January 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:0327-1: moderate: Recommended update for multipath-tools, rdma-core
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for multipath-tools, rdma-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0327-1 Rating: moderate References: #1033541 #1037533 #1038865 #1043027 #1045111 #1046092 #1047180 #1049515 #1053515 #1058504 #1058539 #1060413 #1063639 #1063642 #1063697 #1063698 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: This update for multipath-tools and rdma-core provides fixes and enhancements. multipath-tools: - Adjust kpartx.rules so that the link priority is not increased when DM_UDEV_LOW_PRIORITY_FLAG is set. (bsc#1047180) - Fix timeout caused by a deadlock when processing "add map" commands. (bsc#1053515) - Fix queue_if_no_path logic, avoiding warnings when conflicting configuration options are found. (bsc#1043027) - Ensure that option "no_path_retry" always takes precedence over "features queue_if_no_path", and fix respective log messages and documentation. (bsc#1043027) - Backport many fixes and enhancements for kpartx. (bsc#1037533, bsc#1033541) - Ensure strings printed are always null terminated. (bsc#1038865) - Fix syntax error in kpartx.rules. (bsc#1046092) - Default to running kpartx in sync mode, waiting until requested operation is finished. rdma-core: - Fix a byte order issue which causes ibacm to fail to join a multicast group on recent on recent kernels. (bsc#1063639, bsc#1063697) - Fix a segmentation fault of ibacm when a provider other than default is set. (bsc#1063642, bsc#1063698) - Add support for new Broadcom devices. (bsc#1060413) - Remove runtime dependency on dracut. (bsc#1058504) - Fix issue with umad when QSFP is not plugged in. (bsc#1058539) - Fix a problem with SRP daemon not handling subnet manager changes properly. (bsc#1049515) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-120=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ibacm-14-8.1 ibacm-debuginfo-14-8.1 iwpmd-14-8.1 iwpmd-debuginfo-14-8.1 kpartx-0.7.1+71+suse.632dbce970c0-6.1 kpartx-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 libdmmp-devel-0.7.1+71+suse.632dbce970c0-6.1 libdmmp0_1_0-0.7.1+71+suse.632dbce970c0-6.1 libdmmp0_1_0-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 libibcm1-14-8.1 libibcm1-debuginfo-14-8.1 libibumad3-14-8.1 libibumad3-debuginfo-14-8.1 libibverbs-14-8.1 libibverbs-debuginfo-14-8.1 libibverbs-utils-14-8.1 libibverbs-utils-debuginfo-14-8.1 libibverbs1-14-8.1 libibverbs1-debuginfo-14-8.1 libmlx5-1-14-8.1 libmlx5-1-debuginfo-14-8.1 librdmacm-utils-14-8.1 librdmacm-utils-debuginfo-14-8.1 librdmacm1-14-8.1 librdmacm1-debuginfo-14-8.1 multipath-tools-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-debuginfo-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-debugsource-0.7.1+71+suse.632dbce970c0-6.1 multipath-tools-devel-0.7.1+71+suse.632dbce970c0-6.1 rdma-core-14-8.1 rdma-core-debugsource-14-8.1 rdma-core-devel-14-8.1 rdma-ndd-14-8.1 rdma-ndd-debuginfo-14-8.1 rsocket-14-8.1 rsocket-debuginfo-14-8.1 srp_daemon-14-8.1 srp_daemon-debuginfo-14-8.1 - openSUSE Leap 42.3 (x86_64): libibcm1-32bit-14-8.1 libibcm1-debuginfo-32bit-14-8.1 libibumad3-32bit-14-8.1 libibumad3-debuginfo-32bit-14-8.1 libibverbs-32bit-14-8.1 libibverbs-debuginfo-32bit-14-8.1 libibverbs1-32bit-14-8.1 libibverbs1-debuginfo-32bit-14-8.1 libmlx5-1-32bit-14-8.1 libmlx5-1-debuginfo-32bit-14-8.1 librdmacm1-32bit-14-8.1 librdmacm1-debuginfo-32bit-14-8.1 rdma-core-devel-32bit-14-8.1 rsocket-32bit-14-8.1 rsocket-debuginfo-32bit-14-8.1 References: https://bugzilla.suse.com/1033541 https://bugzilla.suse.com/1037533 https://bugzilla.suse.com/1038865 https://bugzilla.suse.com/1043027 https://bugzilla.suse.com/1045111 https://bugzilla.suse.com/1046092 https://bugzilla.suse.com/1047180 https://bugzilla.suse.com/1049515 https://bugzilla.suse.com/1053515 https://bugzilla.suse.com/1058504 https://bugzilla.suse.com/1058539 https://bugzilla.suse.com/1060413 https://bugzilla.suse.com/1063639 https://bugzilla.suse.com/1063642 https://bugzilla.suse.com/1063697 https://bugzilla.suse.com/1063698

