October 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2018:3541-1: Optional update to add gcc8
by maintenance＠opensuse.org 29 Oct '18

29 Oct '18

openSUSE Optional Update: Optional update to add gcc8 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3541-1 Rating: low References: #1084812 #1084842 #1087550 #1094222 #1102564 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 optional fixes can now be installed. Description: This updates adds the GNU Compiler Collection 8 to openSUSE Leap 42.3. The update also supplies gcc8 compatible libstdc++, libgcc_s1 and other gcc derived libraries. Various optimizers have been improved in GCC 8, several of bugs fixed, quite some new warnings added and the error pin-pointing and fix-suggestions have been greatly improved. The GNU Compiler page for GCC 8 contains a summary of all the changes that have happened: https://gcc.gnu.org/gcc-8/changes.html Also changes needed or common pitfalls when porting software are described on: https://gcc.gnu.org/gcc-8/porting_to.html Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1328=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp8-8.2.1+r264010-2.3 cpp8-debuginfo-8.2.1+r264010-2.3 gcc8-8.2.1+r264010-2.3 gcc8-ada-8.2.1+r264010-2.3 gcc8-ada-debuginfo-8.2.1+r264010-2.3 gcc8-c++-8.2.1+r264010-2.3 gcc8-c++-debuginfo-8.2.1+r264010-2.3 gcc8-debuginfo-8.2.1+r264010-2.3 gcc8-debugsource-8.2.1+r264010-2.3 gcc8-fortran-8.2.1+r264010-2.3 gcc8-fortran-debuginfo-8.2.1+r264010-2.3 gcc8-go-8.2.1+r264010-2.3 gcc8-go-debuginfo-8.2.1+r264010-2.3 gcc8-locale-8.2.1+r264010-2.3 gcc8-obj-c++-8.2.1+r264010-2.3 gcc8-obj-c++-debuginfo-8.2.1+r264010-2.3 gcc8-objc-8.2.1+r264010-2.3 gcc8-objc-debuginfo-8.2.1+r264010-2.3 gcc8-testresults-8.2.1+r264010-2.2 libada8-8.2.1+r264010-2.3 libada8-debuginfo-8.2.1+r264010-2.3 libasan5-8.2.1+r264010-2.3 libasan5-debuginfo-8.2.1+r264010-2.3 libatomic1-8.2.1+r264010-2.3 libatomic1-debuginfo-8.2.1+r264010-2.3 libgcc_s1-8.2.1+r264010-2.3 libgcc_s1-debuginfo-8.2.1+r264010-2.3 libgfortran5-8.2.1+r264010-2.3 libgfortran5-debuginfo-8.2.1+r264010-2.3 libgo13-8.2.1+r264010-2.3 libgo13-debuginfo-8.2.1+r264010-2.3 libgomp1-8.2.1+r264010-2.3 libgomp1-debuginfo-8.2.1+r264010-2.3 libitm1-8.2.1+r264010-2.3 libitm1-debuginfo-8.2.1+r264010-2.3 libmpx2-8.2.1+r264010-2.3 libmpx2-debuginfo-8.2.1+r264010-2.3 libmpxwrappers2-8.2.1+r264010-2.3 libmpxwrappers2-debuginfo-8.2.1+r264010-2.3 libobjc4-gcc8-8.2.1+r264010-2.3 libobjc4-gcc8-debuginfo-8.2.1+r264010-2.3 libquadmath0-8.2.1+r264010-2.3 libquadmath0-debuginfo-8.2.1+r264010-2.3 libstdc++6-8.2.1+r264010-2.3 libstdc++6-debuginfo-8.2.1+r264010-2.3 libstdc++6-devel-gcc8-8.2.1+r264010-2.3 libstdc++6-locale-8.2.1+r264010-2.3 libubsan1-8.2.1+r264010-2.3 libubsan1-debuginfo-8.2.1+r264010-2.3 - openSUSE Leap 42.3 (x86_64): cross-nvptx-gcc8-8.2.1+r264010-2.1 cross-nvptx-newlib8-devel-8.2.1+r264010-2.1 gcc8-32bit-8.2.1+r264010-2.3 gcc8-ada-32bit-8.2.1+r264010-2.3 gcc8-c++-32bit-8.2.1+r264010-2.3 gcc8-fortran-32bit-8.2.1+r264010-2.3 gcc8-go-32bit-8.2.1+r264010-2.3 gcc8-obj-c++-32bit-8.2.1+r264010-2.3 gcc8-objc-32bit-8.2.1+r264010-2.3 libada8-32bit-8.2.1+r264010-2.3 libada8-32bit-debuginfo-8.2.1+r264010-2.3 libasan5-32bit-8.2.1+r264010-2.3 libasan5-32bit-debuginfo-8.2.1+r264010-2.3 libatomic1-32bit-8.2.1+r264010-2.3 libatomic1-32bit-debuginfo-8.2.1+r264010-2.3 libgcc_s1-32bit-8.2.1+r264010-2.3 libgcc_s1-32bit-debuginfo-8.2.1+r264010-2.3 libgfortran5-32bit-8.2.1+r264010-2.3 libgfortran5-32bit-debuginfo-8.2.1+r264010-2.3 libgo13-32bit-8.2.1+r264010-2.3 libgo13-32bit-debuginfo-8.2.1+r264010-2.3 libgomp1-32bit-8.2.1+r264010-2.3 libgomp1-32bit-debuginfo-8.2.1+r264010-2.3 libitm1-32bit-8.2.1+r264010-2.3 libitm1-32bit-debuginfo-8.2.1+r264010-2.3 liblsan0-8.2.1+r264010-2.3 liblsan0-debuginfo-8.2.1+r264010-2.3 libmpx2-32bit-8.2.1+r264010-2.3 libmpx2-32bit-debuginfo-8.2.1+r264010-2.3 libmpxwrappers2-32bit-8.2.1+r264010-2.3 libmpxwrappers2-32bit-debuginfo-8.2.1+r264010-2.3 libobjc4-gcc8-32bit-8.2.1+r264010-2.3 libobjc4-gcc8-32bit-debuginfo-8.2.1+r264010-2.3 libquadmath0-32bit-8.2.1+r264010-2.3 libquadmath0-32bit-debuginfo-8.2.1+r264010-2.3 libstdc++6-32bit-8.2.1+r264010-2.3 libstdc++6-32bit-debuginfo-8.2.1+r264010-2.3 libstdc++6-devel-gcc8-32bit-8.2.1+r264010-2.3 libtsan0-8.2.1+r264010-2.3 libtsan0-debuginfo-8.2.1+r264010-2.3 libubsan1-32bit-8.2.1+r264010-2.3 libubsan1-32bit-debuginfo-8.2.1+r264010-2.3 - openSUSE Leap 42.3 (noarch): gcc8-info-8.2.1+r264010-2.3 References: https://bugzilla.suse.com/1084812 https://bugzilla.suse.com/1084842 https://bugzilla.suse.com/1087550 https://bugzilla.suse.com/1094222 https://bugzilla.suse.com/1102564

1 0

openSUSE-SU-2018:3539-1: moderate: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3539-1 Rating: moderate References: #1080798 #1098854 #1099835 #1104205 #1109209 #1111873 Cross-References: CVE-2018-14526 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for wpa_supplicant provides the following fixes: This security issues was fixe: - CVE-2018-14526: Under certain conditions, the integrity of EAPOL-Key messages was not checked, leading to a decryption oracle. An attacker within range of the Access Point and client could have abused the vulnerability to recover sensitive information (bsc#1104205) These non-security issues were fixed: - Fix reading private key passwords from the configuration file. (bsc#1099835) - Enable PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network. (bsc#1109209) - compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - Enabled timestamps in log file when being invoked by systemd service file (bsc#1080798). - Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1316=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): wpa_supplicant-2.6-lp150.3.6.1 wpa_supplicant-debuginfo-2.6-lp150.3.6.1 wpa_supplicant-debugsource-2.6-lp150.3.6.1 wpa_supplicant-gui-2.6-lp150.3.6.1 wpa_supplicant-gui-debuginfo-2.6-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14526.html https://bugzilla.suse.com/1080798 https://bugzilla.suse.com/1098854 https://bugzilla.suse.com/1099835 https://bugzilla.suse.com/1104205 https://bugzilla.suse.com/1109209 https://bugzilla.suse.com/1111873

1 0

openSUSE-RU-2018:3538-1: moderate: Recommended update for yast2-users
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3538-1 Rating: moderate References: #1107456 #1112119 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-users fixes the following issues: - The YaST users module (NIS) may have crashed when attempting to read data from a non-existent user (bsc#1112119, bsc#1107456) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1323=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-users-4.0.7-lp150.2.6.1 yast2-users-debuginfo-4.0.7-lp150.2.6.1 yast2-users-debugsource-4.0.7-lp150.2.6.1 References: https://bugzilla.suse.com/1107456 https://bugzilla.suse.com/1112119

1 0

openSUSE-SU-2018:3537-1: moderate: Security update for audiofile
by opensuse-security＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Security Update: Security update for audiofile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3537-1 Rating: moderate References: #1111586 Cross-References: CVE-2018-17095 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for audiofile fixes the following issues: - CVE-2018-17095: A heap-based buffer overflow in Expand3To4Module::run could occurred when running sfconvert leading to crashes or code execution when handling untrusted soundfiles (bsc#1111586). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1325=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): audiofile-0.3.6-lp150.2.3.1 audiofile-debuginfo-0.3.6-lp150.2.3.1 audiofile-debugsource-0.3.6-lp150.2.3.1 audiofile-devel-0.3.6-lp150.2.3.1 audiofile-doc-0.3.6-lp150.2.3.1 libaudiofile1-0.3.6-lp150.2.3.1 libaudiofile1-debuginfo-0.3.6-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): audiofile-devel-32bit-0.3.6-lp150.2.3.1 libaudiofile1-32bit-0.3.6-lp150.2.3.1 libaudiofile1-32bit-debuginfo-0.3.6-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-17095.html https://bugzilla.suse.com/1111586

1 0

openSUSE-RU-2018:3536-1: Recommended update for cpio
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3536-1 Rating: low References: #1076810 #889138 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for cpio provides the following fix: - Remove an obsolete patch that was causing cpio not to preserve folder permissions. (bsc#1076810, bsc#889138) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1317=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cpio-2.11-38.3.1 cpio-debuginfo-2.11-38.3.1 cpio-debugsource-2.11-38.3.1 - openSUSE Leap 42.3 (noarch): cpio-lang-2.11-38.3.1 References: https://bugzilla.suse.com/1076810 https://bugzilla.suse.com/889138

1 0

openSUSE-RU-2018:3535-1: moderate: Recommended update for xdm
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3535-1 Rating: moderate References: #1062105 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xdm fixes the following issues: - Change /etc/X11/xdm/scripts/10-gpg-agent to get it work with every gpg version 2.1 and up. (bsc#1062105) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1320=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xdm-1.1.11-lp150.11.3.1 xdm-debuginfo-1.1.11-lp150.11.3.1 xdm-debugsource-1.1.11-lp150.11.3.1 xdm-xsession-1.1.11-lp150.11.3.1 References: https://bugzilla.suse.com/1062105

1 0

openSUSE-RU-2018:3534-1: moderate: Recommended update for libyui-qt-pkg
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for libyui-qt-pkg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3534-1 Rating: moderate References: #991090 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libyui-qt-pkg provides the following fixes: - Do not display "out of disk space" error at start when such a large disk (bigger than 8EiB) is present in the system. (bsc#991090) - Fix displaying negative disk sizes in the disk usage dialog. (bsc#991090) - Added new "Services" view, displayed only when at least one repository service is present. (fate#321043) - Display the busy cursor while package filtering is in progress. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1326=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libyui-qt-pkg-debugsource-2.45.15.2-lp150.2.3.1 libyui-qt-pkg-devel-2.45.15.2-lp150.2.3.1 libyui-qt-pkg8-2.45.15.2-lp150.2.3.1 libyui-qt-pkg8-debuginfo-2.45.15.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libyui-qt-pkg-doc-2.45.15.2-lp150.2.3.1 References: https://bugzilla.suse.com/991090

