October 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:3052-1: moderate: Security update for python
by opensuse-security＠opensuse.org 06 Oct '18

06 Oct '18

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3052-1 Rating: moderate References: #1109663 Cross-References: CVE-2018-1000802 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issue: - CVE-2018-1000802: Prevent command injection in shutil module (make_archive function) via passage of unfiltered user input (bsc#1109663) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1128=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpython2_7-1_0-2.7.14-lp150.6.3.1 libpython2_7-1_0-debuginfo-2.7.14-lp150.6.3.1 python-2.7.14-lp150.6.3.2 python-base-2.7.14-lp150.6.3.1 python-base-debuginfo-2.7.14-lp150.6.3.1 python-base-debugsource-2.7.14-lp150.6.3.1 python-curses-2.7.14-lp150.6.3.2 python-curses-debuginfo-2.7.14-lp150.6.3.2 python-debuginfo-2.7.14-lp150.6.3.2 python-debugsource-2.7.14-lp150.6.3.2 python-demo-2.7.14-lp150.6.3.2 python-devel-2.7.14-lp150.6.3.1 python-gdbm-2.7.14-lp150.6.3.2 python-gdbm-debuginfo-2.7.14-lp150.6.3.2 python-idle-2.7.14-lp150.6.3.2 python-tk-2.7.14-lp150.6.3.2 python-tk-debuginfo-2.7.14-lp150.6.3.2 python-xml-2.7.14-lp150.6.3.1 python-xml-debuginfo-2.7.14-lp150.6.3.1 - openSUSE Leap 15.0 (noarch): python-doc-2.7.14-lp150.6.3.1 python-doc-pdf-2.7.14-lp150.6.3.1 - openSUSE Leap 15.0 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp150.6.3.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp150.6.3.1 python-32bit-2.7.14-lp150.6.3.2 python-32bit-debuginfo-2.7.14-lp150.6.3.2 python-base-32bit-2.7.14-lp150.6.3.1 python-base-32bit-debuginfo-2.7.14-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000802.html https://bugzilla.suse.com/1109663

1 0

openSUSE-SU-2018:3051-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Oct '18

06 Oct '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3051-1 Rating: important References: #1066489 #1084603 #1098998 #1107343 #1107772 #1109363 #1109379 Cross-References: CVE-2017-16541 CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12367 CVE-2018-12371 CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12383 CVE-2018-12385 CVE-2018-16541 CVE-2018-5156 CVE-2018-5187 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343) - CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343) - CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1066489) - CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (bsc#1107343) - CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (bsc#1109363) - CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343) - CVE-2018-12359: Buffer overflow using computed size of canvas element (bsc#1098998) - CVE-2018-12360: Use-after-free when using focus() (bsc#1098998) - CVE-2018-12361: Integer overflow in SwizzleData (bsc#1098998) - CVE-2018-12362: Integer overflow in SSSE3 scaler (bsc#1098998) - CVE-2018-12363: Use-after-free when appending DOM nodes (bsc#1098998) - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998) - CVE-2018-12365: Compromised IPC child process can list local filenames (bsc#1098998) - CVE-2018-12371: Integer overflow in Skia library during edge builder allocation (bsc#1098998) - CVE-2018-12366: Invalid data handling during QCMS transformations (bsc#1098998) - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998) - CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture (bsc#1098998) - CVE-2018-5187: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60 (bsc#1098998) - CVE-2018-5188: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60 (bsc#1098998) Other bugs fixes: - Fix date display issues (bsc#1109379) - Fix start-up crash due to folder name with special characters (bsc#1107772) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1139=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1139=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.2.1-77.2 MozillaThunderbird-buildsymbols-60.2.1-77.2 MozillaThunderbird-debuginfo-60.2.1-77.2 MozillaThunderbird-debugsource-60.2.1-77.2 MozillaThunderbird-translations-common-60.2.1-77.2 MozillaThunderbird-translations-other-60.2.1-77.2 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.2.1-lp150.3.19.1 MozillaThunderbird-buildsymbols-60.2.1-lp150.3.19.1 MozillaThunderbird-debuginfo-60.2.1-lp150.3.19.1 MozillaThunderbird-debugsource-60.2.1-lp150.3.19.1 MozillaThunderbird-translations-common-60.2.1-lp150.3.19.1 MozillaThunderbird-translations-other-60.2.1-lp150.3.19.1 References: https://www.suse.com/security/cve/CVE-2017-16541.html https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-12376.html https://www.suse.com/security/cve/CVE-2018-12377.html https://www.suse.com/security/cve/CVE-2018-12378.html https://www.suse.com/security/cve/CVE-2018-12383.html https://www.suse.com/security/cve/CVE-2018-12385.html https://www.suse.com/security/cve/CVE-2018-16541.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1066489 https://bugzilla.suse.com/1084603 https://bugzilla.suse.com/1098998 https://bugzilla.suse.com/1107343 https://bugzilla.suse.com/1107772 https://bugzilla.suse.com/1109363 https://bugzilla.suse.com/1109379

1 0

openSUSE-RU-2018:3050-1: moderate: Recommended update for yast2-http-server
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for yast2-http-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3050-1 Rating: moderate References: #1099106 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-http-server provides the following fixes: - Fixed PHP support (use PHP7 instead of dropped PHP5). (bsc#1099106) - Fixed also other renamed packages (for Python and apparmor). - Added additional search keys to desktop file. (fate#321043). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1117=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-http-server-4.0.2-lp150.2.3.1 References: https://bugzilla.suse.com/1099106

1 0

openSUSE-RU-2018:3049-1: moderate: Recommended update for shadowsocks-libev
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for shadowsocks-libev ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3049-1 Rating: moderate References: #1109548 #1109550 #1109556 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for shadowsocks-libev fixes the following issues: - Update version to 3.2.0 * Add MinGW support by @linusyang * Refine c-ares integration by @xnoreq. * Fix building issues with GCC8 by @FlyingheartCN. * Minor bug fixes (boo#1109556, boo#1109550, boo#1109548). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1111=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1111=1 Package List: - openSUSE Leap 15.0 (noarch): shadowsocks-libev-doc-3.2.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libshadowsocks-libev2-3.2.0-lp150.2.3.1 libshadowsocks-libev2-debuginfo-3.2.0-lp150.2.3.1 shadowsocks-libev-3.2.0-lp150.2.3.1 shadowsocks-libev-debuginfo-3.2.0-lp150.2.3.1 shadowsocks-libev-debugsource-3.2.0-lp150.2.3.1 shadowsocks-libev-devel-3.2.0-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libshadowsocks-libev2-3.2.0-bp150.2.3.1 libshadowsocks-libev2-debuginfo-3.2.0-bp150.2.3.1 shadowsocks-libev-3.2.0-bp150.2.3.1 shadowsocks-libev-debuginfo-3.2.0-bp150.2.3.1 shadowsocks-libev-debugsource-3.2.0-bp150.2.3.1 shadowsocks-libev-devel-3.2.0-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): shadowsocks-libev-doc-3.2.0-bp150.2.3.1 References: https://bugzilla.suse.com/1109548 https://bugzilla.suse.com/1109550 https://bugzilla.suse.com/1109556

1 0

openSUSE-RU-2018:3048-1: important: Recommended update for osdlyrics
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for osdlyrics ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3048-1 Rating: important References: #1109453 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for osdlyrics fixes the following issues: - osdlyrics did not start up correctly when some required dependencies were not installed (boo#1109453) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1112=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1112=1 Package List: - openSUSE Leap 15.0 (noarch): osdlyrics-lang-0.4.3+git20170817.8661927-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): osdlyrics-0.4.3+git20170817.8661927-lp150.4.3.1 osdlyrics-debuginfo-0.4.3+git20170817.8661927-lp150.4.3.1 osdlyrics-debugsource-0.4.3+git20170817.8661927-lp150.4.3.1 python-osdlyrics-0.4.3+git20170817.8661927-lp150.4.3.1 - openSUSE Backports SLE-15 (x86_64): osdlyrics-0.4.3+git20170817.8661927-bp150.2.3.1 osdlyrics-debuginfo-0.4.3+git20170817.8661927-bp150.2.3.1 osdlyrics-debugsource-0.4.3+git20170817.8661927-bp150.2.3.1 python-osdlyrics-0.4.3+git20170817.8661927-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): osdlyrics-lang-0.4.3+git20170817.8661927-bp150.2.3.1 References: https://bugzilla.suse.com/1109453

1 0

openSUSE-RU-2018:3047-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3047-1 Rating: moderate References: #1063443 #1085419 #1088830 #1092344 #1106381 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for grub2 provides the following fixes: - Fix config_directory on Btrfs to follow path scheme. (bsc#1063443) - Fix setparams doesn't work as expected from boot-last-label NVRAM var. (bsc#1088830) - Fix incorrect netmask on ppc64. (bsc#1085419, bsc#1092344) - Fix outputting invalid btrfs subvolume path on non btrfs filesystem due to bogus return code handling. (bsc#1106381) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1125=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): grub2-2.02-13.1 grub2-branding-upstream-2.02-13.1 grub2-debuginfo-2.02-13.1 grub2-debugsource-2.02-13.1 grub2-i386-pc-2.02-13.1 - openSUSE Leap 42.3 (x86_64): grub2-x86_64-efi-2.02-13.1 grub2-x86_64-xen-2.02-13.1 - openSUSE Leap 42.3 (noarch): grub2-snapper-plugin-2.02-13.1 grub2-systemd-sleep-plugin-2.02-13.1 - openSUSE Leap 42.3 (i586): grub2-i386-efi-2.02-13.1 References: https://bugzilla.suse.com/1063443 https://bugzilla.suse.com/1085419 https://bugzilla.suse.com/1088830 https://bugzilla.suse.com/1092344 https://bugzilla.suse.com/1106381