1 0

openSUSE-SU-2018:0326-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0326-1 Rating: important References: #1020950 #1024749 #1050469 #1066892 #1069925 #1073654 #1075419 Cross-References: CVE-2016-4692 CVE-2016-4743 CVE-2016-7586 CVE-2016-7587 CVE-2016-7589 CVE-2016-7592 CVE-2016-7598 CVE-2016-7599 CVE-2016-7610 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 CVE-2017-13788 CVE-2017-13798 CVE-2017-13803 CVE-2017-13856 CVE-2017-13866 CVE-2017-13870 CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 CVE-2017-2496 CVE-2017-2510 CVE-2017-2539 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-7006 CVE-2017-7011 CVE-2017-7012 CVE-2017-7018 CVE-2017-7019 CVE-2017-7020 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7038 CVE-2017-7039 CVE-2017-7040 CVE-2017-7041 CVE-2017-7042 CVE-2017-7043 CVE-2017-7046 CVE-2017-7048 CVE-2017-7049 CVE-2017-7052 CVE-2017-7055 CVE-2017-7056 CVE-2017-7059 CVE-2017-7061 CVE-2017-7064 CVE-2017-7081 CVE-2017-7087 CVE-2017-7089 CVE-2017-7090 CVE-2017-7091 CVE-2017-7092 CVE-2017-7093 CVE-2017-7094 CVE-2017-7095 CVE-2017-7096 CVE-2017-7098 CVE-2017-7099 CVE-2017-7100 CVE-2017-7102 CVE-2017-7104 CVE-2017-7107 CVE-2017-7109 CVE-2017-7111 CVE-2017-7117 CVE-2017-7120 CVE-2017-7142 CVE-2017-7156 CVE-2017-7157 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 89 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5: + Disable SharedArrayBuffers from Web API. + Reduce the precision of "high" resolution time to 1ms. + bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4: + Make WebDriver implementation more spec compliant. + Fix a bug when trying to remove cookies before a web process is spawned. + WebKitWebDriver process no longer links to libjavascriptcoregtk. + Fix several memory leaks in GStreamer media backend. + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3: + Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. + Fix handling of null capabilities in WebDriver implementation. + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2: + Fix rendering of arabic text. + Fix a crash in the web process when decoding GIF images. + Fix rendering of wind in Windy.com. + Fix several crashes and rendering issues. Update to version 2.18.1: + Improve performance of GIF animations. + Fix garbled display in GMail. + Fix rendering of several material design icons when using the web font. + Fix flickering when resizing the window in Wayland. + Prevent default kerberos authentication credentials from being used in ephemeral sessions. + Fix a crash when webkit_web_resource_get_data() is cancelled. + Correctly handle touchmove and touchend events in WebKitWebView. + Fix the build with enchant 2.1.1. + Fix the build in HPPA and Alpha. + Fix several crashes and rendering issues. + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142. - Enable gold linker on s390/s390x on SLE15/Tumbleweed. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-8.1 libwebkit2gtk-4_0-37-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-2.18.5-8.1 typelib-1_0-JavaScriptCore-4_0-2.18.5-8.1 typelib-1_0-WebKit2-4_0-2.18.5-8.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.5-8.1 webkit-jsc-4-2.18.5-8.1 webkit-jsc-4-debuginfo-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-2.18.5-8.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-8.1 webkit2gtk3-debugsource-2.18.5-8.1 webkit2gtk3-devel-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-2.18.5-8.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.5-8.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.5-8.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-32bit-2.18.5-8.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.5-8.