1 0

openSUSE-RU-2018:3533-1: important: Recommended update for xfsprogs
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3533-1 Rating: important References: #1089777 #1105068 #1105396 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for xfsprogs fixes the following issues: - avoid divide-by-zero when hardware reports optimal i/o size as 0 (bsc#1089777) - repair: shift inode back into place if corrupted by bad log replay (bsc#1105396) This update also contains the following tracked packaging change: - Explictly disable systemd unit files for scrub (bsc#1105068) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1322=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xfsprogs-4.15.0-lp150.3.4.1 xfsprogs-debuginfo-4.15.0-lp150.3.4.1 xfsprogs-debugsource-4.15.0-lp150.3.4.1 xfsprogs-devel-4.15.0-lp150.3.4.1 References: https://bugzilla.suse.com/1089777 https://bugzilla.suse.com/1105068 https://bugzilla.suse.com/1105396

1 0

openSUSE-OU-2018:3532-1: Optional update for tdb
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Optional Update: Optional update for tdb ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3532-1 Rating: low References: #1109571 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for tdb fixes the following issues: - The package license should have been LGPL (bsc#1109571) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1319=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libtdb-devel-1.3.15-lp150.2.3.1 libtdb1-1.3.15-lp150.2.3.1 libtdb1-debuginfo-1.3.15-lp150.2.3.1 python-tdb-1.3.15-lp150.2.3.1 python-tdb-debuginfo-1.3.15-lp150.2.3.1 python3-tdb-1.3.15-lp150.2.3.1 python3-tdb-debuginfo-1.3.15-lp150.2.3.1 tdb-debugsource-1.3.15-lp150.2.3.1 tdb-tools-1.3.15-lp150.2.3.1 tdb-tools-debuginfo-1.3.15-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libtdb1-32bit-1.3.15-lp150.2.3.1 libtdb1-32bit-debuginfo-1.3.15-lp150.2.3.1 python-tdb-32bit-1.3.15-lp150.2.3.1 python-tdb-32bit-debuginfo-1.3.15-lp150.2.3.1 python3-tdb-32bit-1.3.15-lp150.2.3.1 python3-tdb-32bit-debuginfo-1.3.15-lp150.2.3.1 References: https://bugzilla.suse.com/1109571

1 0

openSUSE-RU-2018:3531-1: moderate: Recommended update for kmod
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for kmod ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3531-1 Rating: moderate References: #1112928 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmod provides the following fixes: - Allow 'modprobe -c' print the status of "allow_unsupported_modules" option. (bsc#1112928) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1321=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): kmod-25-lp150.4.3.1 kmod-compat-25-lp150.4.3.1 kmod-debuginfo-25-lp150.4.3.1 kmod-debugsource-25-lp150.4.3.1 libkmod-devel-25-lp150.4.3.1 libkmod2-25-lp150.4.3.1 libkmod2-debuginfo-25-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): kmod-bash-completion-25-lp150.4.3.1 References: https://bugzilla.suse.com/1112928

1 0

openSUSE-RU-2018:3530-1: moderate: Recommended update for glibc
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3530-1 Rating: moderate References: #1102526 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for glibc fixes the following issues: - Fix build on aarch64 with binutils newer than 2.30. - Fix year 2039 bug for localtime with 64-bit time_t (bsc#1102526) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1318=1 Package List: - openSUSE Leap 15.0 (i586 i686 x86_64): glibc-2.26-lp150.11.9.1 glibc-debuginfo-2.26-lp150.11.9.1 glibc-debugsource-2.26-lp150.11.9.1 glibc-devel-2.26-lp150.11.9.1 glibc-devel-debuginfo-2.26-lp150.11.9.1 glibc-devel-static-2.26-lp150.11.9.1 glibc-locale-2.26-lp150.11.9.1 glibc-locale-debuginfo-2.26-lp150.11.9.1 glibc-profile-2.26-lp150.11.9.1 - openSUSE Leap 15.0 (i586 x86_64): glibc-extra-2.26-lp150.11.9.1 glibc-extra-debuginfo-2.26-lp150.11.9.1 glibc-utils-2.26-lp150.11.9.1 glibc-utils-debuginfo-2.26-lp150.11.9.1 glibc-utils-src-debugsource-2.26-lp150.11.9.1 nscd-2.26-lp150.11.9.1 nscd-debuginfo-2.26-lp150.11.9.1 - openSUSE Leap 15.0 (noarch): glibc-html-2.26-lp150.11.9.1 glibc-i18ndata-2.26-lp150.11.9.1 glibc-info-2.26-lp150.11.9.1 - openSUSE Leap 15.0 (x86_64): glibc-32bit-2.26-lp150.11.9.1 glibc-32bit-debuginfo-2.26-lp150.11.9.1 glibc-devel-32bit-2.26-lp150.11.9.1 glibc-devel-32bit-debuginfo-2.26-lp150.11.9.1 glibc-devel-static-32bit-2.26-lp150.11.9.1 glibc-locale-32bit-2.26-lp150.11.9.1 glibc-locale-32bit-debuginfo-2.26-lp150.11.9.1 glibc-profile-32bit-2.26-lp150.11.9.1 glibc-utils-32bit-2.26-lp150.11.9.1 glibc-utils-32bit-debuginfo-2.26-lp150.11.9.1 References: https://bugzilla.suse.com/1102526

1 0

openSUSE-SU-2018:3529-1: moderate: Security update for lcms2
by opensuse-security＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Security Update: Security update for lcms2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3529-1 Rating: moderate References: #1108813 Cross-References: CVE-2018-16435 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lcms2 fixes the following issues: - CVE-2018-16435: Heap-based buffer overflow via a crafted file in the second argument to cmsIT8LoadFromFile (bsc#1108813) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1327=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): lcms2-2.9-lp150.2.3.1 lcms2-debuginfo-2.9-lp150.2.3.1 lcms2-debugsource-2.9-lp150.2.3.1 liblcms2-2-2.9-lp150.2.3.1 liblcms2-2-debuginfo-2.9-lp150.2.3.1 liblcms2-devel-2.9-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): liblcms2-doc-2.9-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liblcms2-2-32bit-2.9-lp150.2.3.1 liblcms2-2-32bit-debuginfo-2.9-lp150.2.3.1 liblcms2-devel-32bit-2.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16435.html https://bugzilla.suse.com/1108813

1 0

openSUSE-RU-2018:3528-1: moderate: Recommended update for texlive-specs-n
by maintenance＠opensuse.org 27 Oct '18