1 0

openSUSE-RU-2018:3046-1: moderate: Recommended update for icewm
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for icewm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3046-1 Rating: moderate References: #1096917 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for icewm fixes the following issues: - Revert a previously applied fix to fix starting of polkit-gnome-authentication-agent-1 in icewm (bsc#1096917) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1126=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): icewm-1.3.12-6.9.1 icewm-debugsource-1.3.12-6.9.1 icewm-default-1.3.12-6.9.1 icewm-default-debuginfo-1.3.12-6.9.1 icewm-lite-1.3.12-6.9.1 icewm-lite-debuginfo-1.3.12-6.9.1 - openSUSE Leap 42.3 (noarch): icewm-config-upstream-1.3.12-6.9.1 icewm-lang-1.3.12-6.9.1 References: https://bugzilla.suse.com/1096917

1 0

openSUSE-RU-2018:3044-1: important: Recommended update for mypaint
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for mypaint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3044-1 Rating: important References: #1081099 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mypaint fixes the following issues: - mypaint did not work correctly due to the wrong python binary being used (boo#1081099) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1114=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1114=1 Package List: - openSUSE Leap 15.0 (noarch): mypaint-lang-1.1.0-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): mypaint-1.1.0-lp150.5.3.1 mypaint-debuginfo-1.1.0-lp150.5.3.1 mypaint-debugsource-1.1.0-lp150.5.3.1 - openSUSE Backports SLE-15 (x86_64): mypaint-1.1.0-bp150.2.3.1 mypaint-debuginfo-1.1.0-bp150.2.3.1 mypaint-debugsource-1.1.0-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): mypaint-lang-1.1.0-bp150.2.3.1 References: https://bugzilla.suse.com/1081099

1 0

openSUSE-SU-2018:3043-1: moderate: Security update for unzip
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3043-1 Rating: moderate References: #1013992 #1013993 #1080074 #910683 #914442 #950110 #950111 Cross-References: CVE-2014-9636 CVE-2014-9913 CVE-2015-7696 CVE-2015-7697 CVE-2016-9844 CVE-2018-1000035 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for unzip fixes the following security issues: - CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993) - CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110) - CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111) - CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992) - CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074). - CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442). This non-security issue was fixed: - Allow processing of Windows zip64 archives (Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher) (bnc#910683) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1124=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): unzip-6.00-31.3.1 unzip-debuginfo-6.00-31.3.1 unzip-debugsource-6.00-31.3.1 unzip-doc-6.00-31.3.1 unzip-rcc-6.00-31.3.1 unzip-rcc-debuginfo-6.00-31.3.1 unzip-rcc-debugsource-6.00-31.3.1 References: https://www.suse.com/security/cve/CVE-2014-9636.html https://www.suse.com/security/cve/CVE-2014-9913.html https://www.suse.com/security/cve/CVE-2015-7696.html https://www.suse.com/security/cve/CVE-2015-7697.html https://www.suse.com/security/cve/CVE-2016-9844.html https://www.suse.com/security/cve/CVE-2018-1000035.html https://bugzilla.suse.com/1013992 https://bugzilla.suse.com/1013993 https://bugzilla.suse.com/1080074 https://bugzilla.suse.com/910683 https://bugzilla.suse.com/914442 https://bugzilla.suse.com/950110 https://bugzilla.suse.com/950111

1 0

openSUSE-RU-2018:3042-1: moderate: Recommended update for linux-glibc-devel
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for linux-glibc-devel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3042-1 Rating: moderate References: #1103375 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for linux-glibc-devel provides the following fix: - elf: Add powerpc specific core note sections. (fate#318470, bsc#1103375) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1113=1 Package List: - openSUSE Leap 42.3 (noarch): linux-glibc-devel-4.4-6.3.1 References: https://bugzilla.suse.com/1103375

1 0

openSUSE-RU-2018:3041-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3041-1 Rating: moderate References: #1040770 #1056756 #1075525 #1106048 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for perf provides the following fixes: - Re-add dependency on libebl on PPC64le. (bsc#1106048) - Support crystall ridge / far / near memory indication in PEBS. (fate#325127) - Add necessary power pvr support. (bsc#1075525) - Fix listing PMU events. They were not listed because pvr code is missing for POWER9. (bsc#1075525) - Add perf scripting support for ppc64le. (bsc#1056756) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1120=1 Package List: - openSUSE Leap 15.0 (x86_64): perf-4.12.14-lp150.8.6.1 perf-debuginfo-4.12.14-lp150.8.6.1 perf-debugsource-4.12.14-lp150.8.6.1 References: https://bugzilla.suse.com/1040770 https://bugzilla.suse.com/1056756 https://bugzilla.suse.com/1075525 https://bugzilla.suse.com/1106048

1 0

openSUSE-RU-2018:3040-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3040-1 Rating: moderate References: #1056686 #1069737 #1096012 #1101624 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for perf provides the following fixes: - POWER9: Fix a problem that was causing perf uprobe with return to fail to record samples when probed on userspace code. (bsc#1096012) - Update PMU event descriptions for Power9 CPUs per IBM request. (bsc#1101624, bsc#1056686, bsc#1069737) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1119=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): perf-4.4.155-53.1 perf-debuginfo-4.4.155-53.1 perf-debugsource-4.4.155-53.1 References: https://bugzilla.suse.com/1056686 https://bugzilla.suse.com/1069737 https://bugzilla.suse.com/1096012 https://bugzilla.suse.com/1101624

1 0

openSUSE-RU-2018:3039-1: Recommended update for sudo
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3039-1 Rating: low References: #1097643 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sudo fixes the following issues: - fix permissions for /var/lib/sudo and /var/lib/sudo/ts (bsc#1097643) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1115=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): sudo-1.8.22-lp150.3.3.1 sudo-debuginfo-1.8.22-lp150.3.3.1 sudo-debugsource-1.8.22-lp150.3.3.1 sudo-devel-1.8.22-lp150.3.3.1 sudo-test-1.8.22-lp150.3.3.1 References: https://bugzilla.suse.com/1097643

1 0

openSUSE-SU-2018:3038-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3038-1 Rating: important References: #1106171 #1106172 #1106173 #1106195 #1107410 #1107411 #1107412 #1107413 #1107420 #1107421 #1107422 #1107423 #1107426 #1107581 #1108027 #1109105 Cross-References: CVE-2018-15908 CVE-2018-15909 CVE-2018-15910 CVE-2018-15911 CVE-2018-16509 CVE-2018-16510 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585 CVE-2018-16802 CVE-2018-17183 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for ghostscript to version 9.25 fixes the following issues: These security issues were fixed: - CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (bsc#1109105) - CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code (bsc#1106172). - CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files (bsc#1106171). - CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code (bsc#1106173). - CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code (bsc#1106195). - CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107412). - CVE-2018-16509: Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction (bsc#1107410). - CVE-2018-16510: Incorrect exec stack handling in the "CS" and "SC" PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact (bsc#1107411). - CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter (bsc#1107413). - CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter (bsc#1107421). - CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107420). - CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable (bsc#1107422). - CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact (bsc#1107423). - CVE-2018-16511: A type confusion in "ztype" could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107426). - CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing (e.g., after the startup phase). This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107581). - CVE-2018-16802: Incorrect "restoration of privilege" checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509 (bsc#1108027). These non-security issues were fixed: * Fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files). * Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--' For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1123=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ghostscript-9.25-lp150.2.6.1 ghostscript-debuginfo-9.25-lp150.2.6.1 ghostscript-debugsource-9.25-lp150.2.6.1 ghostscript-devel-9.25-lp150.2.6.1 ghostscript-mini-9.25-lp150.2.6.1 ghostscript-mini-debuginfo-9.25-lp150.2.6.1 ghostscript-mini-debugsource-9.25-lp150.2.6.1 ghostscript-mini-devel-9.25-lp150.2.6.1 ghostscript-x11-9.25-lp150.2.6.1 ghostscript-x11-debuginfo-9.25-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libspectre-debugsource-0.2.8-lp150.2.3.1 libspectre-devel-0.2.8-lp150.2.3.1 libspectre1-0.2.8-lp150.2.3.1 libspectre1-debuginfo-0.2.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-15908.html https://www.suse.com/security/cve/CVE-2018-15909.html https://www.suse.com/security/cve/CVE-2018-15910.html https://www.suse.com/security/cve/CVE-2018-15911.html https://www.suse.com/security/cve/CVE-2018-16509.html https://www.suse.com/security/cve/CVE-2018-16510.html https://www.suse.com/security/cve/CVE-2018-16511.html https://www.suse.com/security/cve/CVE-2018-16513.html https://www.suse.com/security/cve/CVE-2018-16539.html https://www.suse.com/security/cve/CVE-2018-16540.html https://www.suse.com/security/cve/CVE-2018-16541.html https://www.suse.com/security/cve/CVE-2018-16542.html https://www.suse.com/security/cve/CVE-2018-16543.html https://www.suse.com/security/cve/CVE-2018-16585.html https://www.suse.com/security/cve/CVE-2018-16802.html https://www.suse.com/security/cve/CVE-2018-17183.html https://bugzilla.suse.com/1106171 https://bugzilla.suse.com/1106172 https://bugzilla.suse.com/1106173 https://bugzilla.suse.com/1106195 https://bugzilla.suse.com/1107410 https://bugzilla.suse.com/1107411 https://bugzilla.suse.com/1107412 https://bugzilla.suse.com/1107413 https://bugzilla.suse.com/1107420 https://bugzilla.suse.com/1107421 https://bugzilla.suse.com/1107422 https://bugzilla.suse.com/1107423 https://bugzilla.suse.com/1107426 https://bugzilla.suse.com/1107581 https://bugzilla.suse.com/1108027 https://bugzilla.suse.com/1109105

