October 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:3452-1: moderate: Security update for ntp
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3452-1 Rating: moderate References: #1083424 #1098531 #1111853 Cross-References: CVE-2018-12327 CVE-2018-7170 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: NTP was updated to 4.2.8p12 (bsc#1111853): - CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531) - CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424) Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1275=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ntp-4.2.8p12-lp150.3.3.1 ntp-debuginfo-4.2.8p12-lp150.3.3.1 ntp-debugsource-4.2.8p12-lp150.3.3.1 ntp-doc-4.2.8p12-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12327.html https://www.suse.com/security/cve/CVE-2018-7170.html https://bugzilla.suse.com/1083424 https://bugzilla.suse.com/1098531 https://bugzilla.suse.com/1111853

1 0

openSUSE-SU-2018:3451-1: moderate: Security update for rust
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for rust ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3451-1 Rating: moderate References: #1100691 Cross-References: CVE-2018-1000622 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rust fixes the following issues: - CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution This patch consists of requiring `--plugin-path` to be passed whenever `--plugin` is passed Note that rustdoc plugins will be removed entirely on 1.28.0 (bsc#1100691). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1279=1 Package List: - openSUSE Leap 15.0 (i686 x86_64): rust-1.24.1-lp150.2.4.1 rust-debuginfo-1.24.1-lp150.2.4.1 rust-debugsource-1.24.1-lp150.2.4.1 rust-doc-1.24.1-lp150.2.4.1 rust-gdb-1.24.1-lp150.2.4.1 rust-std-1.24.1-lp150.2.4.1 rust-std-debuginfo-1.24.1-lp150.2.4.1 - openSUSE Leap 15.0 (noarch): rust-src-1.24.1-lp150.2.4.1 References: https://www.suse.com/security/cve/CVE-2018-1000622.html https://bugzilla.suse.com/1100691

1 0

openSUSE-SU-2018:3449-1: important: Security update for postgresql96
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3449-1 Rating: important References: #1104199 #1104202 Cross-References: CVE-2018-10915 CVE-2018-10925 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql96 to 9.6.10 fixes the following issues: These security issues were fixed: - CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could have bypassed client-side connection security features, obtain access to higher privileged connections or potentially cause other impact SQL injection, by causing the PQescape() functions to malfunction (bsc#1104199) - CVE-2018-10925: Add missing authorization check on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could have exploited this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could have exploited this to update other columns in the same table (bsc#1104202) For addition details please see https://www.postgresql.org/docs/current/static/release-9-6-10.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1278=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql96-9.6.10-21.1 postgresql96-contrib-9.6.10-21.1 postgresql96-contrib-debuginfo-9.6.10-21.1 postgresql96-debuginfo-9.6.10-21.1 postgresql96-debugsource-9.6.10-21.1 postgresql96-devel-9.6.10-21.1 postgresql96-devel-debuginfo-9.6.10-21.1 postgresql96-libs-debugsource-9.6.10-21.1 postgresql96-plperl-9.6.10-21.1 postgresql96-plperl-debuginfo-9.6.10-21.1 postgresql96-plpython-9.6.10-21.1 postgresql96-plpython-debuginfo-9.6.10-21.1 postgresql96-pltcl-9.6.10-21.1 postgresql96-pltcl-debuginfo-9.6.10-21.1 postgresql96-server-9.6.10-21.1 postgresql96-server-debuginfo-9.6.10-21.1 postgresql96-test-9.6.10-21.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.10-21.1 References: https://www.suse.com/security/cve/CVE-2018-10915.html https://www.suse.com/security/cve/CVE-2018-10925.html https://bugzilla.suse.com/1104199 https://bugzilla.suse.com/1104202

1 0

openSUSE-SU-2018:3446-1: moderate: Security update for zziplib
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for zziplib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3446-1 Rating: moderate References: #1110687 Cross-References: CVE-2018-17828 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zziplib fixes the following issues: - CVE-2018-17828: Remove any "../" components from pathnames of extracted files to avoid path traversal during unpacking. (bsc#1110687) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1277=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libzzip-0-13-0.13.67-13.12.1 libzzip-0-13-debuginfo-0.13.67-13.12.1 zziplib-debugsource-0.13.67-13.12.1 zziplib-devel-0.13.67-13.12.1 zziplib-devel-debuginfo-0.13.67-13.12.1 - openSUSE Leap 42.3 (x86_64): libzzip-0-13-32bit-0.13.67-13.12.1 libzzip-0-13-debuginfo-32bit-0.13.67-13.12.1 zziplib-devel-32bit-0.13.67-13.12.1 zziplib-devel-debuginfo-32bit-0.13.67-13.12.1 References: https://www.suse.com/security/cve/CVE-2018-17828.html https://bugzilla.suse.com/1110687

