October 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:3041-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3041-1 Rating: moderate References: #1040770 #1056756 #1075525 #1106048 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for perf provides the following fixes: - Re-add dependency on libebl on PPC64le. (bsc#1106048) - Support crystall ridge / far / near memory indication in PEBS. (fate#325127) - Add necessary power pvr support. (bsc#1075525) - Fix listing PMU events. They were not listed because pvr code is missing for POWER9. (bsc#1075525) - Add perf scripting support for ppc64le. (bsc#1056756) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1120=1 Package List: - openSUSE Leap 15.0 (x86_64): perf-4.12.14-lp150.8.6.1 perf-debuginfo-4.12.14-lp150.8.6.1 perf-debugsource-4.12.14-lp150.8.6.1 References: https://bugzilla.suse.com/1040770 https://bugzilla.suse.com/1056756 https://bugzilla.suse.com/1075525 https://bugzilla.suse.com/1106048

1 0

openSUSE-RU-2018:3040-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3040-1 Rating: moderate References: #1056686 #1069737 #1096012 #1101624 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for perf provides the following fixes: - POWER9: Fix a problem that was causing perf uprobe with return to fail to record samples when probed on userspace code. (bsc#1096012) - Update PMU event descriptions for Power9 CPUs per IBM request. (bsc#1101624, bsc#1056686, bsc#1069737) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1119=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): perf-4.4.155-53.1 perf-debuginfo-4.4.155-53.1 perf-debugsource-4.4.155-53.1 References: https://bugzilla.suse.com/1056686 https://bugzilla.suse.com/1069737 https://bugzilla.suse.com/1096012 https://bugzilla.suse.com/1101624

1 0

openSUSE-RU-2018:3039-1: Recommended update for sudo
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3039-1 Rating: low References: #1097643 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sudo fixes the following issues: - fix permissions for /var/lib/sudo and /var/lib/sudo/ts (bsc#1097643) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1115=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): sudo-1.8.22-lp150.3.3.1 sudo-debuginfo-1.8.22-lp150.3.3.1 sudo-debugsource-1.8.22-lp150.3.3.1 sudo-devel-1.8.22-lp150.3.3.1 sudo-test-1.8.22-lp150.3.3.1 References: https://bugzilla.suse.com/1097643

