November 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:3842-1: important: Security update for libwpd
by opensuse-security＠opensuse.org 21 Nov '18

21 Nov '18

openSUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3842-1 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1440=1 Package List: - openSUSE Leap 42.3 (x86_64): libwpd-0_10-10-0.10.2-11.1 libwpd-0_10-10-debuginfo-0.10.2-11.1 libwpd-debugsource-0.10.2-11.1 libwpd-devel-0.10.2-11.1 libwpd-tools-0.10.2-11.1 libwpd-tools-debuginfo-0.10.2-11.1 - openSUSE Leap 42.3 (noarch): libwpd-devel-doc-0.10.2-11.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713

1 0

openSUSE-RU-2018:3841-1: Recommended update for pgn-extract
by maintenance＠opensuse.org 21 Nov '18

21 Nov '18

openSUSE Recommended Update: Recommended update for pgn-extract ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3841-1 Rating: low References: #1116207 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pgn-extract fixes a crash when called with -h (boo#1116207) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1438=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1438=1 Package List: - openSUSE Leap 15.0 (x86_64): pgn-extract-17.55-lp150.2.3.1 pgn-extract-debuginfo-17.55-lp150.2.3.1 pgn-extract-debugsource-17.55-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pgn-extract-17.55-bp150.3.3.1 References: https://bugzilla.suse.com/1116207

1 0

openSUSE-RU-2018:3840-1: moderate: Recommended update for yast2-network
by maintenance＠opensuse.org 21 Nov '18

21 Nov '18

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3840-1 Rating: moderate References: #1095761 #1105230 #1108852 #1111925 #1113080 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for yast2-network fixes the following issues: - Fixes to the networking AutoYaST schema (bsc#1108852) * Added missed s390 device 'layer2' boolean element. - Does no longer crash with internal error when 0.0.0.0 netmask is used in the routing tab (bsc#1105230) - Activate s390 network devices before applying udev naming rules, avoiding "Invalid key/value pair in /etc/udev/rules.d/70-persistent-net.rules" (bsc#1095761) - Propose wpa_supplicant when configuring wlan (bsc#1111925) - Fix detection of peap mode (bsc#1113080) - Propose most commonly used setup for WPA by default - wicked compatible parsing of NTP servers from dhcp leases (fate#323454) - Fixes to the networking AY schema by adding missed s390 device 'layer2' boolean element (bsc#1108852) - Fix crashing with internal error when 0.0.0.0 netmask is used in the routing tab (bsc#1105230) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1439=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-network-4.0.43-lp150.2.6.1 References: https://bugzilla.suse.com/1095761 https://bugzilla.suse.com/1105230 https://bugzilla.suse.com/1108852 https://bugzilla.suse.com/1111925 https://bugzilla.suse.com/1113080

1 0

openSUSE-SU-2018:3839-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 21 Nov '18

21 Nov '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3839-1 Rating: moderate References: #1113064 Cross-References: CVE-2018-18544 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage of coders/msl.c (bsc#1113064). Non-security issues fixed: - asan_build: build ASAN included - debug_build: build more suitable for debugging This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1441=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.9.1 GraphicsMagick-devel-1.3.29-bp150.2.9.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.9.1 libGraphicsMagick++-devel-1.3.29-bp150.2.9.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.9.1 libGraphicsMagick3-config-1.3.29-bp150.2.9.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.9.1 perl-GraphicsMagick-1.3.29-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-18544.html https://bugzilla.suse.com/1113064

1 0

openSUSE-OU-2018:3838-1: Optional update to add perl-XML-Structured to the SUSE PackageHub
by maintenance＠opensuse.org 21 Nov '18

21 Nov '18

openSUSE Optional Update: Optional update to add perl-XML-Structured to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3838-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds perl-XML-Structured to the SUSE PackageHub. The perl module is used for processing XML data into Perl data structures. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1437=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): perl-XML-Structured-1.2-2.1 References:

1 0

openSUSE-SU-2018:3837-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 20 Nov '18

20 Nov '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3837-1 Rating: moderate References: #1115537 Cross-References: CVE-2018-17478 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Chromium 70.0.3538.102 and fixes security issues and bugs. Vulnerabilities fixed: - CVE-2018-17478: Out of bounds memory access in V8 (boo#1115537) - Various fixes from internal audits, fuzzing and other initiatives Packaging changes: - noto-emoji-fonts is no longer a recommended dependency Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1434=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-70.0.3538.102-182.1 chromedriver-debuginfo-70.0.3538.102-182.1 chromium-70.0.3538.102-182.1 chromium-debuginfo-70.0.3538.102-182.1 chromium-debugsource-70.0.3538.102-182.1 References: https://www.suse.com/security/cve/CVE-2018-17478.html https://bugzilla.suse.com/1115537

1 0

openSUSE-OU-2018:3836-1: moderate: Optional update to add nodejs8 to SUSE PackageHub
by maintenance＠opensuse.org 20 Nov '18

20 Nov '18

openSUSE Optional Update: Optional update to add nodejs8 to SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3836-1 Rating: moderate References: #1109141 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds nodejs8 to the SUSE PackageHub. The package is a build dependency for an upcoming Chromium update (boo#1109141). Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1435=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nodejs8-8.11.4-2.1 nodejs8-devel-8.11.4-2.1 npm8-8.11.4-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nodejs8-docs-8.11.4-2.1 References: https://bugzilla.suse.com/1109141