1 0

openSUSE-SU-2018:3445-1: moderate: Security update for python-cryptography
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3445-1 Rating: moderate References: #1101820 Cross-References: CVE-2018-10903 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-cryptography fixes the following issues: - CVE-2018-10903: The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries could have caused key leakage (bsc#1101820). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1281=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): python-cryptography-debuginfo-2.1.4-lp150.3.3.1 python-cryptography-debugsource-2.1.4-lp150.3.3.1 python2-cryptography-2.1.4-lp150.3.3.1 python2-cryptography-debuginfo-2.1.4-lp150.3.3.1 python3-cryptography-2.1.4-lp150.3.3.1 python3-cryptography-debuginfo-2.1.4-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10903.html https://bugzilla.suse.com/1101820

1 0

openSUSE-SU-2018:3438-1: moderate: Security update for ntp
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3438-1 Rating: moderate References: #1083424 #1098531 #1111853 Cross-References: CVE-2018-12327 CVE-2018-7170 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for NTP to version 4.2.8p12 fixes the following vulnerabilities (bsc#1111853): - CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531) - CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424) Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1280=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ntp-4.2.8p12-31.6.1 ntp-debuginfo-4.2.8p12-31.6.1 ntp-debugsource-4.2.8p12-31.6.1 ntp-doc-4.2.8p12-31.6.1 References: https://www.suse.com/security/cve/CVE-2018-12327.html https://www.suse.com/security/cve/CVE-2018-7170.html https://bugzilla.suse.com/1083424 https://bugzilla.suse.com/1098531 https://bugzilla.suse.com/1111853

1 0

openSUSE-SU-2018:3435-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3435-1 Rating: important References: #1112852 Cross-References: CVE-2018-12389 CVE-2018-12390 CVE-2018-12392 CVE-2018-12393 CVE-2018-12395 CVE-2018-12396 CVE-2018-12397 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for Mozilla Firefox to version 60.3.0esr fixes security issues and stability bugs. The following security issues were fixed (MFSA 2018-27, boo#1112852): - CVE-2018-12392: Crash with nested event loops - CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript - CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting - CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts - CVE-2018-12397: WebExtension local file access vulnerability - CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3 - CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1268=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1268=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.3.0-122.2 MozillaFirefox-branding-upstream-60.3.0-122.2 MozillaFirefox-buildsymbols-60.3.0-122.2 MozillaFirefox-debuginfo-60.3.0-122.2 MozillaFirefox-debugsource-60.3.0-122.2 MozillaFirefox-devel-60.3.0-122.2 MozillaFirefox-translations-common-60.3.0-122.2 MozillaFirefox-translations-other-60.3.0-122.2 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.3.0-lp150.3.27.2 MozillaFirefox-branding-upstream-60.3.0-lp150.3.27.2 MozillaFirefox-buildsymbols-60.3.0-lp150.3.27.2 MozillaFirefox-debuginfo-60.3.0-lp150.3.27.2 MozillaFirefox-debugsource-60.3.0-lp150.3.27.2 MozillaFirefox-devel-60.3.0-lp150.3.27.2 MozillaFirefox-translations-common-60.3.0-lp150.3.27.2 MozillaFirefox-translations-other-60.3.0-lp150.3.27.2 References: https://www.suse.com/security/cve/CVE-2018-12389.html https://www.suse.com/security/cve/CVE-2018-12390.html https://www.suse.com/security/cve/CVE-2018-12392.html https://www.suse.com/security/cve/CVE-2018-12393.html https://www.suse.com/security/cve/CVE-2018-12395.html https://www.suse.com/security/cve/CVE-2018-12396.html https://www.suse.com/security/cve/CVE-2018-12397.html https://bugzilla.suse.com/1112852

1 0

openSUSE-RU-2018:3434-1: Recommended update for NetworkManager
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3434-1 Rating: low References: #1103477 #960153 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for NetworkManager provides the following fixes: - Change NetworkManager so that after spawning netconfig it lets it exit by itself instead of killing it after 2000ms. This prevents NetworkManager from rewriting /etc/resolv.conf. (bsc#960153) - Make sure addresses with valid leases are used even if the server is not online. (bsc#1103477) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1273=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): NetworkManager-1.0.12-7.3.1 NetworkManager-debuginfo-1.0.12-7.3.1 NetworkManager-debugsource-1.0.12-7.3.1 NetworkManager-devel-1.0.12-7.3.1 libnm-glib-vpn1-1.0.12-7.3.1 libnm-glib-vpn1-debuginfo-1.0.12-7.3.1 libnm-glib4-1.0.12-7.3.1 libnm-glib4-debuginfo-1.0.12-7.3.1 libnm-util2-1.0.12-7.3.1 libnm-util2-debuginfo-1.0.12-7.3.1 libnm0-1.0.12-7.3.1 libnm0-debuginfo-1.0.12-7.3.1 typelib-1_0-NM-1_0-1.0.12-7.3.1 typelib-1_0-NMClient-1_0-1.0.12-7.3.1 typelib-1_0-NetworkManager-1_0-1.0.12-7.3.1 - openSUSE Leap 42.3 (x86_64): NetworkManager-devel-32bit-1.0.12-7.3.1 libnm-glib-vpn1-32bit-1.0.12-7.3.1 libnm-glib-vpn1-debuginfo-32bit-1.0.12-7.3.1 libnm-glib4-32bit-1.0.12-7.3.1 libnm-glib4-debuginfo-32bit-1.0.12-7.3.1 libnm-util2-32bit-1.0.12-7.3.1 libnm-util2-debuginfo-32bit-1.0.12-7.3.1 - openSUSE Leap 42.3 (noarch): NetworkManager-branding-upstream-1.0.12-7.3.1 NetworkManager-lang-1.0.12-7.3.1 References: https://bugzilla.suse.com/1103477 https://bugzilla.suse.com/960153