1 0

openSUSE-SU-2018:3038-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3038-1 Rating: important References: #1106171 #1106172 #1106173 #1106195 #1107410 #1107411 #1107412 #1107413 #1107420 #1107421 #1107422 #1107423 #1107426 #1107581 #1108027 #1109105 Cross-References: CVE-2018-15908 CVE-2018-15909 CVE-2018-15910 CVE-2018-15911 CVE-2018-16509 CVE-2018-16510 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585 CVE-2018-16802 CVE-2018-17183 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for ghostscript to version 9.25 fixes the following issues: These security issues were fixed: - CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (bsc#1109105) - CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code (bsc#1106172). - CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files (bsc#1106171). - CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code (bsc#1106173). - CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code (bsc#1106195). - CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107412). - CVE-2018-16509: Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction (bsc#1107410). - CVE-2018-16510: Incorrect exec stack handling in the "CS" and "SC" PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact (bsc#1107411). - CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter (bsc#1107413). - CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter (bsc#1107421). - CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107420). - CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable (bsc#1107422). - CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact (bsc#1107423). - CVE-2018-16511: A type confusion in "ztype" could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107426). - CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing (e.g., after the startup phase). This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107581). - CVE-2018-16802: Incorrect "restoration of privilege" checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509 (bsc#1108027). These non-security issues were fixed: * Fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files). * Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--' For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1123=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ghostscript-9.25-lp150.2.6.1 ghostscript-debuginfo-9.25-lp150.2.6.1 ghostscript-debugsource-9.25-lp150.2.6.1 ghostscript-devel-9.25-lp150.2.6.1 ghostscript-mini-9.25-lp150.2.6.1 ghostscript-mini-debuginfo-9.25-lp150.2.6.1 ghostscript-mini-debugsource-9.25-lp150.2.6.1 ghostscript-mini-devel-9.25-lp150.2.6.1 ghostscript-x11-9.25-lp150.2.6.1 ghostscript-x11-debuginfo-9.25-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libspectre-debugsource-0.2.8-lp150.2.3.1 libspectre-devel-0.2.8-lp150.2.3.1 libspectre1-0.2.8-lp150.2.3.1 libspectre1-debuginfo-0.2.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-15908.html https://www.suse.com/security/cve/CVE-2018-15909.html https://www.suse.com/security/cve/CVE-2018-15910.html https://www.suse.com/security/cve/CVE-2018-15911.html https://www.suse.com/security/cve/CVE-2018-16509.html https://www.suse.com/security/cve/CVE-2018-16510.html https://www.suse.com/security/cve/CVE-2018-16511.html https://www.suse.com/security/cve/CVE-2018-16513.html https://www.suse.com/security/cve/CVE-2018-16539.html https://www.suse.com/security/cve/CVE-2018-16540.html https://www.suse.com/security/cve/CVE-2018-16541.html https://www.suse.com/security/cve/CVE-2018-16542.html https://www.suse.com/security/cve/CVE-2018-16543.html https://www.suse.com/security/cve/CVE-2018-16585.html https://www.suse.com/security/cve/CVE-2018-16802.html https://www.suse.com/security/cve/CVE-2018-17183.html https://bugzilla.suse.com/1106171 https://bugzilla.suse.com/1106172 https://bugzilla.suse.com/1106173 https://bugzilla.suse.com/1106195 https://bugzilla.suse.com/1107410 https://bugzilla.suse.com/1107411 https://bugzilla.suse.com/1107412 https://bugzilla.suse.com/1107413 https://bugzilla.suse.com/1107420 https://bugzilla.suse.com/1107421 https://bugzilla.suse.com/1107422 https://bugzilla.suse.com/1107423 https://bugzilla.suse.com/1107426 https://bugzilla.suse.com/1107581 https://bugzilla.suse.com/1108027 https://bugzilla.suse.com/1109105

1 0

openSUSE-RU-2018:3037-1: Recommended update for yast2-add-on
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for yast2-add-on ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3037-1 Rating: low References: #1102705 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-add-on provides the following fixes: - Do not show the main dialog when it is immediately skipped. (bsc#1102705) - Added additional search keys to desktop file. (fate#321043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1116=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-add-on-4.0.10-lp150.2.3.1 References: https://bugzilla.suse.com/1102705

