December 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:4051-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4051-1 Rating: important References: #1110949 #1114729 Cross-References: CVE-2018-17456 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libgit2 fixes the following issues: Security issue fixed: - CVE-2018-17456: Submodule URLs and paths with a leading "-" are now ignored to avoid injecting options into library consumers that perform recursive clones (bsc#1110949). Non-security issues fixed: - Version update to version 0.26.8 (bsc#1114729). - Full changelog can be found at: * https://github.com/libgit2/libgit2/releases/tag/v0.26.8 * https://github.com/libgit2/libgit2/releases/tag/v0.26.7 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1517=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgit2-26-0.26.8-lp150.2.6.1 libgit2-26-debuginfo-0.26.8-lp150.2.6.1 libgit2-debugsource-0.26.8-lp150.2.6.1 libgit2-devel-0.26.8-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libgit2-26-32bit-0.26.8-lp150.2.6.1 libgit2-26-32bit-debuginfo-0.26.8-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-17456.html https://bugzilla.suse.com/1110949 https://bugzilla.suse.com/1114729

1 0

openSUSE-SU-2018:4050-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4050-1 Rating: moderate References: #1100078 #1112209 #1113534 #1113652 #1113742 Cross-References: CVE-2018-0734 CVE-2018-5407 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for openssl-1_0_0 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes "PortSmash" (bsc#1113534). Non-security issues fixed: - Added missing timing side channel patch for DSA signature generation (bsc#1113742). - Set TLS version to 0 in msg_callback for record messages to avoid confusing applications (bsc#1100078). - Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1518=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.9.1 libopenssl1_0_0-1.0.2p-lp150.2.9.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.9.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.9.1 openssl-1_0_0-1.0.2p-lp150.2.9.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.9.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.9.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.9.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.9.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.9.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1100078 https://bugzilla.suse.com/1112209 https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1113742

1 0

openSUSE-RU-2018:4049-1: moderate: Recommended update for skopeo
by maintenance＠opensuse.org 08 Dec '18

08 Dec '18

openSUSE Recommended Update: Recommended update for skopeo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4049-1 Rating: moderate References: #1115165 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for skopeo to version 0.1.32 adds the following feature: - implement `skopeo sync` command (bsc#1115165) This update also adds the package libcontainers-common as a new dependency. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1514=1 Package List: - openSUSE Leap 15.0 (noarch): libcontainers-common-0.0.1-lp150.2.1 - openSUSE Leap 15.0 (x86_64): skopeo-0.1.32-lp150.3.3.1 skopeo-debuginfo-0.1.32-lp150.3.3.1 skopeo-debugsource-0.1.32-lp150.3.3.1 References: https://bugzilla.suse.com/1115165

1 0

openSUSE-RU-2018:4048-1: moderate: Recommended update for fwupdate
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for fwupdate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4048-1 Rating: moderate References: #1112832 #1113008 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for fwupdate fixes the following issues: - Add patch to avoid adding headers to FMP capsules (bsc#1113008) - Add patch to keep the debug variable - Amend the spec file to avoid fwup*.efi from being removed mistakenly (bsc#1112832) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1500=1 Package List: - openSUSE Leap 15.0 (x86_64): fwupdate-9+git21.gcd8f7d7-lp150.5.3.1 fwupdate-debuginfo-9+git21.gcd8f7d7-lp150.5.3.1 fwupdate-debugsource-9+git21.gcd8f7d7-lp150.5.3.1 fwupdate-devel-9+git21.gcd8f7d7-lp150.5.3.1 fwupdate-efi-9+git21.gcd8f7d7-lp150.5.3.1 fwupdate-efi-debuginfo-9+git21.gcd8f7d7-lp150.5.3.1 libfwup1-9+git21.gcd8f7d7-lp150.5.3.1 libfwup1-debuginfo-9+git21.gcd8f7d7-lp150.5.3.1 References: https://bugzilla.suse.com/1112832 https://bugzilla.suse.com/1113008

1 0

openSUSE-RU-2018:4047-1: moderate: Recommended update for glibc
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4047-1 Rating: moderate References: #1105236 #1110661 #1112858 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for glibc fixes the following issues: - Added more checks for valid ld.so.cache file (bsc#1110661) - Rewrite elf_machine_load_address using _DYNAMIC symbol (bsc#1112858) - Always use __IPC_64 on powerpc as required by the kernel (bsc#1105236) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1499=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): glibc-2.22-22.1 glibc-debuginfo-2.22-22.1 glibc-debugsource-2.22-22.1 glibc-devel-2.22-22.1 glibc-devel-debuginfo-2.22-22.1 glibc-devel-static-2.22-22.1 glibc-extra-2.22-22.1 glibc-extra-debuginfo-2.22-22.1 glibc-locale-2.22-22.1 glibc-locale-debuginfo-2.22-22.1 glibc-profile-2.22-22.1 glibc-utils-2.22-22.1 glibc-utils-debuginfo-2.22-22.1 glibc-utils-debugsource-2.22-22.1 nscd-2.22-22.1 nscd-debuginfo-2.22-22.1 - openSUSE Leap 42.3 (noarch): glibc-html-2.22-22.1 glibc-i18ndata-2.22-22.1 glibc-info-2.22-22.1 - openSUSE Leap 42.3 (x86_64): glibc-32bit-2.22-22.2 glibc-debuginfo-32bit-2.22-22.2 glibc-devel-32bit-2.22-22.2 glibc-devel-debuginfo-32bit-2.22-22.2 glibc-devel-static-32bit-2.22-22.2 glibc-locale-32bit-2.22-22.2 glibc-locale-debuginfo-32bit-2.22-22.2 glibc-profile-32bit-2.22-22.2 glibc-utils-32bit-2.22-22.1 glibc-utils-debuginfo-32bit-2.22-22.1 - openSUSE Leap 42.3 (i686): glibc-2.22-22.2 glibc-debuginfo-2.22-22.2 glibc-debugsource-2.22-22.2 glibc-devel-2.22-22.2 glibc-devel-debuginfo-2.22-22.2 glibc-devel-static-2.22-22.2 glibc-locale-2.22-22.2 glibc-locale-debuginfo-2.22-22.2 glibc-profile-2.22-22.2 - openSUSE Leap 42.3 (i586): glibc-obsolete-2.22-22.1 glibc-obsolete-debuginfo-2.22-22.1 References: https://bugzilla.suse.com/1105236 https://bugzilla.suse.com/1110661 https://bugzilla.suse.com/1112858