1 0

openSUSE-RU-2018:3432-1: important: Recommended update for systemd
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3432-1 Rating: important References: #1015254 #1091677 #1093753 #1105031 #1107640 #1107941 #1109197 #991901 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for systemd fixes the following issues: - detect-virt: do not try to read all of /proc/cpuinfo (bsc#1109197) - emergency: make sure console password agents don't interfere with the emergency shell - units: remove udev control socket when systemd stops the socket unit (#4039) (bsc#1015254) - man: document that 'nofail' also has an effect on ordering - journald: take leading spaces into account in syslog_parse_identifier - journal: do not remove multiple spaces after identifier in syslog message - syslog: fix segfault in syslog_parse_priority() - journal: fix syslog_parse_identifier() - tmpfiles: don't adjust qgroups on existing subvolumes (bsc#1093753) - socket-util: attempt SO_RCVBUFFORCE/SO_SNDBUFFORCE only if SO_RCVBUF/SO_SNDBUF fails (bsc#991901) - user@.service: don't kill user manager at runlevel switch (bsc#1091677) - units: make sure user@.service runs with dbus still up - fix race between daemon-reload and other commands (bsc#1105031) - nspawn: always use mode 555 for /sys (bsc#1107640) - cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) - Enable or disable machines.target according to the presets (bsc#1107941) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1272=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-59.1 libsystemd0-debuginfo-228-59.1 libsystemd0-mini-228-59.1 libsystemd0-mini-debuginfo-228-59.1 libudev-devel-228-59.1 libudev-mini-devel-228-59.1 libudev-mini1-228-59.1 libudev-mini1-debuginfo-228-59.1 libudev1-228-59.1 libudev1-debuginfo-228-59.1 nss-myhostname-228-59.1 nss-myhostname-debuginfo-228-59.1 nss-mymachines-228-59.1 nss-mymachines-debuginfo-228-59.1 systemd-228-59.1 systemd-debuginfo-228-59.1 systemd-debugsource-228-59.1 systemd-devel-228-59.1 systemd-logger-228-59.1 systemd-mini-228-59.1 systemd-mini-debuginfo-228-59.1 systemd-mini-debugsource-228-59.1 systemd-mini-devel-228-59.1 systemd-mini-sysvinit-228-59.1 systemd-sysvinit-228-59.1 udev-228-59.1 udev-debuginfo-228-59.1 udev-mini-228-59.1 udev-mini-debuginfo-228-59.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-59.1 libsystemd0-debuginfo-32bit-228-59.1 libudev1-32bit-228-59.1 libudev1-debuginfo-32bit-228-59.1 nss-myhostname-32bit-228-59.1 nss-myhostname-debuginfo-32bit-228-59.1 systemd-32bit-228-59.1 systemd-debuginfo-32bit-228-59.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-59.1 systemd-mini-bash-completion-228-59.1 References: https://bugzilla.suse.com/1015254 https://bugzilla.suse.com/1091677 https://bugzilla.suse.com/1093753 https://bugzilla.suse.com/1105031 https://bugzilla.suse.com/1107640 https://bugzilla.suse.com/1107941 https://bugzilla.suse.com/1109197 https://bugzilla.suse.com/991901

1 0

openSUSE-RU-2018:3428-1: moderate: Recommended update for iotop
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for iotop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3428-1 Rating: moderate References: #1094694 #1094823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for iotop provides the following fix: - Fix a crash when /proc/*/status doesn't have the tab character or when it has invalid lines. (bsc#1094823, bsc#1094694) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1271=1 Package List: - openSUSE Leap 15.0 (noarch): iotop-0.6-lp150.3.3.1 References: https://bugzilla.suse.com/1094694 https://bugzilla.suse.com/1094823

1 0