1 0

openSUSE-SU-2018:3036-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3036-1 Rating: important References: #1106171 #1106172 #1106173 #1106195 #1107410 #1107411 #1107412 #1107413 #1107420 #1107421 #1107422 #1107423 #1107426 #1107581 #1108027 #1109105 Cross-References: CVE-2018-15908 CVE-2018-15909 CVE-2018-15910 CVE-2018-15911 CVE-2018-16509 CVE-2018-16510 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585 CVE-2018-16802 CVE-2018-17183 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for ghostscript to version 9.25 fixes the following issues: These security issues were fixed: - CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (bsc#1109105) - CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code (bsc#1106172). - CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files (bsc#1106171). - CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code (bsc#1106173). - CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code (bsc#1106195). - CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107412). - CVE-2018-16509: Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction (bsc#1107410). - CVE-2018-16510: Incorrect exec stack handling in the "CS" and "SC" PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact (bsc#1107411). - CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter (bsc#1107413). - CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter (bsc#1107421). - CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107420). - CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable (bsc#1107422). - CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact (bsc#1107423). - CVE-2018-16511: A type confusion in "ztype" could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107426). - CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing (e.g., after the startup phase). This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107581). - CVE-2018-16802: Incorrect "restoration of privilege" checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509 (bsc#1108027). These non-security issues were fixed: * Fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files). * Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--' For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm and the changes file of the package. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1122=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ghostscript-9.25-14.9.1 ghostscript-debuginfo-9.25-14.9.1 ghostscript-debugsource-9.25-14.9.1 ghostscript-devel-9.25-14.9.1 ghostscript-mini-9.25-14.9.1 ghostscript-mini-debuginfo-9.25-14.9.1 ghostscript-mini-debugsource-9.25-14.9.1 ghostscript-mini-devel-9.25-14.9.1 ghostscript-x11-9.25-14.9.1 ghostscript-x11-debuginfo-9.25-14.9.1 References: https://www.suse.com/security/cve/CVE-2018-15908.html https://www.suse.com/security/cve/CVE-2018-15909.html https://www.suse.com/security/cve/CVE-2018-15910.html https://www.suse.com/security/cve/CVE-2018-15911.html https://www.suse.com/security/cve/CVE-2018-16509.html https://www.suse.com/security/cve/CVE-2018-16510.html https://www.suse.com/security/cve/CVE-2018-16511.html https://www.suse.com/security/cve/CVE-2018-16513.html https://www.suse.com/security/cve/CVE-2018-16539.html https://www.suse.com/security/cve/CVE-2018-16540.html https://www.suse.com/security/cve/CVE-2018-16541.html https://www.suse.com/security/cve/CVE-2018-16542.html https://www.suse.com/security/cve/CVE-2018-16543.html https://www.suse.com/security/cve/CVE-2018-16585.html https://www.suse.com/security/cve/CVE-2018-16802.html https://www.suse.com/security/cve/CVE-2018-17183.html https://bugzilla.suse.com/1106171 https://bugzilla.suse.com/1106172 https://bugzilla.suse.com/1106173 https://bugzilla.suse.com/1106195 https://bugzilla.suse.com/1107410 https://bugzilla.suse.com/1107411 https://bugzilla.suse.com/1107412 https://bugzilla.suse.com/1107413 https://bugzilla.suse.com/1107420 https://bugzilla.suse.com/1107421 https://bugzilla.suse.com/1107422 https://bugzilla.suse.com/1107423 https://bugzilla.suse.com/1107426 https://bugzilla.suse.com/1107581 https://bugzilla.suse.com/1108027 https://bugzilla.suse.com/1109105

1 0

openSUSE-SU-2018:3035-1: moderate: Security update for gitolite
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for gitolite ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3035-1 Rating: moderate References: #1108272 Cross-References: CVE-2018-16976 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gitolite fixes the following issues: Gitolite was updated to 3.6.9: - CVE-2018-16976: prevent racy access to repos in process of migration to gitolite (boo#1108272) - 'info' learns new '-p' option to show only physical repos (as opposed to wild repos) The update to 3.6.8 contains: - fix bug when deleting *all* hooks for a repo - allow trailing slashes in repo names - make pre-receive hook driver bail on non-zero exit of a pre-receive hook - allow templates in gitolite.conf (new feature) - various optimiations The update to 3.6.7 contains: - allow repo-specific hooks to be organised into subdirectories, and allow the multi-hook driver to be placed in some other location of your choice - allow simple test code to be embedded within the gitolite.conf file; see contrib/utils/testconf for how. (This goes on the client side, not on the server) - allow syslog "facility" to be changed, from the default of 'local0' - allow syslog "facility" to be changed, from the default of replaced with a space separated list of members The update to 3.6.6 contains: - simple but important fix for a future perl deprecation (perl will be removing "." from @INC in 5.24) - 'perms' now requires a '-c' to activate batch mode (should not affect interactive use but check your scripts perhaps?) - gitolite setup now accepts a '-m' option to supply a custom message (useful when it is used by a script) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1118=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1118=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1118=1 Package List: - openSUSE Leap 42.3 (noarch): gitolite-3.6.9-4.3.1 - openSUSE Leap 15.0 (noarch): gitolite-3.6.9-lp150.2.3.1 - openSUSE Backports SLE-15 (noarch): gitolite-3.6.9-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16976.html https://bugzilla.suse.com/1108272