1 0

openSUSE-RU-2018:3037-1: Recommended update for yast2-add-on
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for yast2-add-on ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3037-1 Rating: low References: #1102705 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-add-on provides the following fixes: - Do not show the main dialog when it is immediately skipped. (bsc#1102705) - Added additional search keys to desktop file. (fate#321043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1116=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-add-on-4.0.10-lp150.2.3.1 References: https://bugzilla.suse.com/1102705

1 0

openSUSE-SU-2018:3036-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3036-1 Rating: important References: #1106171 #1106172 #1106173 #1106195 #1107410 #1107411 #1107412 #1107413 #1107420 #1107421 #1107422 #1107423 #1107426 #1107581 #1108027 #1109105 Cross-References: CVE-2018-15908 CVE-2018-15909 CVE-2018-15910 CVE-2018-15911 CVE-2018-16509 CVE-2018-16510 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585 CVE-2018-16802 CVE-2018-17183 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for ghostscript to version 9.25 fixes the following issues: These security issues were fixed: - CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (bsc#1109105) - CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code (bsc#1106172). - CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files (bsc#1106171). - CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code (bsc#1106173). - CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code (bsc#1106195). - CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107412). - CVE-2018-16509: Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction (bsc#1107410). - CVE-2018-16510: Incorrect exec stack handling in the "CS" and "SC" PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact (bsc#1107411). - CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter (bsc#1107413). - CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter (bsc#1107421). - CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107420). - CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable (bsc#1107422). - CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact (bsc#1107423). - CVE-2018-16511: A type confusion in "ztype" could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107426). - CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing (e.g., after the startup phase). This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107581). - CVE-2018-16802: Incorrect "restoration of privilege" checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509 (bsc#1108027). These non-security issues were fixed: * Fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files). * Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--' For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm and the changes file of the package. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1122=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ghostscript-9.25-14.9.1 ghostscript-debuginfo-9.25-14.9.1 ghostscript-debugsource-9.25-14.9.1 ghostscript-devel-9.25-14.9.1 ghostscript-mini-9.25-14.9.1 ghostscript-mini-debuginfo-9.25-14.9.1 ghostscript-mini-debugsource-9.25-14.9.1 ghostscript-mini-devel-9.25-14.9.1 ghostscript-x11-9.25-14.9.1 ghostscript-x11-debuginfo-9.25-14.9.1 References: https://www.suse.com/security/cve/CVE-2018-15908.html https://www.suse.com/security/cve/CVE-2018-15909.html https://www.suse.com/security/cve/CVE-2018-15910.html https://www.suse.com/security/cve/CVE-2018-15911.html https://www.suse.com/security/cve/CVE-2018-16509.html https://www.suse.com/security/cve/CVE-2018-16510.html https://www.suse.com/security/cve/CVE-2018-16511.html https://www.suse.com/security/cve/CVE-2018-16513.html https://www.suse.com/security/cve/CVE-2018-16539.html https://www.suse.com/security/cve/CVE-2018-16540.html https://www.suse.com/security/cve/CVE-2018-16541.html https://www.suse.com/security/cve/CVE-2018-16542.html https://www.suse.com/security/cve/CVE-2018-16543.html https://www.suse.com/security/cve/CVE-2018-16585.html https://www.suse.com/security/cve/CVE-2018-16802.html https://www.suse.com/security/cve/CVE-2018-17183.html https://bugzilla.suse.com/1106171 https://bugzilla.suse.com/1106172 https://bugzilla.suse.com/1106173 https://bugzilla.suse.com/1106195 https://bugzilla.suse.com/1107410 https://bugzilla.suse.com/1107411 https://bugzilla.suse.com/1107412 https://bugzilla.suse.com/1107413 https://bugzilla.suse.com/1107420 https://bugzilla.suse.com/1107421 https://bugzilla.suse.com/1107422 https://bugzilla.suse.com/1107423 https://bugzilla.suse.com/1107426 https://bugzilla.suse.com/1107581 https://bugzilla.suse.com/1108027 https://bugzilla.suse.com/1109105

1 0

openSUSE-SU-2018:3035-1: moderate: Security update for gitolite
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for gitolite ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3035-1 Rating: moderate References: #1108272 Cross-References: CVE-2018-16976 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gitolite fixes the following issues: Gitolite was updated to 3.6.9: - CVE-2018-16976: prevent racy access to repos in process of migration to gitolite (boo#1108272) - 'info' learns new '-p' option to show only physical repos (as opposed to wild repos) The update to 3.6.8 contains: - fix bug when deleting *all* hooks for a repo - allow trailing slashes in repo names - make pre-receive hook driver bail on non-zero exit of a pre-receive hook - allow templates in gitolite.conf (new feature) - various optimiations The update to 3.6.7 contains: - allow repo-specific hooks to be organised into subdirectories, and allow the multi-hook driver to be placed in some other location of your choice - allow simple test code to be embedded within the gitolite.conf file; see contrib/utils/testconf for how. (This goes on the client side, not on the server) - allow syslog "facility" to be changed, from the default of 'local0' - allow syslog "facility" to be changed, from the default of replaced with a space separated list of members The update to 3.6.6 contains: - simple but important fix for a future perl deprecation (perl will be removing "." from @INC in 5.24) - 'perms' now requires a '-c' to activate batch mode (should not affect interactive use but check your scripts perhaps?) - gitolite setup now accepts a '-m' option to supply a custom message (useful when it is used by a script) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1118=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1118=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1118=1 Package List: - openSUSE Leap 42.3 (noarch): gitolite-3.6.9-4.3.1 - openSUSE Leap 15.0 (noarch): gitolite-3.6.9-lp150.2.3.1 - openSUSE Backports SLE-15 (noarch): gitolite-3.6.9-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16976.html https://bugzilla.suse.com/1108272

1 0

openSUSE-RU-2018:3034-1: moderate: Recommended update for ceph
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3034-1 Rating: moderate References: #1100101 #1104331 #1105251 #1107857 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for ceph fixes the following issues: - Syntax errors in the man page for "ceph-bluestore-tool" (bsc#1100101) - Configuring PCF is failing when configuring with AWS signature 4 (bsc#1105251) - ceph-osd segfaults in safe_timer thread (bsc#1107857) - luminous: mgr/MgrClient: Protect daemon_health_metrics (bsc#1104331) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1121=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.8+git.1536505967.080f2248ff-15.1 ceph-base-12.2.8+git.1536505967.080f2248ff-15.1 ceph-base-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-common-12.2.8+git.1536505967.080f2248ff-15.1 ceph-common-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-debugsource-12.2.8+git.1536505967.080f2248ff-15.1 ceph-fuse-12.2.8+git.1536505967.080f2248ff-15.1 ceph-fuse-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mds-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mds-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mgr-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mgr-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mon-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mon-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-osd-12.2.8+git.1536505967.080f2248ff-15.1 ceph-osd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-radosgw-12.2.8+git.1536505967.080f2248ff-15.1 ceph-radosgw-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-resource-agents-12.2.8+git.1536505967.080f2248ff-15.1 ceph-test-12.2.8+git.1536505967.080f2248ff-15.1 ceph-test-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-test-debugsource-12.2.8+git.1536505967.080f2248ff-15.1 libcephfs-devel-12.2.8+git.1536505967.080f2248ff-15.1 libcephfs2-12.2.8+git.1536505967.080f2248ff-15.1 libcephfs2-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librados-devel-12.2.8+git.1536505967.080f2248ff-15.1 librados-devel-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librados2-12.2.8+git.1536505967.080f2248ff-15.1 librados2-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 libradosstriper-devel-12.2.8+git.1536505967.080f2248ff-15.1 libradosstriper1-12.2.8+git.1536505967.080f2248ff-15.1 libradosstriper1-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librbd-devel-12.2.8+git.1536505967.080f2248ff-15.1 librbd1-12.2.8+git.1536505967.080f2248ff-15.1 librbd1-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librgw-devel-12.2.8+git.1536505967.080f2248ff-15.1 librgw2-12.2.8+git.1536505967.080f2248ff-15.1 librgw2-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-ceph-compat-12.2.8+git.1536505967.080f2248ff-15.1 python-cephfs-12.2.8+git.1536505967.080f2248ff-15.1 python-cephfs-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-rados-12.2.8+git.1536505967.080f2248ff-15.1 python-rados-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-rbd-12.2.8+git.1536505967.080f2248ff-15.1 python-rbd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-rgw-12.2.8+git.1536505967.080f2248ff-15.1 python-rgw-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-ceph-argparse-12.2.8+git.1536505967.080f2248ff-15.1 python3-cephfs-12.2.8+git.1536505967.080f2248ff-15.1 python3-cephfs-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-rados-12.2.8+git.1536505967.080f2248ff-15.1 python3-rados-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-rbd-12.2.8+git.1536505967.080f2248ff-15.1 python3-rbd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-rgw-12.2.8+git.1536505967.080f2248ff-15.1 python3-rgw-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 rados-objclass-devel-12.2.8+git.1536505967.080f2248ff-15.1 rbd-fuse-12.2.8+git.1536505967.080f2248ff-15.1 rbd-fuse-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 rbd-mirror-12.2.8+git.1536505967.080f2248ff-15.1 rbd-mirror-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 rbd-nbd-12.2.8+git.1536505967.080f2248ff-15.1 rbd-nbd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 References: https://bugzilla.suse.com/1100101 https://bugzilla.suse.com/1104331 https://bugzilla.suse.com/1105251 https://bugzilla.suse.com/1107857