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.18.5-8.1 References: https://www.suse.com/security/cve/CVE-2016-4692.html https://www.suse.com/security/cve/CVE-2016-4743.html https://www.suse.com/security/cve/CVE-2016-7586.html https://www.suse.com/security/cve/CVE-2016-7587.html https://www.suse.com/security/cve/CVE-2016-7589.html https://www.suse.com/security/cve/CVE-2016-7592.html https://www.suse.com/security/cve/CVE-2016-7598.html https://www.suse.com/security/cve/CVE-2016-7599.html https://www.suse.com/security/cve/CVE-2016-7610.html https://www.suse.com/security/cve/CVE-2016-7623.html https://www.suse.com/security/cve/CVE-2016-7632.html https://www.suse.com/security/cve/CVE-2016-7635.html https://www.suse.com/security/cve/CVE-2016-7639.html https://www.suse.com/security/cve/CVE-2016-7641.html https://www.suse.com/security/cve/CVE-2016-7645.html https://www.suse.com/security/cve/CVE-2016-7652.html https://www.suse.com/security/cve/CVE-2016-7654.html https://www.suse.com/security/cve/CVE-2016-7656.html https://www.suse.com/security/cve/CVE-2017-13788.html https://www.suse.com/security/cve/CVE-2017-13798.html https://www.suse.com/security/cve/CVE-2017-13803.html https://www.suse.com/security/cve/CVE-2017-13856.html https://www.suse.com/security/cve/CVE-2017-13866.html https://www.suse.com/security/cve/CVE-2017-13870.html https://www.suse.com/security/cve/CVE-2017-2350.html https://www.suse.com/security/cve/CVE-2017-2354.html https://www.suse.com/security/cve/CVE-2017-2355.html https://www.suse.com/security/cve/CVE-2017-2356.html https://www.suse.com/security/cve/CVE-2017-2362.html https://www.suse.com/security/cve/CVE-2017-2363.html https://www.suse.com/security/cve/CVE-2017-2364.html https://www.suse.com/security/cve/CVE-2017-2365.html https://www.suse.com/security/cve/CVE-2017-2366.html https://www.suse.com/security/cve/CVE-2017-2369.html https://www.suse.com/security/cve/CVE-2017-2371.html https://www.suse.com/security/cve/CVE-2017-2373.html https://www.suse.com/security/cve/CVE-2017-2496.html https://www.suse.com/security/cve/CVE-2017-2510.html https://www.suse.com/security/cve/CVE-2017-2539.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-7006.html https://www.suse.com/security/cve/CVE-2017-7011.html https://www.suse.com/security/cve/CVE-2017-7012.html https://www.suse.com/security/cve/CVE-2017-7018.html https://www.suse.com/security/cve/CVE-2017-7019.html https://www.suse.com/security/cve/CVE-2017-7020.html https://www.suse.com/security/cve/CVE-2017-7030.html https://www.suse.com/security/cve/CVE-2017-7034.html https://www.suse.com/security/cve/CVE-2017-7037.html https://www.suse.com/security/cve/CVE-2017-7038.html https://www.suse.com/security/cve/CVE-2017-7039.html https://www.suse.com/security/cve/CVE-2017-7040.html https://www.suse.com/security/cve/CVE-2017-7041.html https://www.suse.com/security/cve/CVE-2017-7042.html https://www.suse.com/security/cve/CVE-2017-7043.html https://www.suse.com/security/cve/CVE-2017-7046.html https://www.suse.com/security/cve/CVE-2017-7048.html https://www.suse.com/security/cve/CVE-2017-7049.html https://www.suse.com/security/cve/CVE-2017-7052.html https://www.suse.com/security/cve/CVE-2017-7055.html https://www.suse.com/security/cve/CVE-2017-7056.html https://www.suse.com/security/cve/CVE-2017-7059.html https://www.suse.com/security/cve/CVE-2017-7061.html https://www.suse.com/security/cve/CVE-2017-7064.html https://www.suse.com/security/cve/CVE-2017-7081.html https://www.suse.com/security/cve/CVE-2017-7087.html https://www.suse.com/security/cve/CVE-2017-7089.html https://www.suse.com/security/cve/CVE-2017-7090.html https://www.suse.com/security/cve/CVE-2017-7091.html https://www.suse.com/security/cve/CVE-2017-7092.html https://www.suse.com/security/cve/CVE-2017-7093.html https://www.suse.com/security/cve/CVE-2017-7094.html https://www.suse.com/security/cve/CVE-2017-7095.html https://www.suse.com/security/cve/CVE-2017-7096.html https://www.suse.com/security/cve/CVE-2017-7098.html https://www.suse.com/security/cve/CVE-2017-7099.html https://www.suse.com/security/cve/CVE-2017-7100.html https://www.suse.com/security/cve/CVE-2017-7102.html https://www.suse.com/security/cve/CVE-2017-7104.html https://www.suse.com/security/cve/CVE-2017-7107.html https://www.suse.com/security/cve/CVE-2017-7109.html https://www.suse.com/security/cve/CVE-2017-7111.html https://www.suse.com/security/cve/CVE-2017-7117.html https://www.suse.com/security/cve/CVE-2017-7120.html https://www.suse.com/security/cve/CVE-2017-7142.html https://www.suse.com/security/cve/CVE-2017-7156.html https://www.suse.com/security/cve/CVE-2017-7157.html https://bugzilla.suse.com/1020950 https://bugzilla.suse.com/1024749 https://bugzilla.suse.com/1050469 https://bugzilla.suse.com/1066892 https://bugzilla.suse.com/1069925 https://bugzilla.suse.com/1073654 https://bugzilla.suse.com/1075419