27 Oct '18

openSUSE Recommended Update: Recommended update for texlive-specs-n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3528-1 Rating: moderate References: #1077170 #1083212 #1094731 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes the following issues with texlive-specs-n: - Port back changes for bsd_glob of latexmk(.pl). (bsc#1094731) - Use font-config macros *with* xorg-x11-fonts-core (for encodings), mkfontdir (ditto), and mkfontscale. (bsc#1083212) - Avoid broken scripts due former env correction, only repair those scripts where the shebang exists . - Switch over to python 3. (bsc#1077170) - Avoid nasty warning about missing batchmode in ENVironment. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1324=1 Package List: - openSUSE Leap 15.0 (noarch): texlive-latex-notes-zh-cn-2017.137.1.20svn15878-lp150.5.3.1 texlive-latex-papersize-2017.137.1.62svn42296-lp150.5.3.1 texlive-latex-papersize-doc-2017.137.1.62svn42296-lp150.5.3.1 texlive-latex-referenz-2017.137.2svn36671-lp150.5.3.1 texlive-latex-tabellen-2017.137.svn16979-lp150.5.3.1 texlive-latex-tds-2017.137.svn40613-lp150.5.3.1 texlive-latex-tds-doc-2017.137.svn40613-lp150.5.3.1 texlive-latex-veryshortguide-2017.137.svn41844-lp150.5.3.1 texlive-latex-web-companion-2017.137.svn29349-lp150.5.3.1 texlive-latex2e-help-texinfo-2017.137.svn38709-lp150.5.3.1 texlive-latex2e-help-texinfo-fr-2017.137.svn42541-lp150.5.3.1 texlive-latex2e-help-texinfo-spanish-2017.137.svn37356-lp150.5.3.1 texlive-latex2man-2017.137.1.25svn43855-lp150.5.3.1 texlive-latex2man-doc-2017.137.1.25svn43855-lp150.5.3.1 texlive-latex2nemeth-2017.137.1.0svn42300-lp150.5.3.1 texlive-latex2nemeth-doc-2017.137.1.0svn42300-lp150.5.3.1 texlive-latex4wp-2017.137.1.0.10svn35999-lp150.5.3.1 texlive-latex4wp-it-2017.137.1.0.10svn36000-lp150.5.3.1 texlive-latexbangla-2017.137.0.0.2svn42409-lp150.5.3.1 texlive-latexbangla-doc-2017.137.0.0.2svn42409-lp150.5.3.1 texlive-latexbug-2017.137.1.0asvn44566-lp150.5.3.1 texlive-latexbug-doc-2017.137.1.0asvn44566-lp150.5.3.1 texlive-latexcheat-2017.137.1.13svn15878-lp150.5.3.1 texlive-latexcheat-de-2017.137.svn35702-lp150.5.3.1 texlive-latexcheat-esmx-2017.137.2.00svn36866-lp150.5.3.1 texlive-latexcheat-ptbr-2017.137.1.13svn15878-lp150.5.3.1 texlive-latexconfig-2017.137.svn40274-lp150.5.3.1 texlive-latexcourse-rug-2017.137.1.1svn39026-lp150.5.3.1 texlive-latexdemo-2017.137.0.0.1svn34481-lp150.5.3.1 texlive-latexdemo-doc-2017.137.0.0.1svn34481-lp150.5.3.1 texlive-latexdiff-2017.137.1.2.0svn41892-lp150.5.3.1 texlive-latexdiff-doc-2017.137.1.2.0svn41892-lp150.5.3.1 texlive-latexfileinfo-pkgs-2017.137.0.0.22svn26760-lp150.5.3.1 texlive-latexfileinfo-pkgs-doc-2017.137.0.0.22svn26760-lp150.5.3.1 texlive-latexfileversion-2017.137.0.0.3svn29349-lp150.5.3.1 texlive-latexfileversion-doc-2017.137.0.0.3svn29349-lp150.5.3.1 texlive-latexgit-2017.137.svn41920-lp150.5.3.1 texlive-latexgit-doc-2017.137.svn41920-lp150.5.3.1 texlive-latexindent-2017.137.3.1svn44492-lp150.5.3.1 texlive-latexindent-doc-2017.137.3.1svn44492-lp150.5.3.1 texlive-latexmk-2017.137.4.52csvn43099-lp150.5.3.1 texlive-latexmk-doc-2017.137.4.52csvn43099-lp150.5.3.1 texlive-latexmp-2017.137.1.2.1svn15878-lp150.5.3.1 texlive-latexmp-doc-2017.137.1.2.1svn15878-lp150.5.3.1 texlive-latexpand-2017.137.1.3svn41873-lp150.5.3.1 texlive-latexpand-doc-2017.137.1.3svn41873-lp150.5.3.1 texlive-lato-2017.137.2.2svn24986-lp150.5.3.1 texlive-lato-doc-2017.137.2.2svn24986-lp150.5.3.1 texlive-lato-fonts-2017.137.2.2svn24986-lp150.5.3.1 texlive-layaureo-2017.137.0.0.2svn19087-lp150.5.3.1 texlive-layaureo-doc-2017.137.0.0.2svn19087-lp150.5.3.1 texlive-layouts-2017.137.2.6dsvn42428-lp150.5.3.1 texlive-layouts-doc-2017.137.2.6dsvn42428-lp150.5.3.1 texlive-lazylist-2017.137.1.0asvn17691-lp150.5.3.1 texlive-lazylist-doc-2017.137.1.0asvn17691-lp150.5.3.1 texlive-lcd-2017.137.0.0.3svn16549-lp150.5.3.1 texlive-lcd-doc-2017.137.0.0.3svn16549-lp150.5.3.1 texlive-lcdftypetools-2017.137.svn44166-lp150.5.3.1 texlive-lcg-2017.137.1.3svn31474-lp150.5.3.1 texlive-lcg-doc-2017.137.1.3svn31474-lp150.5.3.1 texlive-lcyw-2017.137.1.1svn15878-lp150.5.3.1 texlive-lcyw-doc-2017.137.1.1svn15878-lp150.5.3.1 texlive-leading-2017.137.0.0.3svn15878-lp150.5.3.1 texlive-leading-doc-2017.137.0.0.3svn15878-lp150.5.3.1 texlive-leadsheets-2017.137.0.0.5asvn43034-lp150.5.3.1 texlive-leadsheets-doc-2017.137.0.0.5asvn43034-lp150.5.3.1 texlive-leaflet-2017.137.1.1bsvn43523-lp150.5.3.1 texlive-leaflet-doc-2017.137.1.1bsvn43523-lp150.5.3.1 texlive-lecturer-2017.137.svn23916-lp150.5.3.1 texlive-lecturer-doc-2017.137.svn23916-lp150.5.3.1 texlive-ledmac-2017.137.0.0.19.4svn41811-lp150.5.3.1 texlive-ledmac-doc-2017.137.0.0.19.4svn41811-lp150.5.3.1 texlive-leftidx-2017.137.svn15878-lp150.5.3.1 texlive-leftidx-doc-2017.137.svn15878-lp150.5.3.1 texlive-leipzig-2017.137.1.1svn34902-lp150.5.3.1 texlive-leipzig-doc-2017.137.1.1svn34902-lp150.5.3.1 texlive-lengthconvert-2017.137.1.0asvn30867-lp150.5.3.1 texlive-lengthconvert-doc-2017.137.1.0asvn30867-lp150.5.3.1 texlive-lettre-2017.137.2.353svn35145-lp150.5.3.1 texlive-lettre-doc-2017.137.2.353svn35145-lp150.5.3.1 texlive-lettrine-2017.137.1.9svn38268-lp150.5.3.1 texlive-lettrine-doc-2017.137.1.9svn38268-lp150.5.3.1 texlive-levy-2017.137.svn21750-lp150.5.3.1 texlive-levy-doc-2017.137.svn21750-lp150.5.3.1 texlive-lewis-2017.137.0.0.1svn15878-lp150.5.3.1 texlive-lewis-doc-2017.137.0.0.1svn15878-lp150.5.3.1 texlive-lexikon-2017.137.1.0csvn17364-lp150.5.3.1 texlive-lexikon-doc-2017.137.1.0csvn17364-lp150.5.3.1 texlive-lexref-2017.137.1.1asvn36026-lp150.5.3.1 texlive-lexref-doc-2017.137.1.1asvn36026-lp150.5.3.1 texlive-lfb-2017.137.1.0svn15878-lp150.5.3.1 texlive-lfb-doc-2017.137.1.0svn15878-lp150.5.3.1 texlive-lgreek-2017.137.svn21818-lp150.5.3.1 texlive-lgreek-doc-2017.137.svn21818-lp150.5.3.1 texlive-lh-2017.137.3.5gsvn15878-lp150.5.3.1 texlive-lh-doc-2017.137.3.5gsvn15878-lp150.5.3.1 texlive-lhcyr-2017.137.svn31795-lp150.5.3.1 texlive-lhelp-2017.137.2.0svn23638-lp150.5.3.1 texlive-lhelp-doc-2017.137.2.0svn23638-lp150.5.3.1 texlive-libertine-2017.137.5.3.0svn43603-lp150.5.3.1 texlive-libertine-doc-2017.137.5.3.0svn43603-lp150.5.3.1 texlive-libertine-fonts-2017.137.5.3.0svn43603-lp150.5.3.1 texlive-libertinegc-2017.137.1.00svn39746-lp150.5.3.1 texlive-libertinegc-doc-2017.137.1.00svn39746-lp150.5.3.1 texlive-libertinus-2017.137.6.4svn44409-lp150.5.3.1 texlive-libertinus-doc-2017.137.6.4svn44409-lp150.5.3.1 texlive-libertinus-fonts-2017.137.6.4svn44409-lp150.5.3.1 texlive-libertinust1math-2017.137.1.0.4svn44542-lp150.5.3.1 texlive-libertinust1math-doc-2017.137.1.0.4svn44542-lp150.5.3.1 texlive-libertinust1math-fonts-2017.137.1.0.4svn44542-lp150.5.3.1 texlive-libgreek-2017.137.1.0svn27789-lp150.5.3.1 texlive-libgreek-doc-2017.137.1.0svn27789-lp150.5.3.1 texlive-librarian-2017.137.1.0svn19880-lp150.5.3.1 texlive-librarian-doc-2017.137.1.0svn19880-lp150.5.3.1 texlive-librebaskerville-2017.137.svn31741-lp150.5.3.1 texlive-librebaskerville-doc-2017.137.svn31741-lp150.5.3.1 texlive-librebaskerville-fonts-2017.137.svn31741-lp150.5.3.1 texlive-librebodoni-2017.137.svn39375-lp150.5.3.1 texlive-librebodoni-doc-2017.137.svn39375-lp150.5.3.1 texlive-librebodoni-fonts-2017.137.svn39375-lp150.5.3.1 texlive-librecaslon-2017.137.svn31929-lp150.5.3.1 texlive-librecaslon-doc-2017.137.svn31929-lp150.5.3.1 texlive-librecaslon-fonts-2017.137.svn31929-lp150.5.3.1 texlive-libris-2017.137.1.007svn19409-lp150.5.3.1 texlive-libris-doc-2017.137.1.007svn19409-lp150.5.3.1 texlive-libris-fonts-2017.137.1.007svn19409-lp150.5.3.1 texlive-lilyglyphs-2017.137.0.0.2.3svn33164-lp150.5.3.1 texlive-lilyglyphs-doc-2017.137.0.0.2.3svn33164-lp150.5.3.1 texlive-lilyglyphs-fonts-2017.137.0.0.2.3svn33164-lp150.5.3.1 texlive-limap-2017.137.2.1svn41390-lp150.5.3.1 texlive-limap-doc-2017.137.2.1svn41390-lp150.5.3.1 texlive-linearA-2017.137.svn15878-lp150.5.3.1 texlive-linearA-doc-2017.137.svn15878-lp150.5.3.1 texlive-linearA-fonts-2017.137.svn15878-lp150.5.3.1 texlive-linegoal-2017.137.2.9svn21523-lp150.5.3.1 texlive-linegoal-doc-2017.137.2.9svn21523-lp150.5.3.1 texlive-lineno-2017.137.4.41svn21442-lp150.5.3.1 texlive-lineno-doc-2017.137.4.41svn21442-lp150.5.3.1 texlive-ling-macros-2017.137.svn42268-lp150.5.3.1 texlive-ling-macros-doc-2017.137.svn42268-lp150.5.3.1 texlive-linguex-2017.137.4.3svn30815-lp150.5.3.1 texlive-linguex-doc-2017.137.4.3svn30815-lp150.5.3.1 texlive-linop-2017.137.0.0.1svn41304-lp150.5.3.1 texlive-linop-doc-2017.137.0.0.1svn41304-lp150.5.3.1 texlive-lion-msc-2017.137.0.0.27svn44131-lp150.5.3.1 texlive-lion-msc-doc-2017.137.0.0.27svn44131-lp150.5.3.1 texlive-lipsum-2017.137.1.3svn34800-lp150.5.3.1 texlive-lipsum-doc-2017.137.1.3svn34800-lp150.5.3.1 texlive-lisp-on-tex-2017.137.2.0svn38722-lp150.5.3.1 texlive-lisp-on-tex-doc-2017.137.2.0svn38722-lp150.5.3.1 texlive-listbib-2017.137.2.2svn29349-lp150.5.3.1 texlive-listbib-doc-2017.137.2.2svn29349-lp150.5.3.1 texlive-listing-2017.137.1.2svn17373-lp150.5.3.1 texlive-listing-doc-2017.137.1.2svn17373-lp150.5.3.1 texlive-listings-2017.137.1.6svn37534-lp150.5.3.1 texlive-listings-doc-2017.137.1.6svn37534-lp150.5.3.1 texlive-listings-ext-2017.137.67svn29349-lp150.5.3.1 texlive-listings-ext-doc-2017.137.67svn29349-lp150.5.3.1 texlive-listlbls-2017.137.1.03svn34893-lp150.5.3.1 texlive-listlbls-doc-2017.137.1.03svn34893-lp150.5.3.1 texlive-listliketab-2017.137.svn15878-lp150.5.3.1 texlive-listliketab-doc-2017.137.svn15878-lp150.5.3.1 texlive-listofitems-2017.137.1.3svn42530-lp150.5.3.1 texlive-listofitems-doc-2017.137.1.3svn42530-lp150.5.3.1 texlive-listofsymbols-2017.137.0.0.2svn16134-lp150.5.3.1 texlive-listofsymbols-doc-2017.137.0.0.2svn16134-lp150.5.3.1 texlive-lithuanian-2017.137.svn22722-lp150.5.3.1 texlive-lithuanian-doc-2017.137.svn22722-lp150.5.3.1 texlive-liturg-2017.137.1.0svn15878-lp150.5.3.1 texlive-liturg-doc-2017.137.1.0svn15878-lp150.5.3.1 texlive-lkproof-2017.137.3.1svn20021-lp150.5.3.1 texlive-lkproof-doc-2017.137.3.1svn20021-lp150.5.3.1 texlive-lm-2017.137.2.004svn28119-lp150.5.3.1 texlive-lm-doc-2017.137.2.004svn28119-lp150.5.3.1 texlive-lm-fonts-2017.137.2.004svn28119-lp150.5.3.1 texlive-lm-math-2017.137.1.959svn36915-lp150.5.3.1 texlive-lm-math-doc-2017.137.1.959svn36915-lp150.5.3.1 texlive-lm-math-fonts-2017.137.1.959svn36915-lp150.5.3.1 texlive-lmake-2017.137.1.0svn25552-lp150.5.3.1 texlive-lmake-doc-2017.137.1.0svn25552-lp150.5.3.1 texlive-lni-2017.137.1.3svn44368-lp150.5.3.1 texlive-lni-doc-2017.137.1.3svn44368-lp150.5.3.1 texlive-lobster2-2017.137.svn32617-lp150.5.3.1 texlive-lobster2-doc-2017.137.svn32617-lp150.5.3.1 texlive-lobster2-fonts-2017.137.svn32617-lp150.5.3.1 texlive-locality-2017.137.0.0.2svn20422-lp150.5.3.1 texlive-locality-doc-2017.137.0.0.2svn20422-lp150.5.3.1 texlive-localloc-2017.137.svn21934-lp150.5.3.1 texlive-localloc-doc-2017.137.svn21934-lp150.5.3.1 texlive-logbox-2017.137.1.0svn24499-lp150.5.3.1 texlive-logbox-doc-2017.137.1.0svn24499-lp150.5.3.1 texlive-logical-markup-utils-2017.137.svn15878-lp150.5.3.1 texlive-logical-markup-utils-doc-2017.137.svn15878-lp150.5.3.1 texlive-logicproof-2017.137.svn33254-lp150.5.3.1 texlive-logicproof-doc-2017.137.svn33254-lp150.5.3.1 texlive-logicpuzzle-2017.137.2.5svn34491-lp150.5.3.1 texlive-logicpuzzle-doc-2017.137.2.5svn34491-lp150.5.3.1 texlive-logpap-2017.137.0.0.6svn15878-lp150.5.3.1 texlive-logpap-doc-2017.137.0.0.6svn15878-lp150.5.3.1 texlive-logreq-2017.137.1.0svn19640-lp150.5.3.1 texlive-logreq-doc-2017.137.1.0svn19640-lp150.5.3.1 texlive-lollipop-2017.137.1.07svn41438-lp150.5.3.1 texlive-lollipop-doc-2017.137.1.07svn41438-lp150.5.3.1 texlive-longdivision-2017.137.1.0svn43159-lp150.5.3.1 texlive-longdivision-doc-2017.137.1.0svn43159-lp150.5.3.1 texlive-longfbox-2017.137.1.0svn39028-lp150.5.3.1 texlive-longfbox-doc-2017.137.1.0svn39028-lp150.5.3.1 texlive-longfigure-2017.137.1.0svn34302-lp150.5.3.1 texlive-longfigure-doc-2017.137.1.0svn34302-lp150.5.3.1 texlive-longnamefilelist-2017.137.0.0.2svn27889-lp150.5.3.1 texlive-longnamefilelist-doc-2017.137.0.0.2svn27889-lp150.5.3.1 texlive-loops-2017.137.1.3svn30704-lp150.5.3.1 texlive-loops-doc-2017.137.1.3svn30704-lp150.5.3.1 texlive-lpform-2017.137.svn36918-lp150.5.3.1 texlive-lpform-doc-2017.137.svn36918-lp150.5.3.1 texlive-lpic-2017.137.0.0.8svn20843-lp150.5.3.1 texlive-lpic-doc-2017.137.0.0.8svn20843-lp150.5.3.1 texlive-lplfitch-2017.137.0.0.9svn31077-lp150.5.3.1 texlive-lplfitch-doc-2017.137.0.0.9svn31077-lp150.5.3.1 texlive-lps-2017.137.0.0.7svn21322-lp150.5.3.1 texlive-lps-doc-2017.137.0.0.7svn21322-lp150.5.3.1 texlive-lroundrect-2017.137.1.0svn39804-lp150.5.3.1 texlive-lroundrect-doc-2017.137.1.0svn39804-lp150.5.3.1 texlive-lsc-2017.137.svn15878-lp150.5.3.1 texlive-lsc-doc-2017.137.svn15878-lp150.5.3.1 texlive-lshort-bulgarian-2017.137.svn15878-lp150.5.3.1 texlive-lshort-chinese-2017.137.5.10svn43606-lp150.5.3.1 texlive-lshort-czech-2017.137.4.27svn29803-lp150.5.3.1 texlive-lshort-dutch-2017.137.1.3svn15878-lp150.5.3.1 texlive-lshort-english-2017.137.5.0.5svn37892-lp150.5.3.1 texlive-lshort-estonian-2017.137.5.05svn39323-lp150.5.3.1 texlive-lshort-finnish-2017.137.svn15878-lp150.5.3.1 texlive-lshort-french-2017.137.5.01fr_0svn23332-lp150.5.3.1 texlive-lshort-german-2017.137.3.0bsvn42434-lp150.5.3.1 References: https://bugzilla.suse.com/1077170 https://bugzilla.suse.com/1083212 https://bugzilla.suse.com/1094731