1 0

openSUSE-SU-2018:3015-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3015-1 Rating: moderate References: #1089039 #1097158 #1101470 #1104789 #1106197 Cross-References: CVE-2018-0732 CVE-2018-0737 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for openssl-1_0_0 to 1.0.2p fixes the following issues: These security issues were fixed: - Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information (bsc#1104789) - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039) - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158) - Make problematic ECDSA sign addition length-invariant - Add blinding to ECDSA and DSA signatures to protect against side channel attacks This non-security issue was fixed: - Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1110=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.6.1 libopenssl1_0_0-1.0.2p-lp150.2.6.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.6.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.6.1 openssl-1_0_0-1.0.2p-lp150.2.6.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.6.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.6.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.6.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.6.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-0737.html https://bugzilla.suse.com/1089039 https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1101470 https://bugzilla.suse.com/1104789 https://bugzilla.suse.com/1106197

1 0

openSUSE-SU-2018:3014-1: Security update for ImageMagick
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3014-1 Rating: low References: #1106855 #1106857 #1106858 #1106989 #1107604 #1107609 #1107612 #1107616 #1107618 #1107619 Cross-References: CVE-2018-16323 CVE-2018-16328 CVE-2018-16329 CVE-2018-16413 CVE-2018-16640 CVE-2018-16641 CVE-2018-16642 CVE-2018-16643 CVE-2018-16644 CVE-2018-16645 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for ImageMagick fixes the following security issues: - CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS (bsc#1106989) - CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS (bsc#1106858). - CVE-2018-16328: Prevent NULL pointer dereference exists in the CheckEventLogging function leading to DoS (bsc#1106857). - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM file that has a negative pixel value. If the affected code was used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data (bsc#1106855) - CVE-2018-16642: The function InsertRow allowed remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write (bsc#1107616) - CVE-2018-16640: Prevent memory leak in the function ReadOneJNGImage (bsc#1107619) - CVE-2018-16641: Prevent memory leak in the TIFFWritePhotoshopLayers function (bsc#1107618). - CVE-2018-16643: The functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage did check the return value of the fputc function, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107612) - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1108=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.15.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.15.1 ImageMagick-debugsource-7.0.7.34-lp150.2.15.1 ImageMagick-devel-7.0.7.34-lp150.2.15.1 ImageMagick-extra-7.0.7.34-lp150.2.15.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.15.1 libMagick++-devel-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.15.1 perl-PerlMagick-7.0.7.34-lp150.2.15.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.15.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.15.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.15.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2018-16323.html https://www.suse.com/security/cve/CVE-2018-16328.html https://www.suse.com/security/cve/CVE-2018-16329.html https://www.suse.com/security/cve/CVE-2018-16413.html https://www.suse.com/security/cve/CVE-2018-16640.html https://www.suse.com/security/cve/CVE-2018-16641.html https://www.suse.com/security/cve/CVE-2018-16642.html https://www.suse.com/security/cve/CVE-2018-16643.html https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-16645.html https://bugzilla.suse.com/1106855 https://bugzilla.suse.com/1106857 https://bugzilla.suse.com/1106858 https://bugzilla.suse.com/1106989 https://bugzilla.suse.com/1107604 https://bugzilla.suse.com/1107609 https://bugzilla.suse.com/1107612 https://bugzilla.suse.com/1107616 https://bugzilla.suse.com/1107618 https://bugzilla.suse.com/1107619

1 0

openSUSE-SU-2018:3013-1: moderate: Security update for openssl-1_1
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3013-1 Rating: moderate References: #1097158 #1101470 Cross-References: CVE-2018-0732 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openssl-1_1 to 1.1.0i fixes the following issues: These security issues were fixed: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158) - Make problematic ECDSA sign addition length-invariant - Add blinding to ECDSA and DSA signatures to protect against side channel attacks These non-security issues were fixed: - When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. - Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. - Fixed a text canonicalisation bug in CMS - Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1109=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_1-devel-1.1.0i-lp150.3.9.1 libopenssl1_1-1.1.0i-lp150.3.9.1 libopenssl1_1-debuginfo-1.1.0i-lp150.3.9.1 libopenssl1_1-hmac-1.1.0i-lp150.3.9.1 openssl-1_1-1.1.0i-lp150.3.9.1 openssl-1_1-debuginfo-1.1.0i-lp150.3.9.1 openssl-1_1-debugsource-1.1.0i-lp150.3.9.1 - openSUSE Leap 15.0 (noarch): libopenssl-devel-1.1.0i-lp150.2.3.1 openssl-1.1.0i-lp150.2.3.1 openssl-1_1-doc-1.1.0i-lp150.3.9.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_1-devel-32bit-1.1.0i-lp150.3.9.1 libopenssl1_1-32bit-1.1.0i-lp150.3.9.1 libopenssl1_1-32bit-debuginfo-1.1.0i-lp150.3.9.1 libopenssl1_1-hmac-32bit-1.1.0i-lp150.3.9.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1101470

1 0

openSUSE-SU-2018:3012-1: moderate: Security update for libX11
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3012-1 Rating: moderate References: #1102062 #1102068 #1102073 Cross-References: CVE-2018-14598 CVE-2018-14599 CVE-2018-14600 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libX11 fixes the following security issues: - CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (bsc#1102062) - CVE-2018-14600: The function XListExtensions interpreted a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (bsc#1102068) - CVE-2018-14598: A malicious server could have sent a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (bsc#1102073) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1107=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libX11-6-1.6.5-lp150.2.3.1 libX11-6-debuginfo-1.6.5-lp150.2.3.1 libX11-debugsource-1.6.5-lp150.2.3.1 libX11-devel-1.6.5-lp150.2.3.1 libX11-xcb1-1.6.5-lp150.2.3.1 libX11-xcb1-debuginfo-1.6.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libX11-6-32bit-1.6.5-lp150.2.3.1 libX11-6-32bit-debuginfo-1.6.5-lp150.2.3.1 libX11-devel-32bit-1.6.5-lp150.2.3.1 libX11-xcb1-32bit-1.6.5-lp150.2.3.1 libX11-xcb1-32bit-debuginfo-1.6.5-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libX11-data-1.6.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14598.html https://www.suse.com/security/cve/CVE-2018-14599.html https://www.suse.com/security/cve/CVE-2018-14600.html https://bugzilla.suse.com/1102062 https://bugzilla.suse.com/1102068 https://bugzilla.suse.com/1102073

1 0

openSUSE-SU-2018:3005-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3005-1 Rating: moderate References: #1103800 #1109822 #1109823 Cross-References: CVE-2018-14593 CVE-2018-16586 CVE-2018-16587 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for otrs to version 4.0.32 fixes the following issues: These security issues were fixed: - CVE-2018-16586: An attacker could have sent a malicious email to an OTRS system. If a logged in user opens it, the email could have caused the browser to load external image or CSS resources (bsc#1109822). - CVE-2018-16587: An attacker could have sent a malicious email to an OTRS system. If a user with admin permissions opens it, it caused deletions of arbitrary files that the OTRS web server user has write access to (bsc#1109823). - CVE-2018-14593: An attacker who is logged into OTRS as an agent may have escalated their privileges by accessing a specially crafted URL (bsc#1103800). These non-security issues were fixed: - fixed permissions file @OTRS_ROOT@/var/tmp -> @OTRS_ROOT@/var/tmp/ - ACL for Action AgentTicketBulk were inconsistent. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1106=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1106=1 Package List: - openSUSE Leap 15.0 (noarch): otrs-4.0.32-lp150.2.3.1 otrs-doc-4.0.32-lp150.2.3.1 otrs-itsm-4.0.32-lp150.2.3.1 - openSUSE Backports SLE-15 (noarch): otrs-4.0.32-bp150.3.3.1 otrs-doc-4.0.32-bp150.3.3.1 otrs-itsm-4.0.32-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-14593.html https://www.suse.com/security/cve/CVE-2018-16586.html https://www.suse.com/security/cve/CVE-2018-16587.html https://bugzilla.suse.com/1103800 https://bugzilla.suse.com/1109822 https://bugzilla.suse.com/1109823