1 0

openSUSE-RU-2018:3034-1: moderate: Recommended update for ceph
by maintenance＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Recommended Update: Recommended update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3034-1 Rating: moderate References: #1100101 #1104331 #1105251 #1107857 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for ceph fixes the following issues: - Syntax errors in the man page for "ceph-bluestore-tool" (bsc#1100101) - Configuring PCF is failing when configuring with AWS signature 4 (bsc#1105251) - ceph-osd segfaults in safe_timer thread (bsc#1107857) - luminous: mgr/MgrClient: Protect daemon_health_metrics (bsc#1104331) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1121=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.8+git.1536505967.080f2248ff-15.1 ceph-base-12.2.8+git.1536505967.080f2248ff-15.1 ceph-base-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-common-12.2.8+git.1536505967.080f2248ff-15.1 ceph-common-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-debugsource-12.2.8+git.1536505967.080f2248ff-15.1 ceph-fuse-12.2.8+git.1536505967.080f2248ff-15.1 ceph-fuse-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mds-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mds-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mgr-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mgr-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mon-12.2.8+git.1536505967.080f2248ff-15.1 ceph-mon-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-osd-12.2.8+git.1536505967.080f2248ff-15.1 ceph-osd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-radosgw-12.2.8+git.1536505967.080f2248ff-15.1 ceph-radosgw-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-resource-agents-12.2.8+git.1536505967.080f2248ff-15.1 ceph-test-12.2.8+git.1536505967.080f2248ff-15.1 ceph-test-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 ceph-test-debugsource-12.2.8+git.1536505967.080f2248ff-15.1 libcephfs-devel-12.2.8+git.1536505967.080f2248ff-15.1 libcephfs2-12.2.8+git.1536505967.080f2248ff-15.1 libcephfs2-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librados-devel-12.2.8+git.1536505967.080f2248ff-15.1 librados-devel-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librados2-12.2.8+git.1536505967.080f2248ff-15.1 librados2-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 libradosstriper-devel-12.2.8+git.1536505967.080f2248ff-15.1 libradosstriper1-12.2.8+git.1536505967.080f2248ff-15.1 libradosstriper1-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librbd-devel-12.2.8+git.1536505967.080f2248ff-15.1 librbd1-12.2.8+git.1536505967.080f2248ff-15.1 librbd1-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 librgw-devel-12.2.8+git.1536505967.080f2248ff-15.1 librgw2-12.2.8+git.1536505967.080f2248ff-15.1 librgw2-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-ceph-compat-12.2.8+git.1536505967.080f2248ff-15.1 python-cephfs-12.2.8+git.1536505967.080f2248ff-15.1 python-cephfs-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-rados-12.2.8+git.1536505967.080f2248ff-15.1 python-rados-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-rbd-12.2.8+git.1536505967.080f2248ff-15.1 python-rbd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python-rgw-12.2.8+git.1536505967.080f2248ff-15.1 python-rgw-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-ceph-argparse-12.2.8+git.1536505967.080f2248ff-15.1 python3-cephfs-12.2.8+git.1536505967.080f2248ff-15.1 python3-cephfs-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-rados-12.2.8+git.1536505967.080f2248ff-15.1 python3-rados-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-rbd-12.2.8+git.1536505967.080f2248ff-15.1 python3-rbd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 python3-rgw-12.2.8+git.1536505967.080f2248ff-15.1 python3-rgw-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 rados-objclass-devel-12.2.8+git.1536505967.080f2248ff-15.1 rbd-fuse-12.2.8+git.1536505967.080f2248ff-15.1 rbd-fuse-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 rbd-mirror-12.2.8+git.1536505967.080f2248ff-15.1 rbd-mirror-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 rbd-nbd-12.2.8+git.1536505967.080f2248ff-15.1 rbd-nbd-debuginfo-12.2.8+git.1536505967.080f2248ff-15.1 References: https://bugzilla.suse.com/1100101 https://bugzilla.suse.com/1104331 https://bugzilla.suse.com/1105251 https://bugzilla.suse.com/1107857

