating: moderate References: #1077001 Cross-References: CVE-2018-1000007 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes one issues. This security issue was fixed: - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-98=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-98=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-30.1 curl-debuginfo-7.37.0-30.1 curl-debugsource-7.37.0-30.1 libcurl-devel-7.37.0-30.1 libcurl4-7.37.0-30.1 libcurl4-debuginfo-7.37.0-30.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-30.1 libcurl4-32bit-7.37.0-30.1 libcurl4-debuginfo-32bit-7.37.0-30.1 - openSUSE Leap 42.2 (i586 x86_64): curl-7.37.0-16.15.1 curl-debuginfo-7.37.0-16.15.1 curl-debugsource-7.37.0-16.15.1 libcurl-devel-7.37.0-16.15.1 libcurl4-7.37.0-16.15.1 libcurl4-debuginfo-7.37.0-16.15.1 - openSUSE Leap 42.2 (x86_64): libcurl-devel-32bit-7.37.0-16.15.1 libcurl4-32bit-7.37.0-16.15.1 libcurl4-debuginfo-32bit-7.37.0-16.15.1 References: https://www.suse.com/security/cve/CVE-2018-1000007.html https://bugzilla.suse.com/1077001

1 0