1 0

openSUSE-SU-2018:3001-1: important: Security update for bitcoin
by opensuse-security＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Security Update: Security update for bitcoin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3001-1 Rating: important References: #1108992 Cross-References: CVE-2018-17144 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bitcoin to version 0.16.3 fixes the following issues: - CVE-2018-17144: Prevent remote denial of service (application crash) exploitable by miners via duplicate input (bsc#1108992). For additional changes please check the changelog. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1098=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1098=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1098=1 Package List: - openSUSE Leap 42.3 (x86_64): bitcoin-debugsource-0.16.3-7.3.1 bitcoin-qt5-0.16.3-7.3.1 bitcoin-qt5-debuginfo-0.16.3-7.3.1 bitcoin-test-0.16.3-7.3.1 bitcoin-test-debuginfo-0.16.3-7.3.1 bitcoin-utils-0.16.3-7.3.1 bitcoin-utils-debuginfo-0.16.3-7.3.1 bitcoind-0.16.3-7.3.1 bitcoind-debuginfo-0.16.3-7.3.1 libbitcoinconsensus-devel-0.16.3-7.3.1 libbitcoinconsensus0-0.16.3-7.3.1 libbitcoinconsensus0-debuginfo-0.16.3-7.3.1 - openSUSE Leap 15.0 (x86_64): bitcoin-debuginfo-0.16.3-lp150.2.3.1 bitcoin-debugsource-0.16.3-lp150.2.3.1 bitcoin-qt5-0.16.3-lp150.2.3.1 bitcoin-qt5-debuginfo-0.16.3-lp150.2.3.1 bitcoin-test-0.16.3-lp150.2.3.1 bitcoin-test-debuginfo-0.16.3-lp150.2.3.1 bitcoin-utils-0.16.3-lp150.2.3.1 bitcoin-utils-debuginfo-0.16.3-lp150.2.3.1 bitcoind-0.16.3-lp150.2.3.1 bitcoind-debuginfo-0.16.3-lp150.2.3.1 libbitcoinconsensus-devel-0.16.3-lp150.2.3.1 libbitcoinconsensus0-0.16.3-lp150.2.3.1 libbitcoinconsensus0-debuginfo-0.16.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): bitcoin-qt5-0.16.3-bp150.3.3.1 bitcoin-test-0.16.3-bp150.3.3.1 bitcoin-utils-0.16.3-bp150.3.3.1 bitcoind-0.16.3-bp150.3.3.1 libbitcoinconsensus-devel-0.16.3-bp150.3.3.1 libbitcoinconsensus0-0.16.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-17144.html https://bugzilla.suse.com/1108992

1 0

openSUSE-RU-2018:3000-1: moderate: Recommended update for multiple yast2 packages
by maintenance＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Recommended Update: Recommended update for multiple yast2 packages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3000-1 Rating: moderate References: #1099691 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update addresses issues in several yast2 packages: Feature added to all packages: - Added additional searchkeys to desktop file (fate#321043, bsc#1099691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1104=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-cluster-4.0.8-lp150.2.3.1 yast2-drbd-4.0.3-lp150.2.3.1 yast2-geo-cluster-4.0.4-lp150.2.3.1 yast2-iplb-4.0.1-lp150.2.3.1 References: https://bugzilla.suse.com/1099691

1 0

openSUSE-RU-2018:2999-1: important: Recommended update for gajim
by maintenance＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Recommended Update: Recommended update for gajim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2999-1 Rating: important References: #1109355 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gajim fixes the following issues: - Add missing python dependencies (boo#1109355). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1100=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1100=1 Package List: - openSUSE Leap 15.0 (noarch): gajim-1.0.3-lp150.3.6.1 gajim-lang-1.0.3-lp150.3.6.1 - openSUSE Backports SLE-15 (noarch): gajim-1.0.3-bp150.2.3.1 gajim-lang-1.0.3-bp150.2.3.1 References: https://bugzilla.suse.com/1109355