1 0

openSUSE-SU-2018:3015-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3015-1 Rating: moderate References: #1089039 #1097158 #1101470 #1104789 #1106197 Cross-References: CVE-2018-0732 CVE-2018-0737 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for openssl-1_0_0 to 1.0.2p fixes the following issues: These security issues were fixed: - Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information (bsc#1104789) - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039) - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158) - Make problematic ECDSA sign addition length-invariant - Add blinding to ECDSA and DSA signatures to protect against side channel attacks This non-security issue was fixed: - Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1110=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.6.1 libopenssl1_0_0-1.0.2p-lp150.2.6.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.6.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.6.1 openssl-1_0_0-1.0.2p-lp150.2.6.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.6.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.6.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.6.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.6.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.6.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-0737.html https://bugzilla.suse.com/1089039 https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1101470 https://bugzilla.suse.com/1104789 https://bugzilla.suse.com/1106197

1 0

openSUSE-SU-2018:3014-1: Security update for ImageMagick
by opensuse-security＠opensuse.org 05 Oct '18

05 Oct '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3014-1 Rating: low References: #1106855 #1106857 #1106858 #1106989 #1107604 #1107609 #1107612 #1107616 #1107618 #1107619 Cross-References: CVE-2018-16323 CVE-2018-16328 CVE-2018-16329 CVE-2018-16413 CVE-2018-16640 CVE-2018-16641 CVE-2018-16642 CVE-2018-16643 CVE-2018-16644 CVE-2018-16645 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for ImageMagick fixes the following security issues: - CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS (bsc#1106989) - CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS (bsc#1106858). - CVE-2018-16328: Prevent NULL pointer dereference exists in the CheckEventLogging function leading to DoS (bsc#1106857). - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM file that has a negative pixel value. If the affected code was used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data (bsc#1106855) - CVE-2018-16642: The function InsertRow allowed remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write (bsc#1107616) - CVE-2018-16640: Prevent memory leak in the function ReadOneJNGImage (bsc#1107619) - CVE-2018-16641: Prevent memory leak in the TIFFWritePhotoshopLayers function (bsc#1107618). - CVE-2018-16643: The functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage did check the return value of the fputc function, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107612) - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1108=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.15.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.15.1 ImageMagick-debugsource-7.0.7.34-lp150.2.15.1 ImageMagick-devel-7.0.7.34-lp150.2.15.1 ImageMagick-extra-7.0.7.34-lp150.2.15.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.15.1 libMagick++-devel-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.15.1 perl-PerlMagick-7.0.7.34-lp150.2.15.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.15.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.15.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.15.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.15.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.15.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.15.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2018-16323.html https://www.suse.com/security/cve/CVE-2018-16328.html https://www.suse.com/security/cve/CVE-2018-16329.html https://www.suse.com/security/cve/CVE-2018-16413.html https://www.suse.com/security/cve/CVE-2018-16640.html https://www.suse.com/security/cve/CVE-2018-16641.html https://www.suse.com/security/cve/CVE-2018-16642.html https://www.suse.com/security/cve/CVE-2018-16643.html https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-16645.html https://bugzilla.suse.com/1106855 https://bugzilla.suse.com/1106857 https://bugzilla.suse.com/1106858 https://bugzilla.suse.com/1106989 https://bugzilla.suse.com/1107604 https://bugzilla.suse.com/1107609 https://bugzilla.suse.com/1107612 https://bugzilla.suse.com/1107616 https://bugzilla.suse.com/1107618 https://bugzilla.suse.com/1107619

1 0