1 0

openSUSE-RU-2018:0325-1: Recommended update for k3b
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0325-1 Rating: low References: #1077728 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for k3b contains the following fix: - build with libmad, lame and ffmpeg, no longer show a warning that libmap is not available (boo#1077728) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-110=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): k3b-lang-17.04.2-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): k3b-17.04.2-8.1 k3b-debuginfo-17.04.2-8.1 k3b-debugsource-17.04.2-8.1 k3b-devel-17.04.2-8.1 References: https://bugzilla.suse.com/1077728

1 0

openSUSE-SU-2018:0324-1: moderate: Security update for libtasn1
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0324-1 Rating: moderate References: #1076832 Cross-References: CVE-2018-6003 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtasn1 fixes one issue. This security issue was fixed: - CVE-2018-6003: Prevent a stack exhaustion in _asn1_decode_simple_ber (lib/decoding.c) when decoding BER encoded structure allowed for DoS (bsc#1076832). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-112=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libtasn1-4.9-3.1 libtasn1-6-4.9-3.1 libtasn1-6-debuginfo-4.9-3.1 libtasn1-debuginfo-4.9-3.1 libtasn1-debugsource-4.9-3.1 libtasn1-devel-4.9-3.1 - openSUSE Leap 42.3 (x86_64): libtasn1-6-32bit-4.9-3.1 libtasn1-6-debuginfo-32bit-4.9-3.1 libtasn1-devel-32bit-4.9-3.1 References: https://www.suse.com/security/cve/CVE-2018-6003.html https://bugzilla.suse.com/1076832

1 0

openSUSE-SU-2018:0323-1: important: Security update for bind
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0323-1 Rating: important References: #1040039 #1047184 #1076118 Cross-References: CVE-2017-3145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes several issues. This security issue was fixed: - CVE-2017-3145: Improper sequencing during cleanup could have lead to a use-after-free error that triggered an assertion failure and crash in named (bsc#1076118). These non-security issues were fixed: - Updated named.root file (bsc#1040039) - Update bind.keys for DNSSEC root KSK rollover (bsc#1047184) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-114=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-devel-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-lwresd-9.9.9P1-53.1 bind-lwresd-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - openSUSE Leap 42.3 (x86_64): bind-libs-32bit-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 - openSUSE Leap 42.3 (noarch): bind-doc-9.9.9P1-53.1 References: https://www.suse.com/security/cve/CVE-2017-3145.html https://bugzilla.suse.com/1040039 https://bugzilla.suse.com/1047184 https://bugzilla.suse.com/1076118