1 0

openSUSE-SU-2018:3835-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Nov '18

20 Nov '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3835-1 Rating: important References: #1112111 #1115537 Cross-References: CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17472 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-17477 CVE-2018-17478 CVE-2018-5179 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update contains Chromium 70.0.3538.102 and fixes security issues and bugs. Vulnerabilities fixed in 70.0.3538.102: - CVE-2018-17478: Out of bounds memory access in V8 (boo#1115537) Vulnerabilities fixed in 70.0.3538.67 (bsc#1112111): - CVE-2018-17462: Sandbox escape in AppCache - CVE-2018-17463: Remote code execution in V8 - Heap buffer overflow in Little CMS in PDFium - CVE-2018-17464: URL spoof in Omnibox - CVE-2018-17465: Use after free in V8 - CVE-2018-17466: Memory corruption in Angle - CVE-2018-17467: URL spoof in Omnibox - CVE-2018-17468: Cross-origin URL disclosure in Blink - CVE-2018-17469: Heap buffer overflow in PDFium - CVE-2018-17470: Memory corruption in GPU Internals - CVE-2018-17471: Security UI occlusion in full screen mode - CVE-2018-17473: URL spoof in Omnibox - CVE-2018-17474: Use after free in Blink - CVE-2018-17475: URL spoof in Omnibox - CVE-2018-17476: Security UI occlusion in full screen mode - CVE-2018-5179: Lack of limits on update() in ServiceWorker - CVE-2018-17477: UI spoof in Extensions This update contains the following packaging changes: - VAAPI hardware accelerated rendering is now enabled by default. - Use the system libusb-1.0 library - Use bundled harfbuzz library - Disable gnome-keyring to avoid crashes - noto-emoji-fonts is no longer a recommended dependency Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1436=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-70.0.3538.102-74.1 chromium-70.0.3538.102-74.1 References: https://www.suse.com/security/cve/CVE-2018-17462.html https://www.suse.com/security/cve/CVE-2018-17463.html https://www.suse.com/security/cve/CVE-2018-17464.html https://www.suse.com/security/cve/CVE-2018-17465.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-17467.html https://www.suse.com/security/cve/CVE-2018-17468.html https://www.suse.com/security/cve/CVE-2018-17469.html https://www.suse.com/security/cve/CVE-2018-17470.html https://www.suse.com/security/cve/CVE-2018-17471.html https://www.suse.com/security/cve/CVE-2018-17472.html https://www.suse.com/security/cve/CVE-2018-17473.html https://www.suse.com/security/cve/CVE-2018-17474.html https://www.suse.com/security/cve/CVE-2018-17475.html https://www.suse.com/security/cve/CVE-2018-17476.html https://www.suse.com/security/cve/CVE-2018-17477.html https://www.suse.com/security/cve/CVE-2018-17478.html https://www.suse.com/security/cve/CVE-2018-5179.html https://bugzilla.suse.com/1112111 https://bugzilla.suse.com/1115537

1 0

openSUSE-SU-2018:3828-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 20 Nov '18

20 Nov '18

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3828-1 Rating: moderate References: #1089087 #1114519 Cross-References: CVE-2018-3839 CVE-2018-3977 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Security issues fixed: - CVE-2018-3839: Fixed an exploitable code execution vulnerability that existed in the XCF image rendering functionality of the Simple DirectMedia Layer (bsc#1089087). - CVE-2018-3977: Fixed a possible code execution via creafted XCF image that could have caused a heap overflow (bsc#1114519). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1433=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): SDL2_image-debugsource-2.0.4-13.13.1 libSDL2_image-2_0-0-2.0.4-13.13.1 libSDL2_image-2_0-0-debuginfo-2.0.4-13.13.1 libSDL2_image-devel-2.0.4-13.13.1 - openSUSE Leap 42.3 (x86_64): libSDL2_image-2_0-0-32bit-2.0.4-13.13.1 libSDL2_image-2_0-0-debuginfo-32bit-2.0.4-13.13.1 libSDL2_image-devel-32bit-2.0.4-13.13.1 References: https://www.suse.com/security/cve/CVE-2018-3839.html https://www.suse.com/security/cve/CVE-2018-3977.html https://bugzilla.suse.com/1089087 https://bugzilla.suse.com/1114519

1 0

openSUSE-SU-2018:3827-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 20 Nov '18

20 Nov '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3827-1 Rating: moderate References: #1113064 Cross-References: CVE-2018-18544 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage of coders/msl.c (bsc#1113064). Non-security issues fixed: - asan_build: build ASAN included - debug_build: build more suitable for debugging Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1430=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-117.1 GraphicsMagick-debuginfo-1.3.25-117.1 GraphicsMagick-debugsource-1.3.25-117.1 GraphicsMagick-devel-1.3.25-117.1 libGraphicsMagick++-Q16-12-1.3.25-117.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-117.1 libGraphicsMagick++-devel-1.3.25-117.1 libGraphicsMagick-Q16-3-1.3.25-117.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-117.1 libGraphicsMagick3-config-1.3.25-117.1 libGraphicsMagickWand-Q16-2-1.3.25-117.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-117.1 perl-GraphicsMagick-1.3.25-117.1 perl-GraphicsMagick-debuginfo-1.3.25-117.1 References: https://www.suse.com/security/cve/CVE-2018-18544.html https://bugzilla.suse.com/1113064

1 0