1 0

openSUSE-SU-2018:3527-1: Security update for hostapd
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for hostapd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3527-1 Rating: low References: #1104205 Cross-References: CVE-2018-14526 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: hostapd was updated to fix following security issue: - CVE-2018-14526: Ignore unauthenticated encrypted EAPOL-Key data (bsc#1104205) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1293=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1293=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1293=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): hostapd-2.6-11.1 hostapd-debuginfo-2.6-11.1 hostapd-debugsource-2.6-11.1 - openSUSE Leap 15.0 (x86_64): hostapd-2.6-lp150.2.3.2 hostapd-debuginfo-2.6-lp150.2.3.2 hostapd-debugsource-2.6-lp150.2.3.2 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): hostapd-2.6-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-14526.html https://bugzilla.suse.com/1104205

1 0

openSUSE-RU-2018:3526-1: moderate: Recommended update for yast2-nfs-client
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for yast2-nfs-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3526-1 Rating: moderate References: #1105674 #1110093 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-nfs-client fixes the following issues: - The YaST2 NFS Client module may have crashed (bsc#1105674, bsc#1110093) - Added additional searchkeys to desktop file (fate#321043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1306=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-nfs-client-4.0.8-lp150.2.6.1 References: https://bugzilla.suse.com/1105674 https://bugzilla.suse.com/1110093

1 0

openSUSE-RU-2018:3525-1: moderate: Recommended update for libzypp
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for libzypp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3525-1 Rating: moderate References: #1099982 #1109877 #408814 #556664 #939392 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for libzypp fixes the following issues: - Add filesize check for downloads with known size (bsc#408814) - Fix conversion of string and glob to regex when compiling queries (bsc#1099982, bsc#939392, bsc#556664) - Fix blocking wait for finished child process (bsc#1109877) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1304=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libzypp-16.19.0-30.1 libzypp-debuginfo-16.19.0-30.1 libzypp-debugsource-16.19.0-30.1 libzypp-devel-16.19.0-30.1 libzypp-devel-doc-16.19.0-30.1 References: https://bugzilla.suse.com/1099982 https://bugzilla.suse.com/1109877 https://bugzilla.suse.com/408814 https://bugzilla.suse.com/556664 https://bugzilla.suse.com/939392

1 0

openSUSE-SU-2018:3524-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3524-1 Rating: moderate References: #1107609 #1112399 Cross-References: CVE-2017-14997 CVE-2018-16644 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2017-14997: GraphicsMagick allowed remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. [bsc#1112399] - CVE-2018-16644: An regression in the security fix for the pict coder was fixed (bsc#1107609) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1312=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-76.1 ImageMagick-debuginfo-6.8.8.1-76.1 ImageMagick-debugsource-6.8.8.1-76.1 ImageMagick-devel-6.8.8.1-76.1 ImageMagick-extra-6.8.8.1-76.1 ImageMagick-extra-debuginfo-6.8.8.1-76.1 libMagick++-6_Q16-3-6.8.8.1-76.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-76.1 libMagick++-devel-6.8.8.1-76.1 libMagickCore-6_Q16-1-6.8.8.1-76.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-76.1 libMagickWand-6_Q16-1-6.8.8.1-76.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-76.1 perl-PerlMagick-6.8.8.1-76.1 perl-PerlMagick-debuginfo-6.8.8.1-76.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-76.1 libMagick++-6_Q16-3-32bit-6.8.8.1-76.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-76.1 libMagick++-devel-32bit-6.8.8.1-76.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-76.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-76.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-76.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-76.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-76.1 References: https://www.suse.com/security/cve/CVE-2017-14997.html https://www.suse.com/security/cve/CVE-2018-16644.html https://bugzilla.suse.com/1107609 https://bugzilla.suse.com/1112399

1 0

openSUSE-RU-2018:3523-1: moderate: Recommended update for yast2-packager
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3523-1 Rating: moderate References: #1073696 #926841 #991090 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2-packager provides the following fixes: - Do not display a false "not enough free space" warning popup if the free space is bigger than 8EiB (2^63). (bsc#991090) - Do not display the "not enough free space" warning for partitions where nothing is going to be installed. (bsc#926841) - Check the parent directory if the target directory does not exist. (bsc#1073696) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1300=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-packager-3.2.26.1-9.1 References: https://bugzilla.suse.com/1073696 https://bugzilla.suse.com/926841 https://bugzilla.suse.com/991090

1 0

openSUSE-RU-2018:3522-1: moderate: Recommended update for libyui-ncurses-pkg
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for libyui-ncurses-pkg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3522-1 Rating: moderate References: #991090 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libyui-ncurses-pkg provides the following fixes: - Do not display "out of disk space" error at start when such a large disk (bigger than 8EiB) is present in the system. (bsc#991090) - Fix displaying negative disk sizes in the disk usage dialog. (bsc#991090) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1308=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libyui-ncurses-pkg-debugsource-2.48.4.1-5.3.1 libyui-ncurses-pkg-devel-2.48.4.1-5.3.1 libyui-ncurses-pkg7-2.48.4.1-5.3.1 libyui-ncurses-pkg7-debuginfo-2.48.4.1-5.3.1 - openSUSE Leap 42.3 (noarch): libyui-ncurses-pkg-doc-2.48.4.1-5.3.1 References: https://bugzilla.suse.com/991090

1 0

openSUSE-RU-2018:3521-1: moderate: Recommended update for yast2-bootloader and rubygem-cfa_grub2
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for yast2-bootloader and rubygem-cfa_grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3521-1 Rating: moderate References: #1053559 #1089829 #1094031 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update addresses some bugs for yast2-bootloader and rubygem-cfa_grub2: yast2-bootloader: - Fixed crash while reading grub settings from installed system (bsc#1094031) - Fix an internal error when GRUB_TERMINAL contains multiple values (bsc#1053559) - Added additional searchkeys to desktop file (fate#321043) - Does no longer crash when required package is not installed (bsc#1089829) rubygem-cfa_grub2: - cfa_grub2 can now handle multiple values for GRUB_TERMINAL. This is required by yast2-bootloader to work properly (bsc#1053559) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1301=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ruby2.5-rubygem-cfa_grub2-1.0.1-lp150.2.3.1 ruby2.5-rubygem-cfa_grub2-doc-1.0.1-lp150.2.3.1 yast2-bootloader-4.0.39-lp150.2.8.1 References: https://bugzilla.suse.com/1053559 https://bugzilla.suse.com/1089829 https://bugzilla.suse.com/1094031

1 0

openSUSE-RU-2018:3520-1: moderate: Recommended update for timezone, timezone-java
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for timezone, timezone-java ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3520-1 Rating: moderate References: #1104700 #1112310 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for timezone, timezone-java fixes the following issues: The timezone database was updated to 2018f: - Volgograd moves from +03 to +04 on 2018-10-28. - Fiji ends DST 2019-01-13, not 2019-01-20. - Most of Chile changes DST dates, effective 2019-04-06 (bsc#1104700) - Corrections to past timestamps of DST transitions - Use "PST" and "PDT" for Philippine time - minor code changes to zic handling of the TZif format - documentation updates Other bugfixes: - Fixed a zic problem with the 1948-1951 DST transition in Japan (bsc#1112310) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1298=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): timezone-2018f-lp150.2.9.1 timezone-debuginfo-2018f-lp150.2.9.1 timezone-debugsource-2018f-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): timezone-java-2018f-lp150.2.9.1 References: https://bugzilla.suse.com/1104700 https://bugzilla.suse.com/1112310

1 0

openSUSE-SU-2018:3519-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3519-1 Rating: moderate References: #1085256 #1095219 #1100612 #1100613 #1104641 Cross-References: CVE-2018-10887 CVE-2018-10888 CVE-2018-11235 CVE-2018-15501 CVE-2018-8099 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgit2 fixes the following issues: - CVE-2018-8099: Fixed possible denial of service attack via different vectors by not being able to differentiate between these status codes (bsc#1085256). - CVE-2018-11235: With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. (bsc#1095219) - CVE-2018-10887: It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may have lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker could have used this flaw to leak memory addresses or cause a Denial of Service. (bsc#1100613) - CVE-2018-10888: A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service. (bsc#1100612) - CVE-2018-15501: A remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS. (bsc#1104641) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1314=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgit2-24-0.24.1-10.3.1 libgit2-24-debuginfo-0.24.1-10.3.1 libgit2-debugsource-0.24.1-10.3.1 libgit2-devel-0.24.1-10.3.1 - openSUSE Leap 42.3 (x86_64): libgit2-24-32bit-0.24.1-10.3.1 libgit2-24-debuginfo-32bit-0.24.1-10.3.1 References: https://www.suse.com/security/cve/CVE-2018-10887.html https://www.suse.com/security/cve/CVE-2018-10888.html https://www.suse.com/security/cve/CVE-2018-11235.html https://www.suse.com/security/cve/CVE-2018-15501.html https://www.suse.com/security/cve/CVE-2018-8099.html https://bugzilla.suse.com/1085256 https://bugzilla.suse.com/1095219 https://bugzilla.suse.com/1100612 https://bugzilla.suse.com/1100613 https://bugzilla.suse.com/1104641

1 0

openSUSE-RU-2018:3518-1: Recommended update for Regina-REXX, THE, ooRexx
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for Regina-REXX, THE, ooRexx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3518-1 Rating: low References: #1012847 #1017668 #1083875 #985384 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for Regina-REXX, THE, ooRexx fixes the following issues: * Allow alternative Rexx (ooRexx and Regina-REXX) implementations to be installed in parallel (boo#1083875) * Do not ship any preset file in ooRexx (boo#1012847) * Leftower process running at end of build of ooRexx (boo#1017668) * Fix building of ooRexx gcc6 and later (boo#985384) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1294=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): Regina-REXX-3.9.1-5.2 Regina-REXX-devel-3.9.1-5.2 Regina-REXX-doc-3.9.1-5.2 libregina3-3.9.1-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x): Regina-REXX-3.9.1-5.1 Regina-REXX-devel-3.9.1-5.1 Regina-REXX-doc-3.9.1-5.1 libregina3-3.9.1-5.1 References: https://bugzilla.suse.com/1012847 https://bugzilla.suse.com/1017668 https://bugzilla.suse.com/1083875 https://bugzilla.suse.com/985384