1 0

openSUSE-SU-2018:0322-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0322-1 Rating: moderate References: #1035442 #1052825 #1062571 #1062760 #1064947 #1065766 #1070130 #1072887 #1073973 #1076500 Cross-References: CVE-2018-5748 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 9 fixes is now available. Description: This update for libvirt provides several fixes. This security issue was fixed: - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead() method which allowed to cause DoS (bsc#1076500). These security issues were fixed: - Add a qemu hook script providing functionality similar to Xen's block-dmmd script. (fate#324177) - schema: Make disk driver name attribute optional. (bsc#1073973) - virt-create-rootfs: Handle all SLE 12 versions. (bsc#1072887) - libvirt-guests: Fix the 'stop' operation when action is 'suspend'. (bsc#1070130) - s390: Fix missing host cpu model info. (bsc#1065766) - cpu: Add new EPYC CPU model. (bsc#1052825, fate#324038) - pci: Fix the detection of the link's maximum speed. (bsc#1064947) - nodedev: Increase the netlink socket buffer size. (bsc#1035442) - storage: Fix a race between the volume creation and the pool refresh. (bsc#1062571) - daemon: Drop the minsize directive from hypervisor logrotate files. (bsc#1062760) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-115=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-12.1 libvirt-admin-3.3.0-12.1 libvirt-admin-debuginfo-3.3.0-12.1 libvirt-client-3.3.0-12.1 libvirt-client-debuginfo-3.3.0-12.1 libvirt-daemon-3.3.0-12.1 libvirt-daemon-config-network-3.3.0-12.1 libvirt-daemon-config-nwfilter-3.3.0-12.1 libvirt-daemon-debuginfo-3.3.0-12.1 libvirt-daemon-driver-interface-3.3.0-12.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-12.1 libvirt-daemon-driver-lxc-3.3.0-12.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-12.1 libvirt-daemon-driver-network-3.3.0-12.1 libvirt-daemon-driver-network-debuginfo-3.3.0-12.1 libvirt-daemon-driver-nodedev-3.3.0-12.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-12.1 libvirt-daemon-driver-nwfilter-3.3.0-12.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-12.1 libvirt-daemon-driver-qemu-3.3.0-12.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-12.1 libvirt-daemon-driver-secret-3.3.0-12.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-3.3.0-12.1 libvirt-daemon-driver-storage-core-3.3.0-12.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-disk-3.3.0-12.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-iscsi-3.3.0-12.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-logical-3.3.0-12.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-mpath-3.3.0-12.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-scsi-3.3.0-12.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-12.1 libvirt-daemon-driver-uml-3.3.0-12.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-12.1 libvirt-daemon-driver-vbox-3.3.0-12.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-12.1 libvirt-daemon-hooks-3.3.0-12.1 libvirt-daemon-lxc-3.3.0-12.1 libvirt-daemon-qemu-3.3.0-12.1 libvirt-daemon-uml-3.3.0-12.1 libvirt-daemon-vbox-3.3.0-12.1 libvirt-debugsource-3.3.0-12.1 libvirt-devel-3.3.0-12.1 libvirt-doc-3.3.0-12.1 libvirt-libs-3.3.0-12.1 libvirt-libs-debuginfo-3.3.0-12.1 libvirt-lock-sanlock-3.3.0-12.1 libvirt-lock-sanlock-debuginfo-3.3.0-12.1 libvirt-nss-3.3.0-12.1 libvirt-nss-debuginfo-3.3.0-12.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-12.1 libvirt-daemon-driver-libxl-3.3.0-12.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-12.1 libvirt-daemon-driver-storage-rbd-3.3.0-12.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-12.1 libvirt-daemon-xen-3.3.0-12.1 libvirt-devel-32bit-3.3.0-12.1 References: https://www.suse.com/security/cve/CVE-2018-5748.html https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1052825 https://bugzilla.suse.com/1062571 https://bugzilla.suse.com/1062760 https://bugzilla.suse.com/1064947 https://bugzilla.suse.com/1065766 https://bugzilla.suse.com/1070130 https://bugzilla.suse.com/1072887 https://bugzilla.suse.com/1073973 https://bugzilla.suse.com/1076500