1 0

openSUSE-SU-2018:2998-1: important: Security update for texlive
by opensuse-security＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Security Update: Security update for texlive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2998-1 Rating: important References: #1109673 Cross-References: CVE-2018-17407 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for texlive fixes the following issue: - CVE-2018-17407: Prevent buffer overflow when handling of Type 1 fonts allowed arbitrary code execution when a malicious font was loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex (bsc#1109673) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1099=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libkpathsea6-6.2.2-32.3.1 libkpathsea6-debuginfo-6.2.2-32.3.1 libptexenc1-1.3.4-32.3.1 libptexenc1-debuginfo-1.3.4-32.3.1 libsynctex1-1.18-32.3.1 libsynctex1-debuginfo-1.18-32.3.1 libtexlua52-5-5.2.4-32.3.1 libtexlua52-5-debuginfo-5.2.4-32.3.1 libtexluajit2-2.1.0beta2-32.3.1 libtexluajit2-debuginfo-2.1.0beta2-32.3.1 texlive-2016.20160523-32.3.1 texlive-a2ping-bin-2016.20160523.svn27321-32.3.1 texlive-accfonts-bin-2016.20160523.svn12688-32.3.1 texlive-adhocfilelist-bin-2016.20160523.svn28038-32.3.1 texlive-afm2pl-bin-2016.20160523.svn40473-32.3.1 texlive-afm2pl-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-aleph-bin-2016.20160523.svn40987-32.3.1 texlive-aleph-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-amstex-bin-2016.20160523.svn3006-32.3.1 texlive-arara-bin-2016.20160523.svn29036-32.3.1 texlive-asymptote-bin-2016.20160523.svn41076-32.3.1 texlive-asymptote-bin-debuginfo-2016.20160523.svn41076-32.3.1 texlive-authorindex-bin-2016.20160523.svn18790-32.3.1 texlive-autosp-bin-2016.20160523.svn40473-32.3.1 texlive-autosp-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-bibexport-bin-2016.20160523.svn16219-32.3.1 texlive-bibtex-bin-2016.20160523.svn40473-32.3.1 texlive-bibtex-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-bibtex8-bin-2016.20160523.svn40473-32.3.1 texlive-bibtex8-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-bibtexu-bin-2016.20160523.svn40473-32.3.1 texlive-bibtexu-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-bin-devel-2016.20160523-32.3.1 texlive-bundledoc-bin-2016.20160523.svn17794-32.3.1 texlive-cachepic-bin-2016.20160523.svn15543-32.3.1 texlive-checkcites-bin-2016.20160523.svn25623-32.3.1 texlive-checklistings-bin-2016.20160523.svn38300-32.3.1 texlive-chktex-bin-2016.20160523.svn40473-32.3.1 texlive-chktex-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-cjk-gs-integrate-bin-2016.20160523.svn37223-32.3.1 texlive-cjkutils-bin-2016.20160523.svn40473-32.3.1 texlive-cjkutils-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-context-bin-2016.20160523.svn34112-32.3.1 texlive-convbkmk-bin-2016.20160523.svn30408-32.3.1 texlive-crossrefware-bin-2016.20160523.svn35401-32.3.1 texlive-cslatex-bin-2016.20160523.svn3006-32.3.1 texlive-csplain-bin-2016.20160523.svn33902-32.3.1 texlive-ctanify-bin-2016.20160523.svn24061-32.3.1 texlive-ctanupload-bin-2016.20160523.svn23866-32.3.1 texlive-ctie-bin-2016.20160523.svn40473-32.3.1 texlive-ctie-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-cweb-bin-2016.20160523.svn40473-32.3.1 texlive-cweb-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-cyrillic-bin-bin-2016.20160523.svn29741-32.3.1 texlive-de-macro-bin-2016.20160523.svn17399-32.3.1 texlive-debugsource-2016.20160523-32.3.1 texlive-detex-bin-2016.20160523.svn40750-32.3.1 texlive-detex-bin-debuginfo-2016.20160523.svn40750-32.3.1 texlive-devnag-bin-2016.20160523.svn40987-32.3.1 texlive-devnag-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-dosepsbin-bin-2016.20160523.svn24759-32.3.1 texlive-dtl-bin-2016.20160523.svn40473-32.3.1 texlive-dtl-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-dtxgen-bin-2016.20160523.svn29031-32.3.1 texlive-dviasm-bin-2016.20160523.svn8329-32.3.1 texlive-dvicopy-bin-2016.20160523.svn40473-32.3.1 texlive-dvicopy-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-dvidvi-bin-2016.20160523.svn40473-32.3.1 texlive-dvidvi-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-dviljk-bin-2016.20160523.svn40473-32.3.1 texlive-dviljk-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-dvipdfmx-bin-2016.20160523.svn40273-32.3.1 texlive-dvipng-bin-2016.20160523.svn40473-32.3.1 texlive-dvipng-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-dvipos-bin-2016.20160523.svn40473-32.3.1 texlive-dvipos-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-dvips-bin-2016.20160523.svn40987-32.3.1 texlive-dvips-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-dvisvgm-bin-2016.20160523.svn40987-32.3.1 texlive-dvisvgm-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-ebong-bin-2016.20160523.svn21000-32.3.1 texlive-eplain-bin-2016.20160523.svn3006-32.3.1 texlive-epspdf-bin-2016.20160523.svn29050-32.3.1 texlive-epstopdf-bin-2016.20160523.svn18336-32.3.1 texlive-exceltex-bin-2016.20160523.svn25860-32.3.1 texlive-fig4latex-bin-2016.20160523.svn14752-32.3.1 texlive-findhyph-bin-2016.20160523.svn14758-32.3.1 texlive-fontinst-bin-2016.20160523.svn29741-32.3.1 texlive-fontools-bin-2016.20160523.svn25997-32.3.1 texlive-fontware-bin-2016.20160523.svn40473-32.3.1 texlive-fontware-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-fragmaster-bin-2016.20160523.svn13663-32.3.1 texlive-getmap-bin-2016.20160523.svn34971-32.3.1 texlive-glossaries-bin-2016.20160523.svn37813-32.3.1 texlive-gregoriotex-bin-2016.20160523.svn40473-32.3.1 texlive-gregoriotex-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-gsftopk-bin-2016.20160523.svn40473-32.3.1 texlive-gsftopk-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-jadetex-bin-2016.20160523.svn3006-32.3.1 texlive-jfontmaps-bin-2016.20160523.svn29848-32.3.1 texlive-kotex-utils-bin-2016.20160523.svn32101-32.3.1 texlive-kpathsea-bin-2016.20160523.svn40473-32.3.1 texlive-kpathsea-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-kpathsea-devel-6.2.2-32.3.1 texlive-lacheck-bin-2016.20160523.svn40473-32.3.1 texlive-lacheck-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-latex-bin-bin-2016.20160523.svn14050-32.3.1 texlive-latex-git-log-bin-2016.20160523.svn30983-32.3.1 texlive-latex2man-bin-2016.20160523.svn13663-32.3.1 texlive-latexdiff-bin-2016.20160523.svn16420-32.3.1 texlive-latexfileversion-bin-2016.20160523.svn25012-32.3.1 texlive-latexindent-bin-2016.20160523.svn32150-32.3.1 texlive-latexmk-bin-2016.20160523.svn10937-32.3.1 texlive-latexpand-bin-2016.20160523.svn27025-32.3.1 texlive-lcdftypetools-bin-2016.20160523.svn40473-32.3.1 texlive-lcdftypetools-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-lilyglyphs-bin-2016.20160523.svn31696-32.3.1 texlive-listbib-bin-2016.20160523.svn26126-32.3.1 texlive-listings-ext-bin-2016.20160523.svn15093-32.3.1 texlive-lollipop-bin-2016.20160523.svn41133-32.3.1 texlive-ltxfileinfo-bin-2016.20160523.svn29005-32.3.1 texlive-ltximg-bin-2016.20160523.svn32346-32.3.1 texlive-lua2dox-bin-2016.20160523.svn29053-32.3.1 texlive-luaotfload-bin-2016.20160523.svn34647-32.3.1 texlive-luatex-bin-2016.20160523.svn41091-32.3.1 texlive-luatex-bin-debuginfo-2016.20160523.svn41091-32.3.1 texlive-m-tx-bin-2016.20160523.svn40961-32.3.1 texlive-m-tx-bin-debuginfo-2016.20160523.svn40961-32.3.1 texlive-make4ht-bin-2016.20160523.svn37750-32.3.1 texlive-makedtx-bin-2016.20160523.svn38769-32.3.1 texlive-makeindex-bin-2016.20160523.svn40473-32.3.1 texlive-makeindex-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-match_parens-bin-2016.20160523.svn23500-32.3.1 texlive-mathspic-bin-2016.20160523.svn23661-32.3.1 texlive-metafont-bin-2016.20160523.svn40987-32.3.1 texlive-metafont-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-metapost-bin-2016.20160523.svn40473-32.3.1 texlive-metapost-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-mex-bin-2016.20160523.svn3006-32.3.1 texlive-mf2pt1-bin-2016.20160523.svn23406-32.3.1 texlive-mflua-bin-2016.20160523.svn40987-32.3.1 texlive-mflua-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-mfware-bin-2016.20160523.svn40473-32.3.1 texlive-mfware-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-mkgrkindex-bin-2016.20160523.svn14428-32.3.1 texlive-mkjobtexmf-bin-2016.20160523.svn8457-32.3.1 texlive-mkpic-bin-2016.20160523.svn33688-32.3.1 texlive-mltex-bin-2016.20160523.svn3006-32.3.1 texlive-mptopdf-bin-2016.20160523.svn18674-32.3.1 texlive-multibibliography-bin-2016.20160523.svn30534-32.3.1 texlive-musixtex-bin-2016.20160523.svn37026-32.3.1 texlive-musixtnt-bin-2016.20160523.svn40473-32.3.1 texlive-musixtnt-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-omegaware-bin-2016.20160523.svn40750-32.3.1 texlive-omegaware-bin-debuginfo-2016.20160523.svn40750-32.3.1 texlive-patgen-bin-2016.20160523.svn40473-32.3.1 texlive-patgen-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-pax-bin-2016.20160523.svn10843-32.3.1 texlive-pdfbook2-bin-2016.20160523.svn37537-32.3.1 texlive-pdfcrop-bin-2016.20160523.svn14387-32.3.1 texlive-pdfjam-bin-2016.20160523.svn17868-32.3.1 texlive-pdftex-bin-2016.20160523.svn40987-32.3.1 texlive-pdftex-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-pdftools-bin-2016.20160523.svn40473-32.3.1 texlive-pdftools-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-pdfxup-bin-2016.20160523.svn40690-32.3.1 texlive-pedigree-perl-bin-2016.20160523.svn25962-32.3.1 texlive-perltex-bin-2016.20160523.svn16181-32.3.1 texlive-petri-nets-bin-2016.20160523.svn39165-32.3.1 texlive-pfarrei-bin-2016.20160523.svn29348-32.3.1 texlive-pkfix-bin-2016.20160523.svn13364-32.3.1 texlive-pkfix-helper-bin-2016.20160523.svn13663-32.3.1 texlive-platex-bin-2016.20160523.svn22859-32.3.1 texlive-pmx-bin-2016.20160523.svn41091-32.3.1 texlive-pmx-bin-debuginfo-2016.20160523.svn41091-32.3.1 texlive-pmxchords-bin-2016.20160523.svn32405-32.3.1 texlive-ps2pk-bin-2016.20160523.svn40473-32.3.1 texlive-ps2pk-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-pst-pdf-bin-2016.20160523.svn7838-32.3.1 texlive-pst2pdf-bin-2016.20160523.svn29333-32.3.1 texlive-pstools-bin-2016.20160523.svn40473-32.3.1 texlive-pstools-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-ptex-bin-2016.20160523.svn40987-32.3.1 texlive-ptex-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-ptex2pdf-bin-2016.20160523.svn29335-32.3.1 texlive-ptexenc-devel-1.3.4-32.3.1 texlive-purifyeps-bin-2016.20160523.svn13663-32.3.1 texlive-pygmentex-bin-2016.20160523.svn34996-32.3.1 texlive-pythontex-bin-2016.20160523.svn31638-32.3.1 texlive-rubik-bin-2016.20160523.svn32919-32.3.1 texlive-seetexk-bin-2016.20160523.svn40473-32.3.1 texlive-seetexk-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-splitindex-bin-2016.20160523.svn29688-32.3.1 texlive-srcredact-bin-2016.20160523.svn38710-32.3.1 texlive-sty2dtx-bin-2016.20160523.svn21215-32.3.1 texlive-svn-multi-bin-2016.20160523.svn13663-32.3.1 texlive-synctex-bin-2016.20160523.svn40473-32.3.1 texlive-synctex-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-synctex-devel-1.18-32.3.1 texlive-tetex-bin-2016.20160523.svn36770-32.3.1 texlive-tex-bin-2016.20160523.svn40987-32.3.1 texlive-tex-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-tex4ebook-bin-2016.20160523.svn37771-32.3.1 texlive-tex4ht-bin-2016.20160523.svn40473-32.3.1 texlive-tex4ht-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-texconfig-bin-2016.20160523.svn29741-32.3.1 texlive-texcount-bin-2016.20160523.svn13013-32.3.1 texlive-texdef-bin-2016.20160523.svn21802-32.3.1 texlive-texdiff-bin-2016.20160523.svn15506-32.3.1 texlive-texdirflatten-bin-2016.20160523.svn12782-32.3.1 texlive-texdoc-bin-2016.20160523.svn29741-32.3.1 texlive-texfot-bin-2016.20160523.svn33155-32.3.1 texlive-texliveonfly-bin-2016.20160523.svn24062-32.3.1 texlive-texloganalyser-bin-2016.20160523.svn13663-32.3.1 texlive-texlua-devel-5.2.4-32.3.1 texlive-texluajit-devel-2.1.0beta2-32.3.1 texlive-texsis-bin-2016.20160523.svn3006-32.3.1 texlive-texware-bin-2016.20160523.svn40473-32.3.1 texlive-texware-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-thumbpdf-bin-2016.20160523.svn6898-32.3.1 texlive-tie-bin-2016.20160523.svn40473-32.3.1 texlive-tie-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-tpic2pdftex-bin-2016.20160523.svn29741-32.3.1 texlive-ttfutils-bin-2016.20160523.svn40473-32.3.1 texlive-ttfutils-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-typeoutfileinfo-bin-2016.20160523.svn25648-32.3.1 texlive-ulqda-bin-2016.20160523.svn13663-32.3.1 texlive-uplatex-bin-2016.20160523.svn26326-32.3.1 texlive-uptex-bin-2016.20160523.svn40987-32.3.1 texlive-uptex-bin-debuginfo-2016.20160523.svn40987-32.3.1 texlive-urlbst-bin-2016.20160523.svn23262-32.3.1 texlive-vlna-bin-2016.20160523.svn40473-32.3.1 texlive-vlna-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-vpe-bin-2016.20160523.svn6897-32.3.1 texlive-web-bin-2016.20160523.svn40473-32.3.1 texlive-web-bin-debuginfo-2016.20160523.svn40473-32.3.1 texlive-xdvi-bin-2016.20160523.svn40750-32.3.1 texlive-xdvi-bin-debuginfo-2016.20160523.svn40750-32.3.1 texlive-xetex-bin-2016.20160523.svn41091-32.3.1 texlive-xetex-bin-debuginfo-2016.20160523.svn41091-32.3.1 texlive-xmltex-bin-2016.20160523.svn3006-32.3.1 texlive-yplan-bin-2016.20160523.svn34398-32.3.1 - openSUSE Leap 42.3 (noarch): perl-biber-2016.20160523.svn30357-32.3.1 texlive-biber-bin-2016.20160523.svn41193-32.3.1 texlive-diadia-bin-2016.20160523.svn37645-32.3.1 References: https://www.suse.com/security/cve/CVE-2018-17407.html https://bugzilla.suse.com/1109673