1 0

openSUSE-SU-2018:3517-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3517-1 Rating: moderate References: #1110899 Cross-References: CVE-2018-17983 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mercurial fixes the following issues: - CVE-2018-17983: Fix an out-of-bounds read during parsing of a malformed manifest entry (bsc#1110899). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1297=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): mercurial-4.5.2-lp150.2.6.1 mercurial-debuginfo-4.5.2-lp150.2.6.1 mercurial-debugsource-4.5.2-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): mercurial-lang-4.5.2-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-17983.html https://bugzilla.suse.com/1110899

1 0

openSUSE-RU-2018:3516-1: moderate: Recommended update for python-pyOpenSSL
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for python-pyOpenSSL ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3516-1 Rating: moderate References: #1110435 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-pyOpenSSL fixes the following issues: - Handle duplicate certificate addition using X509_STORE_add_cert so it works after upgrading to openssl 1.1.1. (bsc#1110435) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1311=1 Package List: - openSUSE Leap 15.0 (noarch): python-pyOpenSSL-doc-17.5.0-lp150.2.3.1 python2-pyOpenSSL-17.5.0-lp150.2.3.1 python3-pyOpenSSL-17.5.0-lp150.2.3.1 References: https://bugzilla.suse.com/1110435

1 0

openSUSE-RU-2018:3515-1: Recommended update for yast2-core
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for yast2-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3515-1 Rating: low References: #1103076 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-core fixes the following issues: - Reduced risk of race condition between getenv and setenv while logging (bsc#1103076) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1295=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-core-3.2.3-7.3.1 yast2-core-debuginfo-3.2.3-7.3.1 yast2-core-debugsource-3.2.3-7.3.1 yast2-core-devel-3.2.3-7.3.1 References: https://bugzilla.suse.com/1103076

1 0

openSUSE-RU-2018:3514-1: moderate: Recommended update for a2ps
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for a2ps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3514-1 Rating: moderate References: #1112014 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for a2ps fixes the following issues: - Make a2ps handle inode numbers larger than 32bit (bsc#1112014) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1299=1 Package List: - openSUSE Leap 42.3 (x86_64): a2ps-4.14-5.3.1 a2ps-debuginfo-4.14-5.3.1 a2ps-debugsource-4.14-5.3.1 a2ps-devel-4.14-5.3.1 References: https://bugzilla.suse.com/1112014

1 0

openSUSE-RU-2018:3513-1: moderate: Recommended update for python-msrestazure and it's dependencies
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for python-msrestazure and it's dependencies ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3513-1 Rating: moderate References: #1109694 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-adal, python-isodate, python-msrest, python-msrestazure fixes the following issues: python-msrestazure: - Update to version 0.5.0 + Features * Implementation is now using ADAL and not request-oauthlib. This allows more AD scenarios (like federated). * Add additionalInfo parsing for CloudError. * Implement new LRO options of Autorest. * Improve MSI for VM token polling algorithm. * MSIAuthentication now uses IMDS endpoint if available. * MSIAuthentication can be used in any environment that defines MSI_ENDPOINT env variable. * CloudError now includes the "innererror" attribute to match OData v4. * Introduces ARMPolling implementation of Azure Resource Management LRO. * Add support for WebApp/Functions in MSIAuthentication classes. * Add parse_resource_id(), resource_id(), validate_resource_id() to parse ARM ids. * Retry strategy now n reach 24 seconds (instead of 12 seconds). * Add Managed Service Integrated (MSI) authentication. * Add "timeout" to ServicePrincipalCredentials and UserPasswordCredentials. * Threads created by AzureOperationPoller have now a name prefixed by "AzureOperationPoller" to help identify them. * Improve MSIAuthentication to support User Assigned Identity. + Bugfixes * MSIAuthentication regression for KeyVault since IMDS support. * MSIAuthentication should initialize the token attribute on creation. * Fixes refreshToken in UserPassCredentials and AADTokenCredentials. * Fix US government cloud definition. * Reduce max MSI polling time for VM. * IMDS/MSI: Retry on more error codes. * IMDS/MSI: Fix a boundary case on timeout. * Fix parse_resource_id() tool to be case*insensitive to keywords when matching. * Add missing baseclass init call for AdalAuthentication. * Fix LRO result if POST uses AsyncOperation header. * Remove a possible infinite loop with MSIAuthentication. * Fix session obj for cloudmetadata endpoint. * Fix authentication resource node for AzureSatck. * Better detection of AppService with MSIAuthentication. * get_cloud_from_metadata_endpoint incorrect on AzureStack. * get_cloud_from_metadata_endpoint certificate issue. * Fix AttributeError if error JSON from ARM does not follow ODatav4 (as it should). * Fix AttributeError if input JSON is not a dict. * Fix AdalError handling in some scenarios. * Update Azure Gov login endpoint. * Update metadata ARM endpoint parser. + Incompatible changes * Remove unused auth_uri, state, client and token_uri attributes in ServicePrincipalCredentials, UserPassCredentials and AADTokenCredentials. * Remove token caching based on "keyring". Token caching should be implemented using ADAL now. * Remove InteractiveCredentials. This class was deprecated and unusable. Use ADAL device code instead. python-msrest - Update to version 0.5.0 + Require python-enum32 and python-typing. + Features * Support additionalProperties and XML. * Deserialize/from_dict now accepts a content*type parameter to parse XML strings. * Add XML support * Add many type hints, and MyPY testing on CI. * HTTP calls are made through a HTTPDriver API. Only implementation is `requests` for now. This driver API is *not* considered stable and you should pin your msrest version if you want to provide a personal implementation. * msrest is now able to keep the "requests.Session" alive for performance. * All Authentication classes now define `signed_session` and `refresh_session` with an optional `session` parameter. * Disable HTTP log by default (security), add `enable_http_log` to restore it. * Add TopicCredentials for EventGrid client. * Add LROPoller class. This is a customizable LRO engine. * Model now accept kwargs in constructor for future kwargs models. * Add support for additional_properties. * The interpretation of Swagger 2.0 "discriminator" is now lenient. * Add ApiKeyCredentials class. This can be used to support OpenAPI ApiKey feature. * Add CognitiveServicesAuthentication class. Pre*declared ApiKeyCredentials class for Cognitive Services. * Add Configuration.session_configuration_callback to customize the requests.Session if necessary. * Add a flag to Serializer to disable client*side*validation. * Remove "import requests" from "exceptions.py" for apps that require fast loading time. * Input is now more lenient. * Model have a "validate" method to check content constraints. * Model have now new methods for serialize, as_dict, deserialize and from_dict. + Bugfixes * Fix a serialization issue if additional_properties is declared, and "automatic model" syntax is used ("automatic model" being the ability to pass a dict to command and have the model auto*created). * Better parse empty node and not string types. * Improve "object" XML parsing. * Fix some XML serialization subtle scenarios. * Fix some complex XML Swagger definitions. * Lower Accept header overwrite logging message. * Fix 'object' type and XML format. * Incorrect milliseconds serialization for some datetime object. * Improve `SDKClient.__exit__` to take exc_details as optional parameters and not required. * Refresh_session should also use the permanent HTTP session if available. * Fix incorrect date parsing if ms precision is over 6 digits. * Fix minimal dependency of isodate. * Fix serialisation from dict if datetime provided. * Date parsing is now compliant with Autorest / Swagger 2.0 specification (less lenient). * Accept to deserialize enum of different type if content string match. * Stop failing on deserialization if enum string is unkwon. Return the string instead. * Do not validate additional_properties. * Improve validation error if expected type is dict, but actual type is not. * Fix additional_properties if Swagger was flatten. * Optional formdata parameters were raising an exception. * "application/x*www*form*urlencoded" form was sent using "multipart/form*data". * Fix regression: accept "set<str>" as a valid "[str]" * Always log response body. * Improved exception message if error JSON is Odata v4. * Refuse "str" as a valid "[str]" type. * Better exception handling if input from server is not JSON valid. * Fix regression introduced in msrest 0.4.12 * dict syntax with enum modeled as string and enum used. * Fix regression introduced in msrest 0.4.12 * dict syntax using isodate.Duration. * Better Enum checking. + Internal optimisation * Call that does not return a streamable object are now executed in requests stream mode False (was True whatever the type of the call). This should reduce the number of leaked opened session and allow urllib3 to manage connection pooling more efficiently. Only clients generated with Autorest.Python >= 2.1.31 (not impacted otherwise, fully backward compatible) + Deprecation * Trigger DeprecationWarning for _client.add_header and _client.send_formdata. python-adal - Update to version 1.0.2 python-isodate - Update to version 0.6.0 + Support incomplete month date. + Rely on duck typing when doing duration maths. + Support ':' as separator in fractional time zones. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1315=1 Package List: - openSUSE Leap 15.0 (noarch): python2-adal-1.0.2-lp150.3.3.1 python2-isodate-0.6.0-lp150.2.3.1 python2-msrest-0.5.5-lp150.3.3.1 python2-msrestazure-0.5.0-lp150.3.3.1 python3-adal-1.0.2-lp150.3.3.1 python3-isodate-0.6.0-lp150.2.3.1 python3-msrest-0.5.5-lp150.3.3.1 python3-msrestazure-0.5.0-lp150.3.3.1 References: https://bugzilla.suse.com/1109694

1 0

openSUSE-RU-2018:3512-1: moderate: Recommended update for libyui-qt-pkg
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for libyui-qt-pkg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3512-1 Rating: moderate References: #991090 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libyui-qt-pkg provides the following fixes: - Do not display "out of disk space" error at start when such a large disk (bigger than 8EiB) is present in the system. (bsc#991090) - Fix displaying negative disk sizes in the disk usage dialog. (bsc#991090) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1309=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libyui-qt-pkg-debugsource-2.45.13.1-2.3.1 libyui-qt-pkg-devel-2.45.13.1-2.3.1 libyui-qt-pkg7-2.45.13.1-2.3.1 libyui-qt-pkg7-debuginfo-2.45.13.1-2.3.1 - openSUSE Leap 42.3 (noarch): libyui-qt-pkg-doc-2.45.13.1-2.3.1 References: https://bugzilla.suse.com/991090

1 0

openSUSE-RU-2018:3511-1: Recommended update for rsync
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3511-1 Rating: low References: #1083017 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rsync provides the following fix: - Do not send useless keepalive messages to sender if the file list is still being sent. This may cause a crash in older versions of rsync. (bsc#1083017) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1296=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): rsync-3.1.0-16.1 rsync-debuginfo-3.1.0-16.1 rsync-debugsource-3.1.0-16.1 References: https://bugzilla.suse.com/1083017

1 0

openSUSE-OU-2018:3510-1: moderate: Optional update for ldb
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Optional Update: Optional update for ldb ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3510-1 Rating: moderate References: #1108164 #1109571 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two optional fixes can now be installed. Description: This update for ldb addresses issues that a visible - Spec file directives related to python-talloc-devel caused build failures (bsc#1108164) - The package license should have been LGPL 3.0 (bsc#1109571) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1305=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ldb-debugsource-1.2.3-lp150.2.3.1 ldb-tools-1.2.3-lp150.2.3.1 ldb-tools-debuginfo-1.2.3-lp150.2.3.1 libldb-devel-1.2.3-lp150.2.3.1 libldb1-1.2.3-lp150.2.3.1 libldb1-debuginfo-1.2.3-lp150.2.3.1 python-ldb-1.2.3-lp150.2.3.1 python-ldb-debuginfo-1.2.3-lp150.2.3.1 python-ldb-devel-1.2.3-lp150.2.3.1 python3-ldb-1.2.3-lp150.2.3.1 python3-ldb-debuginfo-1.2.3-lp150.2.3.1 python3-ldb-devel-1.2.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libldb1-32bit-1.2.3-lp150.2.3.1 libldb1-32bit-debuginfo-1.2.3-lp150.2.3.1 python-ldb-32bit-1.2.3-lp150.2.3.1 python-ldb-32bit-debuginfo-1.2.3-lp150.2.3.1 python3-ldb-32bit-1.2.3-lp150.2.3.1 python3-ldb-32bit-debuginfo-1.2.3-lp150.2.3.1 References: https://bugzilla.suse.com/1108164 https://bugzilla.suse.com/1109571