1 0

openSUSE-RU-2018:0321-1: Recommended update for dmraid
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for dmraid ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0321-1 Rating: low References: #1060551 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dmraid provides the following fixes: - Remove partitions with O_RDONLY: it's not necessary to use O_RDWR to use BLKPG_DEL_PARTITION. It's actually harmful, because closing the device will cause an IN_CLOSE_WRITE inotify event, which will trigger a BLKRRPART from systemd, which will reinstate all partitions just deleted. (bsc#1060551) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-113=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): dmraid-1.0.0.rc16-42.1 dmraid-debuginfo-1.0.0.rc16-42.1 dmraid-debugsource-1.0.0.rc16-42.1 References: https://bugzilla.suse.com/1060551

1 0

openSUSE-SU-2018:0320-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0320-1 Rating: moderate References: #1048510 #1065276 #1066156 #1068251 #1070428 #1071558 #1074254 #1075724 #1076308 #897422 Cross-References: CVE-2017-15908 CVE-2018-1049 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update for systemd fixes several issues. This security issue was fixed: - CVE-2018-1049: Prevent race that can lead to DoS when using automounts (bsc#1076308). These non-security issues were fixed: - core: don't choke if a unit another unit triggers vanishes during reload - delta: don't ignore PREFIX when the given argument is PREFIX/SUFFIX - delta: extend skip logic to work on full directory paths (prefix+suffix) (bsc#1070428) - delta: check if a prefix needs to be skipped only once - delta: skip symlink paths when split-usr is enabled (#4591) - sysctl: use raw file descriptor in sysctl_write (#7753) - sd-netlink: don't take possesion of netlink fd from caller on failure (bsc#1074254) - Fix the regexp used to detect broken by-id symlinks in /etc/crypttab It was missing the following case: "/dev/disk/by-id/cr_-xxx". - sysctl: disable buffer while writing to /proc (bsc#1071558) - Use read_line() and LONG_LINE_MAX to read values configuration files. (bsc#1071558) - sysctl: no need to check for eof twice - def: add new constant LONG_LINE_MAX - fileio: add new helper call read_line() as bounded getline() replacement - service: Don't stop unneeded units needed by restarted service (#7526) (bsc#1066156) - gpt-auto-generator: fix the handling of the value returned by fstab_has_fstype() in add_swap() (#6280) - gpt-auto-generator: disable gpt auto logic for swaps if at least one is defined in fstab (bsc#897422) - fstab-util: introduce fstab_has_fstype() helper - fstab-generator: ignore root=/dev/nfs (#3591) - fstab-generator: don't process root= if it happens to be "gpt-auto" (#3452) - virt: use XENFEAT_dom0 to detect the hardware domain (#6442, #6662) (#7581) (bsc#1048510) - analyze: replace --no-man with --man=no in the man page (bsc#1068251) - udev: net_setup_link: don't error out when we couldn't apply link config (#7328) - Add missing /etc/systemd/network directory - Fix parsing of features in detect_vm_xen_dom0 (#7890) (bsc#1048510) - sd-bus: use -- when passing arguments to ssh (#6706) - systemctl: make sure we terminate the bus connection first, and then close the pager (#3550) - sd-bus: bump message queue size (bsc#1075724) - tmpfiles: downgrade warning about duplicate line This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-117=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-41.1 libsystemd0-debuginfo-228-41.1 libsystemd0-mini-228-41.1 libsystemd0-mini-debuginfo-228-41.1 libudev-devel-228-41.1 libudev-mini-devel-228-41.1 libudev-mini1-228-41.1 libudev-mini1-debuginfo-228-41.1 libudev1-228-41.1 libudev1-debuginfo-228-41.1 nss-myhostname-228-41.1 nss-myhostname-debuginfo-228-41.1 nss-mymachines-228-41.1 nss-mymachines-debuginfo-228-41.1 systemd-228-41.1 systemd-debuginfo-228-41.1 systemd-debugsource-228-41.1 systemd-devel-228-41.1 systemd-logger-228-41.1 systemd-mini-228-41.1 systemd-mini-debuginfo-228-41.1 systemd-mini-debugsource-228-41.1 systemd-mini-devel-228-41.1 systemd-mini-sysvinit-228-41.1 systemd-sysvinit-228-41.1 udev-228-41.1 udev-debuginfo-228-41.1 udev-mini-228-41.1 udev-mini-debuginfo-228-41.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-41.1 libsystemd0-debuginfo-32bit-228-41.1 libudev1-32bit-228-41.1 libudev1-debuginfo-32bit-228-41.1 nss-myhostname-32bit-228-41.1 nss-myhostname-debuginfo-32bit-228-41.1 systemd-32bit-228-41.1 systemd-debuginfo-32bit-228-41.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-41.1 systemd-mini-bash-completion-228-41.1 References: https://www.suse.com/security/cve/CVE-2017-15908.html https://www.suse.com/security/cve/CVE-2018-1049.html https://bugzilla.suse.com/1048510 https://bugzilla.suse.com/1065276 https://bugzilla.suse.com/1066156 https://bugzilla.suse.com/1068251 https://bugzilla.suse.com/1070428 https://bugzilla.suse.com/1071558 https://bugzilla.suse.com/1074254 https://bugzilla.suse.com/1075724 https://bugzilla.suse.com/1076308 https://bugzilla.suse.com/897422