1 0

openSUSE-SU-2018:4046-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4046-1 Rating: moderate References: #1115416 Cross-References: CVE-2018-19141 CVE-2018-19143 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for otrs fixes the following issues: Update to version 4.0.33. Security issues fixed: - CVE-2018-19141: Fixed privilege escalation, that an attacker who is logged into OTRS as an admin user cannot manipulate the URL to cause execution of JavaScript in the context of OTRS. - CVE-2018-19143: Fixed remote file deletion, that an attacker who is logged into OTRS as a user cannot manipulate the submission form to cause deletion of arbitrary files that the OTRS web server user has write access to. Non-security issues fixed: - Full release notes can be found at: * https://community.otrs.com/release-notes-otrs-4-patch-level-33/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1503=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1503=1 Package List: - openSUSE Leap 15.0 (noarch): otrs-4.0.33-lp150.2.6.1 otrs-doc-4.0.33-lp150.2.6.1 otrs-itsm-4.0.33-lp150.2.6.1 - openSUSE Backports SLE-15 (noarch): otrs-4.0.33-bp150.3.6.1 otrs-doc-4.0.33-bp150.3.6.1 otrs-itsm-4.0.33-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19141.html https://www.suse.com/security/cve/CVE-2018-19143.html https://bugzilla.suse.com/1115416

1 0

openSUSE-SU-2018:4045-1: moderate: Security update for dom4j
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4045-1 Rating: moderate References: #1105443 Cross-References: CVE-2018-1000632 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection that could have resulted in an attacker tampering with XML documents (bsc#1105443). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1492=1 Package List: - openSUSE Backports SLE-15 (noarch): dom4j-1.6.1-bp150.2.3.1 dom4j-demo-1.6.1-bp150.2.3.1 dom4j-javadoc-1.6.1-bp150.2.3.1 dom4j-manual-1.6.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000632.html https://bugzilla.suse.com/1105443

1 0

openSUSE-RU-2018:4044-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4044-1 Rating: moderate References: #1102589 #1107753 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for open-iscsi fixes the following issues: - iscsiuio: Do not flush tx queue on each uio interrupt. This makes ping to such NICs work better (bsc#1102589) - Not allow multiple sessions just because they were started in parallel (bsc#1107753) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1505=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): iscsiuio-0.7.8.2-lp150.9.6.1 iscsiuio-debuginfo-0.7.8.2-lp150.9.6.1 libopeniscsiusr0_2_0-2.0.876-lp150.9.6.1 libopeniscsiusr0_2_0-debuginfo-2.0.876-lp150.9.6.1 open-iscsi-2.0.876-lp150.9.6.1 open-iscsi-debuginfo-2.0.876-lp150.9.6.1 open-iscsi-debugsource-2.0.876-lp150.9.6.1 open-iscsi-devel-2.0.876-lp150.9.6.1 References: https://bugzilla.suse.com/1102589 https://bugzilla.suse.com/1107753

1 0

openSUSE-SU-2018:4043-1: important: Security update for pam
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for pam ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4043-1 Rating: important References: #1115640 Cross-References: CVE-2018-17953 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pam fixes the following issue: Security issue fixed: - CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified (bsc#1115640). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1511=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): pam-1.3.0-lp150.5.6.1 pam-debuginfo-1.3.0-lp150.5.6.1 pam-debugsource-1.3.0-lp150.5.6.1 pam-devel-1.3.0-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): pam-32bit-1.3.0-lp150.5.6.1 pam-32bit-debuginfo-1.3.0-lp150.5.6.1 pam-devel-32bit-1.3.0-lp150.5.6.1 - openSUSE Leap 15.0 (noarch): pam-doc-1.3.0-lp150.5.6.1 References: https://www.suse.com/security/cve/CVE-2018-17953.html https://bugzilla.suse.com/1115640

1 0

openSUSE-SU-2018:4042-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4042-1 Rating: moderate References: #1110850 Cross-References: CVE-2018-11784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat to 9.0.12 fixes the following issues: See the full changelog at: http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.12_(markt ) Security issues fixed: - CVE-2018-11784: When the default servlet in Apache Tomcat returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. (bsc#1110850) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1504=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.12-lp150.2.6.1 tomcat-admin-webapps-9.0.12-lp150.2.6.1 tomcat-docs-webapp-9.0.12-lp150.2.6.1 tomcat-el-3_0-api-9.0.12-lp150.2.6.1 tomcat-embed-9.0.12-lp150.2.6.1 tomcat-javadoc-9.0.12-lp150.2.6.1 tomcat-jsp-2_3-api-9.0.12-lp150.2.6.1 tomcat-jsvc-9.0.12-lp150.2.6.1 tomcat-lib-9.0.12-lp150.2.6.1 tomcat-servlet-4_0-api-9.0.12-lp150.2.6.1 tomcat-webapps-9.0.12-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-11784.html https://bugzilla.suse.com/1110850

1 0