1 0

openSUSE-SU-2018:3508-1: important: Security update for net-snmp
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for net-snmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3508-1 Rating: important References: #1027353 #1081164 #1102775 #1111122 Cross-References: CVE-2018-18065 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for net-snmp fixes the following issues: Security issues fixed: - CVE-2018-18065: _set_key in agent/helpers/table_container.c had a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. (bsc#1111122) Non-security issues fixed: - swintst_rpm: Protect against unspecified Group name (bsc#1102775) - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1313=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsnmp30-5.7.3-7.3.1 libsnmp30-debuginfo-5.7.3-7.3.1 net-snmp-5.7.3-7.3.1 net-snmp-debuginfo-5.7.3-7.3.1 net-snmp-debugsource-5.7.3-7.3.1 net-snmp-devel-5.7.3-7.3.1 net-snmp-python-5.7.3-7.3.1 net-snmp-python-debuginfo-5.7.3-7.3.1 perl-SNMP-5.7.3-7.3.1 perl-SNMP-debuginfo-5.7.3-7.3.1 snmp-mibs-5.7.3-7.3.1 - openSUSE Leap 42.3 (x86_64): libsnmp30-32bit-5.7.3-7.3.1 libsnmp30-debuginfo-32bit-5.7.3-7.3.1 net-snmp-devel-32bit-5.7.3-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-18065.html https://bugzilla.suse.com/1027353 https://bugzilla.suse.com/1081164 https://bugzilla.suse.com/1102775 https://bugzilla.suse.com/1111122

1 0

openSUSE-RU-2018:3507-1: Recommended update for Regina-REXX, THE, ooRexx
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for Regina-REXX, THE, ooRexx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3507-1 Rating: low References: #1012847 #1017668 #1083875 #985384 Affected Products: openSUSE Leap 42.3:NonFree openSUSE Leap 42.3 openSUSE Leap 15.0:NonFree openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for Regina-REXX, THE, ooRexx fixes the following issues: * Allow alternative Rexx (ooRexx and Regina-REXX) implementations to be installed in parallel (boo#1083875) * Do not ship any preset file in ooRexx (boo#1012847) * Leftower process running at end of build of ooRexx (boo#1017668) * Fix building of ooRexx gcc6 and later (boo#985384) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3:NonFree: zypper in -t patch openSUSE-2018-1294=1 - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1294=1 - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2018-1294=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1294=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1294=1 Package List: - openSUSE Leap 42.3:NonFree (x86_64): THE-3.3~RC4-3.3.1 THE-debuginfo-3.3~RC4-3.3.1 THE-debugsource-3.3~RC4-3.3.1 - openSUSE Leap 42.3:NonFree (noarch): THE-doc-3.3~RC4-3.3.1 - openSUSE Leap 42.3 (i586 x86_64): Regina-REXX-3.9.1-4.3.1 Regina-REXX-devel-3.9.1-4.3.1 Regina-REXX-doc-3.9.1-4.3.1 libregina3-3.9.1-4.3.1 ooRexx-4.2.0-6.3.1 ooRexx-debuginfo-4.2.0-6.3.1 ooRexx-debugsource-4.2.0-6.3.1 ooRexx-devel-4.2.0-6.3.1 - openSUSE Leap 15.0:NonFree (x86_64): THE-3.3~RC4-lp150.2.3.1 THE-debuginfo-3.3~RC4-lp150.2.3.1 THE-debugsource-3.3~RC4-lp150.2.3.1 - openSUSE Leap 15.0:NonFree (noarch): THE-doc-3.3~RC4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): Regina-REXX-3.9.1-lp150.2.3.1 Regina-REXX-devel-3.9.1-lp150.2.3.1 Regina-REXX-doc-3.9.1-lp150.2.3.1 libregina3-3.9.1-lp150.2.3.1 ooRexx-4.2.0-lp150.3.3.2 ooRexx-debuginfo-4.2.0-lp150.3.3.2 ooRexx-debugsource-4.2.0-lp150.3.3.2 ooRexx-devel-4.2.0-lp150.3.3.2 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): Regina-REXX-3.9.1-bp150.3.3.1 Regina-REXX-devel-3.9.1-bp150.3.3.1 Regina-REXX-doc-3.9.1-bp150.3.3.1 libregina3-3.9.1-bp150.3.3.1 ooRexx-4.2.0-bp150.3.3.1 ooRexx-debuginfo-4.2.0-bp150.3.3.1 ooRexx-debugsource-4.2.0-bp150.3.3.1 ooRexx-devel-4.2.0-bp150.3.3.1 References: https://bugzilla.suse.com/1012847 https://bugzilla.suse.com/1017668 https://bugzilla.suse.com/1083875 https://bugzilla.suse.com/985384

1 0

openSUSE-SU-2018:3505-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3505-1 Rating: moderate References: #1103040 #1104457 #1110723 Cross-References: CVE-2018-14680 CVE-2018-14681 CVE-2018-14682 CVE-2018-15378 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for clamav fixes the following issues: clamav was updated to version 0.100.2: - CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. (bsc#1110723) - CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more fixes for embedded libmspack. (bsc#1103040) - Make freshclam more robust against lagging signature mirrors. - On-Access "Extra Scanning", an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, see: https://bugzilla.clamav.net/show_bug.cgi?id=12048 - Restore exit code compatibility of freshclam with versions before 0.100.0 when the virus database is already up to date (bsc#1104457). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1310=1 Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.100.2-32.1 clamav-debuginfo-0.100.2-32.1 clamav-debugsource-0.100.2-32.1 References: https://www.suse.com/security/cve/CVE-2018-14680.html https://www.suse.com/security/cve/CVE-2018-14681.html https://www.suse.com/security/cve/CVE-2018-14682.html https://www.suse.com/security/cve/CVE-2018-15378.html https://bugzilla.suse.com/1103040 https://bugzilla.suse.com/1104457 https://bugzilla.suse.com/1110723

1 0

openSUSE-RU-2018:3504-1: important: Recommended update for fping
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for fping ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3504-1 Rating: important References: #988195 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fping provides the following fix: - Fix a problem that was causing fping to flood /tmp after a network stop. (bsc#988195) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1302=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): fping-3.5-10.3.1 fping-debuginfo-3.5-10.3.1 fping-debugsource-3.5-10.3.1 References: https://bugzilla.suse.com/988195

1 0

openSUSE-RU-2018:3502-1: Recommended update for tar
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3502-1 Rating: low References: #1071340 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tar provides the following fix: - Revert an upstream commit meant for optimizing sparse files as it causes a regression on offline files. (bsc#1071340) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1303=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): tar-1.27.1-15.3.1 tar-backup-scripts-1.27.1-15.3.1 tar-debuginfo-1.27.1-15.3.1 tar-debugsource-1.27.1-15.3.1 tar-tests-1.27.1-15.3.1 tar-tests-debuginfo-1.27.1-15.3.1 - openSUSE Leap 42.3 (noarch): tar-lang-1.27.1-15.3.1 References: https://bugzilla.suse.com/1071340

1 0

openSUSE-OU-2018:3501-1: Optional update for tevent
by maintenance＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Optional Update: Optional update for tevent ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3501-1 Rating: low References: #1109571 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for tevent fixes the following issues: - The license of the package should have been LGPL 3.0 (bsc#1109571) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1307=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libtevent-devel-0.9.36-lp150.2.6.1 libtevent0-0.9.36-lp150.2.6.1 libtevent0-debuginfo-0.9.36-lp150.2.6.1 python-tevent-0.9.36-lp150.2.6.1 python-tevent-debuginfo-0.9.36-lp150.2.6.1 python3-tevent-0.9.36-lp150.2.6.1 python3-tevent-debuginfo-0.9.36-lp150.2.6.1 tevent-debugsource-0.9.36-lp150.2.6.1 tevent-man-0.9.36-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libtevent0-32bit-0.9.36-lp150.2.6.1 libtevent0-32bit-debuginfo-0.9.36-lp150.2.6.1 python-tevent-32bit-0.9.36-lp150.2.6.1 python-tevent-32bit-debuginfo-0.9.36-lp150.2.6.1 python3-tevent-32bit-0.9.36-lp150.2.6.1 python3-tevent-32bit-debuginfo-0.9.36-lp150.2.6.1 References: https://bugzilla.suse.com/1109571

1 0

openSUSE-SU-2018:3481-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3481-1 Rating: moderate References: #1108480 #1108672 Cross-References: CVE-2018-16554 CVE-2018-17088 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jhead fixes the following issues: Security issues fixed: - CVE-2018-17088: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. (boo#1108672) - CVE-2018-16554: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling. (boo#1108480) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1292=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1292=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1292=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): jhead-3.00-14.1 jhead-debuginfo-3.00-14.1 jhead-debugsource-3.00-14.1 - openSUSE Leap 15.0 (x86_64): jhead-3.00-lp150.3.6.1 jhead-debuginfo-3.00-lp150.3.6.1 jhead-debugsource-3.00-lp150.3.6.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): jhead-3.00-bp150.3.7.1 References: https://www.suse.com/security/cve/CVE-2018-16554.html https://www.suse.com/security/cve/CVE-2018-17088.html https://bugzilla.suse.com/1108480 https://bugzilla.suse.com/1108672

1 0

openSUSE-SU-2018:3479-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 26 Oct '18

26 Oct '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3479-1 Rating: moderate References: #1112392 #1112399 Cross-References: CVE-2017-10794 CVE-2017-14997 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2017-10794: When GraphicsMagick processed an RGB TIFF picture (with metadata indicating a single sample per pixel) in coders/tiff.c, a buffer overflow occured, related to QuantumTransferMode. (boo#1112392) - CVE-2017-14997: GraphicsMagick allowed remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. (boo#1112399) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1291=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-114.1 GraphicsMagick-debuginfo-1.3.25-114.1 GraphicsMagick-debugsource-1.3.25-114.1 GraphicsMagick-devel-1.3.25-114.1 libGraphicsMagick++-Q16-12-1.3.25-114.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-114.1 libGraphicsMagick++-devel-1.3.25-114.1 libGraphicsMagick-Q16-3-1.3.25-114.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-114.1 libGraphicsMagick3-config-1.3.25-114.1 libGraphicsMagickWand-Q16-2-1.3.25-114.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-114.1 perl-GraphicsMagick-1.3.25-114.1 perl-GraphicsMagick-debuginfo-1.3.25-114.1 References: https://www.suse.com/security/cve/CVE-2017-10794.html https://www.suse.com/security/cve/CVE-2017-14997.html https://bugzilla.suse.com/1112392 https://bugzilla.suse.com/1112399