1 0

openSUSE-RU-2018:2997-1: moderate: Recommended update for yast2-users
by maintenance＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Recommended Update: Recommended update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2997-1 Rating: moderate References: #1095320 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-users fixes the following issues: - Fixed conflicting shortcuts in plugin module (bsc#1095320). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1103=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-users-4.0.6-lp150.2.3.1 yast2-users-debuginfo-4.0.6-lp150.2.3.1 yast2-users-debugsource-4.0.6-lp150.2.3.1 References: https://bugzilla.suse.com/1095320

1 0

openSUSE-SU-2018:2996-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2996-1 Rating: important References: #1110506 #1110507 Cross-References: CVE-2018-12386 CVE-2018-12387 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Mozilla Firefox to version 60.2.2esr contains the following security fixes (MFSA 2018-24): - CVE-2018-12386: Type confusion in JavaScript allowed remote code execution (bsc#1110506) - CVE-2018-12387: Array.prototype.push stack pointer vulnerability may enable exploits in the sandboxed content process (bsc#1110507) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1097=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1097=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.2.2-118.1 MozillaFirefox-branding-upstream-60.2.2-118.1 MozillaFirefox-buildsymbols-60.2.2-118.1 MozillaFirefox-debuginfo-60.2.2-118.1 MozillaFirefox-debugsource-60.2.2-118.1 MozillaFirefox-devel-60.2.2-118.1 MozillaFirefox-translations-common-60.2.2-118.1 MozillaFirefox-translations-other-60.2.2-118.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.2.2-lp150.3.23.1 MozillaFirefox-branding-upstream-60.2.2-lp150.3.23.1 MozillaFirefox-buildsymbols-60.2.2-lp150.3.23.1 MozillaFirefox-debuginfo-60.2.2-lp150.3.23.1 MozillaFirefox-debugsource-60.2.2-lp150.3.23.1 MozillaFirefox-devel-60.2.2-lp150.3.23.1 MozillaFirefox-translations-common-60.2.2-lp150.3.23.1 MozillaFirefox-translations-other-60.2.2-lp150.3.23.1 References: https://www.suse.com/security/cve/CVE-2018-12386.html https://www.suse.com/security/cve/CVE-2018-12387.html https://bugzilla.suse.com/1110506 https://bugzilla.suse.com/1110507

1 0

openSUSE-OU-2018:2995-1: moderate: Optional update for gri
by maintenance＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Optional Update: Optional update for gri ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2995-1 Rating: moderate References: #1109976 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for gri fixes issues rebuilding gri following a maintenance update for ImageMagick (boo#1109976). Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1101=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1101=1 Package List: - openSUSE Leap 15.0 (x86_64): gri-2.12.23-lp150.2.3.1 gri-debuginfo-2.12.23-lp150.2.3.1 gri-debugsource-2.12.23-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): gri-2.12.23-bp150.2.3.1 gri-debuginfo-2.12.23-bp150.2.3.1 gri-debugsource-2.12.23-bp150.2.3.1 References: https://bugzilla.suse.com/1109976

1 0

openSUSE-RU-2018:2994-1: moderate: Recommended update for openscap
by maintenance＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Recommended Update: Recommended update for openscap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2994-1 Rating: moderate References: #1091040 #1102706 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openscap fixes the following issues: - Append a \n to XCCDF fix scripts, to avoid shell scripts without linefeeds. (bsc#1102706) - remove cpe id from the sample yast2 SCAP XCCDF file, so it runs everywhere. (bsc#1091040) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1105=1 Package List: - openSUSE Leap 15.0 (x86_64): libopenscap8-1.2.16-lp150.6.3.1 libopenscap8-debuginfo-1.2.16-lp150.6.3.1 libopenscap_sce8-1.2.16-lp150.6.3.1 libopenscap_sce8-debuginfo-1.2.16-lp150.6.3.1 openscap-1.2.16-lp150.6.3.1 openscap-content-1.2.16-lp150.6.3.1 openscap-debuginfo-1.2.16-lp150.6.3.1 openscap-debugsource-1.2.16-lp150.6.3.1 openscap-devel-1.2.16-lp150.6.3.1 openscap-docker-1.2.16-lp150.6.3.1 openscap-engine-sce-1.2.16-lp150.6.3.1 openscap-extra-probes-1.2.16-lp150.6.3.1 openscap-extra-probes-debuginfo-1.2.16-lp150.6.3.1 openscap-utils-1.2.16-lp150.6.3.1 openscap-utils-debuginfo-1.2.16-lp150.6.3.1 References: https://bugzilla.suse.com/1091040 https://bugzilla.suse.com/1102706

1 0

openSUSE-OU-2018:2993-1: moderate: Optional update for ddd
by maintenance＠opensuse.org 04 Oct '18

04 Oct '18

openSUSE Optional Update: Optional update for ddd ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2993-1 Rating: moderate References: #1109976 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for ddd fixes issues rebuilding ddd following a ImageMagick update (boo#1109976). Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1102=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1102=1 Package List: - openSUSE Leap 15.0 (noarch): ddd-doc-3.3.12-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): ddd-3.3.12-lp150.2.3.1 ddd-debuginfo-3.3.12-lp150.2.3.1 ddd-debugsource-3.3.12-lp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): ddd-3.3.12-bp150.3.3.1 ddd-debuginfo-3.3.12-bp150.3.3.1 ddd-debugsource-3.3.12-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): ddd-doc-3.3.12-bp150.3.3.1 References: https://bugzilla.suse.com/1109976

1 0

openSUSE-RU-2018:2968-1: moderate: Recommended update for zsh
by maintenance＠opensuse.org 02 Oct '18

02 Oct '18

openSUSE Recommended Update: Recommended update for zsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2968-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for zsh to version 5.6.2 fixes the following issues: - Fixed that the signal SIGWINCH was being ignored when zsh is not in the foreground. - Fixed two regressions with pipelines getting backgrounded and emitting the signal SIGTTOU Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1095=1 Package List: - openSUSE Leap 15.0 (x86_64): zsh-5.6.2-lp150.2.9.1 zsh-debuginfo-5.6.2-lp150.2.9.1 zsh-debugsource-5.6.2-lp150.2.9.1 zsh-htmldoc-5.6.2-lp150.2.9.1 References:

1 0

openSUSE-RU-2018:2967-1: moderate: Recommended update for MozillaFirefox
by maintenance＠opensuse.org 02 Oct '18

02 Oct '18

openSUSE Recommended Update: Recommended update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2967-1 Rating: moderate References: #1094767 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for MozillaFirefox fixes the following issues: - Tabs may have crashed on specific websites due to undefined behavior in IPC fd-passing code (boo#1094767) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1093=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1093=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.2.1-115.1 MozillaFirefox-branding-upstream-60.2.1-115.1 MozillaFirefox-buildsymbols-60.2.1-115.1 MozillaFirefox-debuginfo-60.2.1-115.1 MozillaFirefox-debugsource-60.2.1-115.1 MozillaFirefox-devel-60.2.1-115.1 MozillaFirefox-translations-common-60.2.1-115.1 MozillaFirefox-translations-other-60.2.1-115.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.2.1-lp150.3.20.1 MozillaFirefox-branding-upstream-60.2.1-lp150.3.20.1 MozillaFirefox-buildsymbols-60.2.1-lp150.3.20.1 MozillaFirefox-debuginfo-60.2.1-lp150.3.20.1 MozillaFirefox-debugsource-60.2.1-lp150.3.20.1 MozillaFirefox-devel-60.2.1-lp150.3.20.1 MozillaFirefox-translations-common-60.2.1-lp150.3.20.1 MozillaFirefox-translations-other-60.2.1-lp150.3.20.1 References: https://bugzilla.suse.com/1094767