1 0

openSUSE-RU-2018:0319-1: moderate: Recommended update for python-py2pack
by maintenance＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Recommended Update: Recommended update for python-py2pack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0319-1 Rating: moderate References: #1055632 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-py2pack fixes the following issues: - Run-time requirement on python-setuptools was missing (boo#1055632) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-111=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-py2pack-0.6.3-5.1 References: https://bugzilla.suse.com/1055632

1 0

openSUSE-SU-2018:0318-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 31 Jan '18

31 Jan '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0318-1 Rating: moderate References: #1076220 #1076391 Cross-References: CVE-2018-5711 CVE-2018-5712 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php7 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220). - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-28.1 apache2-mod_php7-debuginfo-7.0.7-28.1 php7-7.0.7-28.1 php7-bcmath-7.0.7-28.1 php7-bcmath-debuginfo-7.0.7-28.1 php7-bz2-7.0.7-28.1 php7-bz2-debuginfo-7.0.7-28.1 php7-calendar-7.0.7-28.1 php7-calendar-debuginfo-7.0.7-28.1 php7-ctype-7.0.7-28.1 php7-ctype-debuginfo-7.0.7-28.1 php7-curl-7.0.7-28.1 php7-curl-debuginfo-7.0.7-28.1 php7-dba-7.0.7-28.1 php7-dba-debuginfo-7.0.7-28.1 php7-debuginfo-7.0.7-28.1 php7-debugsource-7.0.7-28.1 php7-devel-7.0.7-28.1 php7-dom-7.0.7-28.1 php7-dom-debuginfo-7.0.7-28.1 php7-enchant-7.0.7-28.1 php7-enchant-debuginfo-7.0.7-28.1 php7-exif-7.0.7-28.1 php7-exif-debuginfo-7.0.7-28.1 php7-fastcgi-7.0.7-28.1 php7-fastcgi-debuginfo-7.0.7-28.1 php7-fileinfo-7.0.7-28.1 php7-fileinfo-debuginfo-7.0.7-28.1 php7-firebird-7.0.7-28.1 php7-firebird-debuginfo-7.0.7-28.1 php7-fpm-7.0.7-28.1 php7-fpm-debuginfo-7.0.7-28.1 php7-ftp-7.0.7-28.1 php7-ftp-debuginfo-7.0.7-28.1 php7-gd-7.0.7-28.1 php7-gd-debuginfo-7.0.7-28.1 php7-gettext-7.0.7-28.1 php7-gettext-debuginfo-7.0.7-28.1 php7-gmp-7.0.7-28.1 php7-gmp-debuginfo-7.0.7-28.1 php7-iconv-7.0.7-28.1 php7-iconv-debuginfo-7.0.7-28.1 