1 0

openSUSE-SU-2018:3478-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3478-1 Rating: important References: #1013882 #1112368 #1112369 #1112390 #1112393 #1112397 #1112398 #1112417 #1112421 #1112432 Cross-References: CVE-2016-9843 CVE-2018-3133 CVE-2018-3143 CVE-2018-3156 CVE-2018-3174 CVE-2018-3247 CVE-2018-3251 CVE-2018-3276 CVE-2018-3278 CVE-2018-3282 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MySQL Community Server was updated to 5.6.42, fixing bugs and security issues: Changes: http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-42.html Fixed CVEs: - CVE-2016-9843 [boo#1013882], CVE-2018-3143 [boo#1112421], - CVE-2018-3156 [boo#1112417], CVE-2018-3251 [boo#1112397], - CVE-2018-3133 [boo#1112369], CVE-2018-3247 [boo#1112398], - CVE-2018-3174 [boo#1112368], CVE-2018-3276 [boo#1112393], - CVE-2018-3278 [boo#1112390], CVE-2018-3282 [boo#1112432], Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1284=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.42-42.1 libmysql56client18-debuginfo-5.6.42-42.1 libmysql56client_r18-5.6.42-42.1 mysql-community-server-5.6.42-42.1 mysql-community-server-bench-5.6.42-42.1 mysql-community-server-bench-debuginfo-5.6.42-42.1 mysql-community-server-client-5.6.42-42.1 mysql-community-server-client-debuginfo-5.6.42-42.1 mysql-community-server-debuginfo-5.6.42-42.1 mysql-community-server-debugsource-5.6.42-42.1 mysql-community-server-test-5.6.42-42.1 mysql-community-server-test-debuginfo-5.6.42-42.1 mysql-community-server-tools-5.6.42-42.1 mysql-community-server-tools-debuginfo-5.6.42-42.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.42-42.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.42-42.1 libmysql56client18-debuginfo-32bit-5.6.42-42.1 libmysql56client_r18-32bit-5.6.42-42.1 References: https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2018-3133.html https://www.suse.com/security/cve/CVE-2018-3143.html https://www.suse.com/security/cve/CVE-2018-3156.html https://www.suse.com/security/cve/CVE-2018-3174.html https://www.suse.com/security/cve/CVE-2018-3247.html https://www.suse.com/security/cve/CVE-2018-3251.html https://www.suse.com/security/cve/CVE-2018-3276.html https://www.suse.com/security/cve/CVE-2018-3278.html https://www.suse.com/security/cve/CVE-2018-3282.html https://bugzilla.suse.com/1013882 https://bugzilla.suse.com/1112368 https://bugzilla.suse.com/1112369 https://bugzilla.suse.com/1112390 https://bugzilla.suse.com/1112393 https://bugzilla.suse.com/1112397 https://bugzilla.suse.com/1112398 https://bugzilla.suse.com/1112417 https://bugzilla.suse.com/1112421 https://bugzilla.suse.com/1112432

1 0

openSUSE-RU-2018:3477-1: moderate: Recommended update for bluez-qt
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for bluez-qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3477-1 Rating: moderate References: #1112598 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bluez-qt resolves the following issue: - Bluetooth could not be enabled from the KDE Plasma Applet due to a misplaced udev file (boo#1112598) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1283=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): bluez-qt-debugsource-5.26.0-6.1 bluez-qt-debugsource-5.32.0-6.1 bluez-qt-devel-5.26.0-6.1 bluez-qt-devel-5.32.0-6.1 bluez-qt-imports-5.26.0-6.1 bluez-qt-imports-5.32.0-6.1 bluez-qt-imports-debuginfo-5.26.0-6.1 bluez-qt-imports-debuginfo-5.32.0-6.1 bluez-qt-udev-5.26.0-6.1 bluez-qt-udev-5.32.0-6.1 libKF5BluezQt6-5.26.0-6.1 libKF5BluezQt6-5.32.0-6.1 libKF5BluezQt6-debuginfo-5.26.0-6.1 libKF5BluezQt6-debuginfo-5.32.0-6.1 References: https://bugzilla.suse.com/1112598

1 0

openSUSE-RU-2018:3475-1: moderate: Recommended update for vpp
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for vpp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3475-1 Rating: moderate References: #1112540 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for vpp fixes the following issues: - Do not install 80-vpp.conf; it modifies system-wide settings and it is not needed since VPP 17.08 (boo#1112540) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1286=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1286=1 Package List: - openSUSE Leap 15.0 (x86_64): libvpp0-18.01-lp150.4.3.1 libvpp0-debuginfo-18.01-lp150.4.3.1 vpp-18.01-lp150.4.3.1 vpp-api-java-18.01-lp150.4.3.1 vpp-api-lua-18.01-lp150.4.3.1 vpp-api-python-18.01-lp150.4.3.1 vpp-debuginfo-18.01-lp150.4.3.1 vpp-debugsource-18.01-lp150.4.3.1 vpp-devel-18.01-lp150.4.3.1 vpp-plugins-18.01-lp150.4.3.1 vpp-plugins-debuginfo-18.01-lp150.4.3.1 - openSUSE Backports SLE-15 (x86_64): libvpp0-18.01-bp150.2.3.1 libvpp0-debuginfo-18.01-bp150.2.3.1 vpp-18.01-bp150.2.3.1 vpp-api-java-18.01-bp150.2.3.1 vpp-api-lua-18.01-bp150.2.3.1 vpp-api-python-18.01-bp150.2.3.1 vpp-debuginfo-18.01-bp150.2.3.1 vpp-debugsource-18.01-bp150.2.3.1 vpp-devel-18.01-bp150.2.3.1 vpp-plugins-18.01-bp150.2.3.1 vpp-plugins-debuginfo-18.01-bp150.2.3.1 References: https://bugzilla.suse.com/1112540

1 0

openSUSE-RU-2018:3474-1: moderate: Recommended update for Salt
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for Salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3474-1 Rating: moderate References: #1095651 #1104491 #1106164 #1107333 #1108557 #1108834 #1108969 #1108995 #1109893 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update fixes the following issues: - Improved IPv6 address handling (bsc#1108557) - Better handling for zypper exiting with exit code ZYPPER_EXIT_NO_REPOS (bsc#1108834, bsc#1109893) - Fix for dependency problem with pip (bsc#1104491) - Fix loosen azure sdk dependencies in azurearm cloud driver (bsc#1107333) - Fix for Python3 issue in zypper (bsc#1108995) - Allow running salt-cloud in GCE using instance credentials (bsc#1108969) - Improved handling of Python unicode literals in YAML parsing (bsc#1095651) - Fix for Salt "acl.present" and "acl.absent" states to make them successfully work recursively when "recurse=True". (bsc#1106164) - Fix for Python3 byte/unicode mismatch and additional minor bugfixes to x509 module. - Integration of MSI authentication for azurearm - Compound list targeting wrongly returned with minions specified in "not". - Fixes the x509 module to work, when using the sign_remote_certificate functionality. - Fix for SUSE Expanded Support os grain detection (returned "Redhat" instead of "Centos") This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1290=1 Package List: - openSUSE Leap 15.0 (x86_64): python2-salt-2018.3.0-lp150.3.14.1 python3-salt-2018.3.0-lp150.3.14.1 salt-2018.3.0-lp150.3.14.1 salt-api-2018.3.0-lp150.3.14.1 salt-cloud-2018.3.0-lp150.3.14.1 salt-doc-2018.3.0-lp150.3.14.1 salt-master-2018.3.0-lp150.3.14.1 salt-minion-2018.3.0-lp150.3.14.1 salt-proxy-2018.3.0-lp150.3.14.1 salt-ssh-2018.3.0-lp150.3.14.1 salt-syndic-2018.3.0-lp150.3.14.1 - openSUSE Leap 15.0 (noarch): salt-bash-completion-2018.3.0-lp150.3.14.1 salt-fish-completion-2018.3.0-lp150.3.14.1 salt-zsh-completion-2018.3.0-lp150.3.14.1 References: https://bugzilla.suse.com/1095651 https://bugzilla.suse.com/1104491 https://bugzilla.suse.com/1106164 https://bugzilla.suse.com/1107333 https://bugzilla.suse.com/1108557 https://bugzilla.suse.com/1108834 https://bugzilla.suse.com/1108969 https://bugzilla.suse.com/1108995 https://bugzilla.suse.com/1109893