1 0

openSUSE-SU-2018:2966-1: important: Security update for zsh
by opensuse-security＠opensuse.org 02 Oct '18

02 Oct '18

openSUSE Security Update: Security update for zsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2966-1 Rating: important References: #1019130 #1084656 #1087026 #1089030 #1107294 #1107296 #900424 #934175 #998858 Cross-References: CVE-2018-0502 CVE-2018-1071 CVE-2018-1083 CVE-2018-1100 CVE-2018-13259 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has four fixes is now available. Description: This update for zsh to version 5.6.2 fixes the following issues: These security issues were fixed: - CVE-2018-0502: The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line (bsc#1107296) - CVE-2018-13259: Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one (bsc#1107294) - CVE-2018-1100: Prevent stack-based buffer overflow in the utils.c:checkmailpath function that allowed local attackers to execute arbitrary code in the context of another user (bsc#1089030). - CVE-2018-1071: Prevent stack-based buffer overflow in the exec.c:hashcmd() function that allowed local attackers to cause a denial of service (bsc#1084656). - CVE-2018-1083: Prevent buffer overflow in the shell autocomplete functionality that allowed local unprivileged users to create a specially crafted directory path which lead to code execution in the context of the user who tries to use autocomplete to traverse the mentioned path (bsc#1087026). - Disallow evaluation of the initial values of integer variables imported from the environment These non-security issues were fixed: - Fixed that the signal SIGWINCH was being ignored when zsh is not in the foreground. - Fixed two regressions with pipelines getting backgrounded and emitting the signal SIGTTOU - The effect of the NO_INTERACTIVE_COMMENTS option extends into $(...) and `...` command substitutions when used on the command line. - The 'exec' and 'command' precommand modifiers, and options to them, are now parsed after parameter expansion. - Functions executed by ZLE widgets no longer have their standard input closed, but redirected from /dev/null instead. - There is an option WARN_NESTED_VAR, a companion to the existing WARN_CREATE_GLOBAL that causes a warning if a function updates a variable from an enclosing scope without using typeset -g. - zmodload now has an option -s to be silent on a failure to find a module but still print other errors. - Fix typo in chflags completion - Fixed invalid git commands completion - VCS info system: vcs_info git: Avoid a fork. - Fix handling of "printf -" and "printf --" - fix broken completion for filterdiff (boo#1019130) - Unicode9 support, this needs support from your terminal to work correctly. - The new word modifier ':P' computes the physical path of the argument. - The output of "typeset -p" uses "export" commands or the "-g" option for parameters that are not local to the current scope. - vi-repeat-change can repeat user-defined widgets if the widget calls zle -f vichange. - The parameter $registers now makes the contents of vi register buffers available to user-defined widgets. - New vi-up-case and vi-down-case builtin widgets bound to gU/gu (or U/u in visual mode) for doing case conversion. - A new select-word-match function provides vim-style text objects with configurable word boundaries using the existing match-words-by-style mechanism. - Support for the conditional expression [[ -v var ]] to test if a variable is set for compatibility with other shells. - The print and printf builtins have a new option -v to assign the output to a variable. - New x: syntax in completion match specifications make it possible to disable match specifications hardcoded in completion functions. - Re-add custom zshrc and zshenv to unbreak compatibility with old usage (boo#998858). - Read /etc/profile as zsh again. - The new module zsh/param/private can be loaded to allow the shell to define parameters that are private to a function scope (i.e. are not propagated to nested functions called within this function). - The GLOB_STAR_SHORT option allows the pattern **/* to be shortened to just ** if no / follows. so **.c searches recursively for a file whose name has the suffix ".c". - The effect of the WARN_CREATE_GLOBAL option has been significantly extended, so expect it to cause additional warning messages about parameters created globally within function scope. - The print builtin has new options -x and -X to expand tabs. - Several new command completions and numerous updates to others. - Options to "fc" to segregate internal and shared history. - All emulations including "sh" use multibyte by default; several repairs to multibyte handling. - ZLE supports "bracketed paste" mode to avoid interpreting pasted newlines as accept-line. Pastes can be highlighted for visibility and to make it more obvious whether accept-line has occurred. - Improved (though still not perfect) POSIX compatibility for getopts builtin when POSIX_BUILTINS is set. - New setopt APPEND_CREATE for POSIX-compatible NO_CLOBBER behavior. - Completion of date values now displays in a calendar format when the complist module is available. Controllable by zstyle. - New parameter UNDO_LIMIT_NO for more control over ZLE undo repeat. - Several repairs/improvements to the contributed narrow-to-region ZLE function. - Many changes to child-process and signal handling to eliminate race conditions and avoid deadlocks on descriptor and memory management. - New builtin sysopen in zsh/system module for detailed control of file descriptor modes. - Fix a printf regression boo#934175 - Global aliases can be created for syntactic tokens such as command separators (";", "&", "|", "&&", "||"), redirection operators, etc. - There have been various further improvements to builtin handling with the POSIX_BUILTINS option (off by default) for compatibility with the POSIX standard. - 'whence -v' is now more informative, and 'whence -S' shows you how a full chain of symbolic links resolves to a command. - The 'p' parameter flag now allows an argument to be specified as a reference to a variable, e.g. ${(ps.$sep.)foo} to split $foo on a string given by $sep. - The option FORCE_FLOAT now forces variables, not just constants, to floating point in arithmetic expressions. - The type of an assignment in arithmetic expressions, e.g. the type seen by the variable res in $(( res = a = b )), is now more logical and C-like. - The default binding of 'u' in vi command mode has changed to undo multiple changes when invoked repeatedly. '^R' is now bound to redo changes. To revert to toggling of the last edit use: bindkey -a u vi-undo-change - Compatibility with Vim has been improved for vi editing mode. Most notably, Vim style text objects are supported and the region can be manipulated with vi commands in the same manner as Vim's visual mode. - Elements of the watch variable may now be patterns. - The logic for retrying history locking has been improved. - Fix openSUSE versions in osc completion - Add back rpm completion file (boo#900424) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1094=1 Package List: - openSUSE Leap 42.3 (x86_64): zsh-5.6.2-9.6.1 zsh-debuginfo-5.6.2-9.6.1 zsh-debugsource-5.6.2-9.6.1 zsh-htmldoc-5.6.2-9.6.1 References: https://www.suse.com/security/cve/CVE-2018-0502.html https://www.suse.com/security/cve/CVE-2018-1071.html https://www.suse.com/security/cve/CVE-2018-1083.html https://www.suse.com/security/cve/CVE-2018-1100.html https://www.suse.com/security/cve/CVE-2018-13259.html https://bugzilla.suse.com/1019130 https://bugzilla.suse.com/1084656 https://bugzilla.suse.com/1087026 https://bugzilla.suse.com/1089030 https://bugzilla.suse.com/1107294 https://bugzilla.suse.com/1107296 https://bugzilla.suse.com/900424 https://bugzilla.suse.com/934175 https://bugzilla.suse.com/998858

1 0

openSUSE-SU-2018:2958-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 01 Oct '18

01 Oct '18

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2958-1 Rating: moderate References: #1047002 #1105437 #1105459 #1105460 Cross-References: CVE-2017-10790 CVE-2018-10844 CVE-2018-10845 CVE-2018-10846 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for gnutls fixes the following security issues: - Improved mitigations against Lucky 13 class of attacks - CVE-2018-10846: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery (bsc#1105460) - CVE-2018-10845: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant (bsc#1105459) - CVE-2018-10844: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls (bsc#1105437) - CVE-2017-10790: The _asn1_check_identifier function in Libtasn1 caused a NULL pointer dereference and crash (bsc#1047002) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1092=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gnutls-3.6.2-lp150.4.3.1 gnutls-debuginfo-3.6.2-lp150.4.3.1 gnutls-debugsource-3.6.2-lp150.4.3.1 gnutls-guile-3.6.2-lp150.4.3.1 gnutls-guile-debuginfo-3.6.2-lp150.4.3.1 libgnutls-dane-devel-3.6.2-lp150.4.3.1 libgnutls-dane0-3.6.2-lp150.4.3.1 libgnutls-dane0-debuginfo-3.6.2-lp150.4.3.1 libgnutls-devel-3.6.2-lp150.4.3.1 libgnutls30-3.6.2-lp150.4.3.1 libgnutls30-debuginfo-3.6.2-lp150.4.3.1 libgnutlsxx-devel-3.6.2-lp150.4.3.1 libgnutlsxx28-3.6.2-lp150.4.3.1 libgnutlsxx28-debuginfo-3.6.2-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): libgnutls-devel-32bit-3.6.2-lp150.4.3.1 libgnutls30-32bit-3.6.2-lp150.4.3.1 libgnutls30-32bit-debuginfo-3.6.2-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-10790.html https://www.suse.com/security/cve/CVE-2018-10844.html https://www.suse.com/security/cve/CVE-2018-10845.html https://www.suse.com/security/cve/CVE-2018-10846.html https://bugzilla.suse.com/1047002 https://bugzilla.suse.com/1105437 https://bugzilla.suse.com/1105459 https://bugzilla.suse.com/1105460

1 0