php7-imap-7.0.7-28.1 php7-imap-debuginfo-7.0.7-28.1 php7-intl-7.0.7-28.1 php7-intl-debuginfo-7.0.7-28.1 php7-json-7.0.7-28.1 php7-json-debuginfo-7.0.7-28.1 php7-ldap-7.0.7-28.1 php7-ldap-debuginfo-7.0.7-28.1 php7-mbstring-7.0.7-28.1 php7-mbstring-debuginfo-7.0.7-28.1 php7-mcrypt-7.0.7-28.1 php7-mcrypt-debuginfo-7.0.7-28.1 php7-mysql-7.0.7-28.1 php7-mysql-debuginfo-7.0.7-28.1 php7-odbc-7.0.7-28.1 php7-odbc-debuginfo-7.0.7-28.1 php7-opcache-7.0.7-28.1 php7-opcache-debuginfo-7.0.7-28.1 php7-openssl-7.0.7-28.1 php7-openssl-debuginfo-7.0.7-28.1 php7-pcntl-7.0.7-28.1 php7-pcntl-debuginfo-7.0.7-28.1 php7-pdo-7.0.7-28.1 php7-pdo-debuginfo-7.0.7-28.1 php7-pgsql-7.0.7-28.1 php7-pgsql-debuginfo-7.0.7-28.1 php7-phar-7.0.7-28.1 php7-phar-debuginfo-7.0.7-28.1 php7-posix-7.0.7-28.1 php7-posix-debuginfo-7.0.7-28.1 php7-pspell-7.0.7-28.1 php7-pspell-debuginfo-7.0.7-28.1 php7-readline-7.0.7-28.1 php7-readline-debuginfo-7.0.7-28.1 php7-shmop-7.0.7-28.1 php7-shmop-debuginfo-7.0.7-28.1 php7-snmp-7.0.7-28.1 php7-snmp-debuginfo-7.0.7-28.1 php7-soap-7.0.7-28.1 php7-soap-debuginfo-7.0.7-28.1 php7-sockets-7.0.7-28.1 php7-sockets-debuginfo-7.0.7-28.1 php7-sqlite-7.0.7-28.1 php7-sqlite-debuginfo-7.0.7-28.1 php7-sysvmsg-7.0.7-28.1 php7-sysvmsg-debuginfo-7.0.7-28.1 php7-sysvsem-7.0.7-28.1 php7-sysvsem-debuginfo-7.0.7-28.1 php7-sysvshm-7.0.7-28.1 php7-sysvshm-debuginfo-7.0.7-28.1 php7-tidy-7.0.7-28.1 php7-tidy-debuginfo-7.0.7-28.1 php7-tokenizer-7.0.7-28.1 php7-tokenizer-debuginfo-7.0.7-28.1 php7-wddx-7.0.7-28.1 php7-wddx-debuginfo-7.0.7-28.1 php7-xmlreader-7.0.7-28.1 php7-xmlreader-debuginfo-7.0.7-28.1 php7-xmlrpc-7.0.7-28.1 php7-xmlrpc-debuginfo-7.0.7-28.1 php7-xmlwriter-7.0.7-28.1 php7-xmlwriter-debuginfo-7.0.7-28.1 php7-xsl-7.0.7-28.1 php7-xsl-debuginfo-7.0.7-28.1 php7-zip-7.0.7-28.1 php7-zip-debuginfo-7.0.7-28.1 php7-zlib-7.0.7-28.1 php7-zlib-debuginfo-7.0.7-28.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-28.1 php7-pear-Archive_Tar-7.0.7-28.1 References: https://www.suse.com/security/cve/CVE-2018-5711.html https://www.suse.com/security/cve/CVE-2018-5712.html https://bugzilla.suse.com/1076220 https://bugzilla.suse.com/1076391

1 0