1 0

openSUSE-SU-2018:3473-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3473-1 Rating: moderate References: #1075775 #1077535 #1079512 #1088182 #1088932 #1092278 #1092279 #1092280 #1095611 #1096060 #1096061 #1097693 #1101999 #1102530 #1104169 Cross-References: CVE-2017-13884 CVE-2017-13885 CVE-2017-7153 CVE-2017-7160 CVE-2017-7161 CVE-2017-7165 CVE-2018-11646 CVE-2018-11712 CVE-2018-11713 CVE-2018-12911 CVE-2018-4088 CVE-2018-4096 CVE-2018-4101 CVE-2018-4113 CVE-2018-4114 CVE-2018-4117 CVE-2018-4118 CVE-2018-4119 CVE-2018-4120 CVE-2018-4121 CVE-2018-4122 CVE-2018-4125 CVE-2018-4127 CVE-2018-4128 CVE-2018-4129 CVE-2018-4133 CVE-2018-4146 CVE-2018-4161 CVE-2018-4162 CVE-2018-4163 CVE-2018-4165 CVE-2018-4190 CVE-2018-4199 CVE-2018-4200 CVE-2018-4204 CVE-2018-4218 CVE-2018-4222 CVE-2018-4232 CVE-2018-4233 CVE-2018-4246 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.20.3 fixes the issues: The following security vulnerabilities were addressed: - CVE-2018-12911: Fixed an off-by-one error in xdg_mime_get_simple_globs (boo#1101999) - CVE-2017-13884: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775). - CVE-2017-13885: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775). - CVE-2017-7153: An unspecified issue allowed remote attackers to spoof user-interface information (about whether the entire content is derived from a valid TLS session) via a crafted web site that sends a 401 Unauthorized redirect (bsc#1077535). - CVE-2017-7160: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775). - CVE-2017-7161: An unspecified issue allowed remote attackers to execute arbitrary code via special characters that trigger command injection (bsc#1075775, bsc#1077535). - CVE-2017-7165: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775). - CVE-2018-4088: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775). - CVE-2018-4096: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775). - CVE-2018-4200: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free (bsc#1092280). - CVE-2018-4204: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1092279). - CVE-2018-4101: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4113: An issue in the JavaScriptCore function in the "WebKit" component allowed attackers to trigger an assertion failure by leveraging improper array indexing (bsc#1088182) - CVE-2018-4114: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182) - CVE-2018-4117: An unspecified issue allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1088182, bsc#1102530). - CVE-2018-4118: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182) - CVE-2018-4119: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182) - CVE-2018-4120: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4121: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1092278). - CVE-2018-4122: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4125: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4127: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4128: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4129: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4146: An unspecified issue allowed attackers to cause a denial of service (memory corruption) via a crafted web site (bsc#1088182). - CVE-2018-4161: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4162: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4163: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4165: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182). - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch (bsc#1097693) - CVE-2018-4199: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site (bsc#1097693) - CVE-2018-4218: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free (bsc#1097693) - CVE-2018-4222: An unspecified issue allowed remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation (bsc#1097693) - CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite cookies via a crafted web site (bsc#1097693) - CVE-2018-4233: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1097693) - CVE-2018-4246: An unspecified issue allowed remote attackers to execute arbitrary code via a crafted web site that leverages type confusion (bsc#1104169) - CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL mishandled an unset pageURL, leading to an application crash (bsc#1095611) - CVE-2018-4133: A Safari cross-site scripting (XSS) vulnerability allowed remote attackers to inject arbitrary web script or HTML via a crafted URL (bsc#1088182). - CVE-2018-11713: The libsoup network backend of WebKit unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection (bsc#1096060). - CVE-2018-11712: The libsoup network backend of WebKit failed to perform TLS certificate verification for WebSocket connections (bsc#1096061). This update for webkit2gtk3 fixes the following issues: - Fixed a crash when atk_object_ref_state_set is called on an AtkObject that's being destroyed (bsc#1088932). - Fixed crash when using Wayland with QXL/virtio (bsc#1079512) - Disable Gigacage if mmap fails to allocate in Linux. - Add user agent quirk for paypal website. - Properly detect compiler flags, needed libs, and fallbacks for usage of 64-bit atomic operations. - Fix a network process crash when trying to get cookies of about:blank page. - Fix UI process crash when closing the window under Wayland. - Fix several crashes and rendering issues. - Do TLS error checking on GTlsConnection::accept-certificate to finish the load earlier in case of errors. - Properly close the connection to the nested wayland compositor in the Web Process. - Avoid painting backing stores for zero-opacity layers. - Fix downloads started by context menu failing in some websites due to missing user agent HTTP header. - Fix video unpause when GStreamerGL is disabled. - Fix several GObject introspection annotations. - Update user agent quiks to fix Outlook.com and Chase.com. - Fix several crashes and rendering issues. - Improve error message when Gigacage cannot allocate virtual memory. - Add missing WebKitWebProcessEnumTypes.h to webkit-web-extension.h. - Improve web process memory monitor thresholds. - Fix a web process crash when the web view is created and destroyed quickly. - Fix a network process crash when load is cancelled while searching for stored HTTP auth credentials. - Fix the build when ENABLE_VIDEO, ENABLE_WEB_AUDIO and ENABLE_XSLT are disabled. - New API to retrieve and delete cookies with WebKitCookieManager. - New web process API to detect when form is submitted via JavaScript. - Several improvements and fixes in the touch/gestures support. - Support for the “system” CSS font family. - Complex text rendering improvements and fixes. - More complete and spec compliant WebDriver implementation. - Ensure DNS prefetching cannot be re-enabled if disabled by settings. - Fix seek sometimes not working. - Fix rendering of emojis that were using the wrong scale factor in some cases. - Fix rendering of combining enclosed keycap. - Fix rendering scale of some layers in HiDPI. - Fix a crash in Wayland when closing the web view. - Fix crashes upower crashes when running inside a chroot or on systems with broken dbus/upower. - Fix memory leaks in GStreamer media backend when using GStreamer 1.14. - Fix several crashes and rendering issues. - Add ENABLE_ADDRESS_SANITIZER to make it easier to build with asan support. - Fix a crash a under Wayland when using mesa software rasterization. - Make fullscreen video work again. - Fix handling of missing GStreamer elements. - Fix rendering when webm video is played twice. - Fix kinetic scrolling sometimes jumping around. - Fix build with ICU configured without collation support. - WebSockets use system proxy settings now (requires libsoup 2.61.90). - Show the context menu on long-press gesture. - Add support for Shift + mouse scroll to scroll horizontally. - Fix zoom gesture to actually zoom instead of changing the page scale. - Implement support for Graphics ARIA roles. - Make sleep inhibitors work under Flatpak. - Add get element CSS value command to WebDriver. - Fix a crash aftter a swipe gesture. - Fix several crashes and rendering issues. - Fix crashes due to duplicated symbols in libjavascriptcoregtk and libwebkit2gtk. - Fix parsing of timeout values in WebDriver. - Implement get timeouts command in WebDriver. - Fix deadlock in GStreamer video sink during shutdown when accelerated compositing is disabled. - Fix several crashes and rendering issues. - Add web process API to detect when form is submitted via JavaScript. - Add new API to replace webkit_form_submission_request_get_text_fields() that is now deprecated. - Add WebKitWebView::web-process-terminated signal and deprecate web-process-crashed. - Fix rendering issues when editing text areas. - Use FastMalloc based GstAllocator for GStreamer. - Fix web process crash at startup in bmalloc. - Fix several memory leaks in GStreamer media backend. - WebKitWebDriver process no longer links to libjavascriptcoregtk. - Fix several crashes and rendering issues. - Add new API to add, retrieve and delete cookies via WebKitCookieManager. - Add functions to WebSettings to convert font sizes between points and pixels. - Ensure cookie operations take effect when they happen before a web process has been spawned. - Automatically adjust font size when GtkSettings:gtk-xft-dpi changes. - Add initial resource load statistics support. - Add API to expose availability of certain editing commands in WebKitEditorState. - Add API to query whether a WebKitNavigationAction is a redirect or not. - Improve complex text rendering. - Add support for the "system" CSS font family. - Disable USE_GSTREAMER_GL This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1288=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.20.3-11.1 libjavascriptcoregtk-4_0-18-debuginfo-2.20.3-11.1 libwebkit2gtk-4_0-37-2.20.3-11.1 libwebkit2gtk-4_0-37-debuginfo-2.20.3-11.1 typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1 typelib-1_0-WebKit2-4_0-2.20.3-11.1 typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1 webkit-jsc-4-2.20.3-11.1 webkit-jsc-4-debuginfo-2.20.3-11.1 webkit2gtk-4_0-injected-bundles-2.20.3-11.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.20.3-11.1 webkit2gtk3-debugsource-2.20.3-11.1 webkit2gtk3-devel-2.20.3-11.1 webkit2gtk3-plugin-process-gtk2-2.20.3-11.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.20.3-11.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.20.3-11.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.20.3-11.1 libwebkit2gtk-4_0-37-32bit-2.20.3-11.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.20.3-11.1 References: https://www.suse.com/security/cve/CVE-2017-13884.html https://www.suse.com/security/cve/CVE-2017-13885.html https://www.suse.com/security/cve/CVE-2017-7153.html https://www.suse.com/security/cve/CVE-2017-7160.html https://www.suse.com/security/cve/CVE-2017-7161.html https://www.suse.com/security/cve/CVE-2017-7165.html https://www.suse.com/security/cve/CVE-2018-11646.html https://www.suse.com/security/cve/CVE-2018-11712.html https://www.suse.com/security/cve/CVE-2018-11713.html https://www.suse.com/security/cve/CVE-2018-12911.html https://www.suse.com/security/cve/CVE-2018-4088.html https://www.suse.com/security/cve/CVE-2018-4096.html https://www.suse.com/security/cve/CVE-2018-4101.html https://www.suse.com/security/cve/CVE-2018-4113.html https://www.suse.com/security/cve/CVE-2018-4114.html https://www.suse.com/security/cve/CVE-2018-4117.html https://www.suse.com/security/cve/CVE-2018-4118.html https://www.suse.com/security/cve/CVE-2018-4119.html https://www.suse.com/security/cve/CVE-2018-4120.html https://www.suse.com/security/cve/CVE-2018-4121.html https://www.suse.com/security/cve/CVE-2018-4122.html https://www.suse.com/security/cve/CVE-2018-4125.html https://www.suse.com/security/cve/CVE-2018-4127.html https://www.suse.com/security/cve/CVE-2018-4128.html https://www.suse.com/security/cve/CVE-2018-4129.html https://www.suse.com/security/cve/CVE-2018-4133.html https://www.suse.com/security/cve/CVE-2018-4146.html https://www.suse.com/security/cve/CVE-2018-4161.html https://www.suse.com/security/cve/CVE-2018-4162.html https://www.suse.com/security/cve/CVE-2018-4163.html https://www.suse.com/security/cve/CVE-2018-4165.html https://www.suse.com/security/cve/CVE-2018-4190.html https://www.suse.com/security/cve/CVE-2018-4199.html https://www.suse.com/security/cve/CVE-2018-4200.html https://www.suse.com/security/cve/CVE-2018-4204.html https://www.suse.com/security/cve/CVE-2018-4218.html https://www.suse.com/security/cve/CVE-2018-4222.html https://www.suse.com/security/cve/CVE-2018-4232.html https://www.suse.com/security/cve/CVE-2018-4233.html https://www.suse.com/security/cve/CVE-2018-4246.html https://bugzilla.suse.com/1075775 https://bugzilla.suse.com/1077535 https://bugzilla.suse.com/1079512 https://bugzilla.suse.com/1088182 https://bugzilla.suse.com/1088932 https://bugzilla.suse.com/1092278 https://bugzilla.suse.com/1092279 https://bugzilla.suse.com/1092280 https://bugzilla.suse.com/1095611 https://bugzilla.suse.com/1096060 https://bugzilla.suse.com/1096061 https://bugzilla.suse.com/1097693 https://bugzilla.suse.com/1101999 https://bugzilla.suse.com/1102530 https://bugzilla.suse.com/1104169

1 0

openSUSE-RU-2018:3472-1: moderate: Recommended update for bluez-qt
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for bluez-qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3472-1 Rating: moderate References: #1112598 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bluez-qt resolves the following issue: - Bluetooth could not be enabled from the KDE Plasma Applet due to a misplaced udev file (boo#1112598) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1283=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1283=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1283=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): bluez-qt-debugsource-5.32.0-2.3.1 bluez-qt-devel-5.32.0-2.3.1 bluez-qt-imports-5.32.0-2.3.1 bluez-qt-imports-debuginfo-5.32.0-2.3.1 bluez-qt-udev-5.32.0-2.3.1 libKF5BluezQt6-5.32.0-2.3.1 libKF5BluezQt6-debuginfo-5.32.0-2.3.1 - openSUSE Leap 15.0 (x86_64): bluez-qt-debuginfo-5.45.0-lp150.2.3.1 bluez-qt-debugsource-5.45.0-lp150.2.3.1 bluez-qt-devel-5.45.0-lp150.2.3.1 bluez-qt-imports-5.45.0-lp150.2.3.1 bluez-qt-imports-debuginfo-5.45.0-lp150.2.3.1 bluez-qt-udev-5.45.0-lp150.2.3.1 libKF5BluezQt6-5.45.0-lp150.2.3.1 libKF5BluezQt6-debuginfo-5.45.0-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): bluez-qt-debuginfo-5.45.0-bp150.3.4.1 bluez-qt-debugsource-5.45.0-bp150.3.4.1 bluez-qt-devel-5.45.0-bp150.3.4.1 bluez-qt-imports-5.45.0-bp150.3.4.1 bluez-qt-imports-debuginfo-5.45.0-bp150.3.4.1 bluez-qt-udev-5.45.0-bp150.3.4.1 libKF5BluezQt6-5.45.0-bp150.3.4.1 libKF5BluezQt6-debuginfo-5.45.0-bp150.3.4.1 References: https://bugzilla.suse.com/1112598

1 0

openSUSE-RU-2018:3471-1: moderate: Recommended update for gettext-runtime
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for gettext-runtime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3471-1 Rating: moderate References: #1106843 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gettext-runtime provides the following fix: - Reset the length of message string after a line has been removed to fix a crash in msgfmt when writing java source code and the .po file has a POT-Creation-Date header. (bsc#1106843) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1289=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le x86_64): gettext-csharp-0.19.8.1-bp150.2.3.1 References: https://bugzilla.suse.com/1106843

1 0

openSUSE-RU-2018:3469-1: moderate: Recommended update for rkhunter
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for rkhunter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3469-1 Rating: moderate References: #1111770 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rkhunter fixes the following issues: - Upgrade to the latest available version 1.4.6 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1287=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1287=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1287=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): rkhunter-1.4.6-12.3.1 - openSUSE Leap 15.0 (x86_64): rkhunter-1.4.6-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): rkhunter-1.4.6-bp150.3.3.1 References: https://bugzilla.suse.com/1111770

1 0

openSUSE-RU-2018:3468-1: moderate: Recommended update for patterns-lxqt
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for patterns-lxqt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3468-1 Rating: moderate References: #1084751 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for patterns-lxqt fixes the following issues: - The LXQt icons may have been missing due to the oxygen icon theme missing from the pattern (boo#1084751) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1285=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1285=1 Package List: - openSUSE Leap 15.0 (x86_64): patterns-lxqt-lxqt-20170319-lp150.2.7.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): patterns-lxqt-lxqt-20170319-bp150.4.3.1 References: https://bugzilla.suse.com/1084751

1 0

openSUSE-RU-2018:3466-1: Recommended update for calibre
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3466-1 Rating: low References: #1112569 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for calibre adds support for the Kobo Forma device (boo#1112569). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1282=1 Package List: - openSUSE Leap 15.0 (x86_64): calibre-3.27.1-lp150.3.12.1 calibre-debuginfo-3.27.1-lp150.3.12.1 calibre-debugsource-3.27.1-lp150.3.12.1 References: https://bugzilla.suse.com/1112569

1 0

openSUSE-SU-2018:3453-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3453-1 Rating: moderate References: #1110850 Cross-References: CVE-2018-11784 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2018-11784: When the default servlet in Apache Tomcat returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. (bsc#1110850) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1276=1 Package List: - openSUSE Leap 42.3 (noarch): tomcat-8.0.53-18.1 tomcat-admin-webapps-8.0.53-18.1 tomcat-docs-webapp-8.0.53-18.1 tomcat-el-3_0-api-8.0.53-18.1 tomcat-embed-8.0.53-18.1 tomcat-javadoc-8.0.53-18.1 tomcat-jsp-2_3-api-8.0.53-18.1 tomcat-jsvc-8.0.53-18.1 tomcat-lib-8.0.53-18.1 tomcat-servlet-3_1-api-8.0.53-18.1 tomcat-webapps-8.0.53-18.1 References: https://www.suse.com/security/cve/CVE-2018-11784.html https://bugzilla.suse.com/1110850

1 0