December 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:4246-1: moderate: Recommended update for libgcrypt
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4246-1 Rating: moderate References: #1117355 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libgcrypt fixes the following issues: - Fail selftests when checksum file is missing in FIPS mode only (bsc#1117355) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1577=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgcrypt-cavs-1.8.2-lp150.5.6.1 libgcrypt-cavs-debuginfo-1.8.2-lp150.5.6.1 libgcrypt-debugsource-1.8.2-lp150.5.6.1 libgcrypt-devel-1.8.2-lp150.5.6.1 libgcrypt-devel-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-1.8.2-lp150.5.6.1 libgcrypt20-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-hmac-1.8.2-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): libgcrypt-devel-32bit-1.8.2-lp150.5.6.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-32bit-1.8.2-lp150.5.6.1 libgcrypt20-32bit-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-hmac-32bit-1.8.2-lp150.5.6.1 References: https://bugzilla.suse.com/1117355

1 0

openSUSE-RU-2018:4245-1: moderate: Recommended update for openCryptoki
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for openCryptoki ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4245-1 Rating: moderate References: #1096378 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openCryptoki fixes the following issues: - Adapt pid file creation on demonize for systemd (bsc#1096378) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1580=1 Package List: - openSUSE Leap 15.0 (x86_64): openCryptoki-3.8.2-lp150.4.3.1 openCryptoki-64bit-3.8.2-lp150.4.3.1 openCryptoki-64bit-debuginfo-3.8.2-lp150.4.3.1 openCryptoki-debuginfo-3.8.2-lp150.4.3.1 openCryptoki-debugsource-3.8.2-lp150.4.3.1 openCryptoki-devel-3.8.2-lp150.4.3.1 References: https://bugzilla.suse.com/1096378

1 0

openSUSE-RU-2018:4244-1: moderate: Recommended update for polkit-default-privs
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for polkit-default-privs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4244-1 Rating: moderate References: #1083066 #1088648 #1118117 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for polkit-default-privs fixes the following issues: - Backport relaxed polkit rules regarding blueman settings and locally logged-in users should be able to run blueman without any password entry (bsc#1083066) - Backport of tuned polkit rules extensions for SLE-15-SP1 (bsc#1088648, bsc#1118117) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1586=1 Package List: - openSUSE Leap 15.0 (noarch): polkit-default-privs-13.2-lp150.8.9.1 References: https://bugzilla.suse.com/1083066 https://bugzilla.suse.com/1088648 https://bugzilla.suse.com/1118117

1 0

openSUSE-RU-2018:4243-1: important: Recommended update for suse-module-tools
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for suse-module-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4243-1 Rating: important References: #1116665 #1119371 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for suse-module-tools fixes the following issues: - Move "weak-modules" script to -legacy subpackage to avoid dependency on binutils (bsc#1116665, bsc#1119371) - Require mkinitrd (provided also by dracut) directly instead of file requires. This is fixing image build failures This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1584=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): suse-module-tools-15.0.2-lp150.2.6.1 suse-module-tools-legacy-15.0.2-lp150.2.6.1 References: https://bugzilla.suse.com/1116665 https://bugzilla.suse.com/1119371

1 0

openSUSE-SU-2018:4242-1: moderate: Security update for tryton
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4242-1 Rating: moderate References: #1117105 Cross-References: CVE-2018-19443 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tryton to version 4.2.19 fixes the following issues: Security issue fixed: - CVE-2018-19443: Fixed an information leakage by attemping to initiate an unencrypted connection, which would fail eventually, but might leak session information of the user (boo#1117105) This update also contains newer versions of tryton related packages with general bug fixes and updates: - trytond 4.2.17 - trytond_account 4.2.10 - trytond_account_invoice 4.2.7 - trytond_purchase_request 4.2.4 - trytond_stock 4.2.8 - trytond_stock_supply 4.2.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1588=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1588=1 Package List: - openSUSE Leap 15.0 (noarch): tryton-4.2.19-lp150.2.10.1 trytond-4.2.17-lp150.2.15.1 trytond_account-4.2.10-lp150.2.3.1 trytond_account_invoice-4.2.7-lp150.2.3.1 trytond_purchase_request-4.2.4-lp150.2.3.1 trytond_stock-4.2.8-lp150.2.3.1 trytond_stock_supply-4.2.3-lp150.2.7.1 - openSUSE Backports SLE-15 (noarch): tryton-4.2.19-bp150.2.6.1 trytond-4.2.17-bp150.2.6.1 trytond_account-4.2.10-bp150.3.3.1 trytond_account_invoice-4.2.7-bp150.3.3.1 trytond_purchase_request-4.2.4-bp150.3.3.1 trytond_stock-4.2.8-bp150.3.3.1 trytond_stock_supply-4.2.3-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19443.html https://bugzilla.suse.com/1117105

1 0

openSUSE-RU-2018:4241-1: moderate: Recommended update for psmisc
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for psmisc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4241-1 Rating: moderate References: #1098697 #1112780 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for psmisc provides the following fix: - Make the fuser option -m <block_device> work even with mountinfo. (bsc#1098697) - Support also btrFS entries in mountinfo, that is use stat(2) to determine the device of the mounted subvolume (bsc#1098697, bsc#1112780) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1583=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): psmisc-23.0-lp150.4.6.1 psmisc-debuginfo-23.0-lp150.4.6.1 psmisc-debugsource-23.0-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): psmisc-lang-23.0-lp150.4.6.1 References: https://bugzilla.suse.com/1098697 https://bugzilla.suse.com/1112780

1 0

openSUSE-SU-2018:4240-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4240-1 Rating: moderate References: #1115916 #1115917 #1117998 Cross-References: CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916). - CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917). - CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917). - CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917). Non security issues fixed: - Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1590=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.9.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.9.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.9.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2017-5731.html https://www.suse.com/security/cve/CVE-2017-5732.html https://www.suse.com/security/cve/CVE-2017-5733.html https://www.suse.com/security/cve/CVE-2017-5734.html https://www.suse.com/security/cve/CVE-2017-5735.html https://www.suse.com/security/cve/CVE-2018-3613.html https://bugzilla.suse.com/1115916 https://bugzilla.suse.com/1115917 https://bugzilla.suse.com/1117998

1 0

openSUSE-RU-2018:4239-1: Recommended update for perl-Bootloader
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for perl-Bootloader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4239-1 Rating: low References: #1079321 #1108777 #994322 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for perl-Bootloader fixes the following issues: - Create temporary files in /tmp (bsc#1108777) - Work without /etc/default/grub_installdevice (bsc#1079321, bsc#994322) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1581=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): perl-Bootloader-0.923-lp150.3.6.1 perl-Bootloader-YAML-0.923-lp150.3.6.1 References: https://bugzilla.suse.com/1079321 https://bugzilla.suse.com/1108777 https://bugzilla.suse.com/994322

1 0

openSUSE-SU-2018:4213-1: moderate: Security update for keepalived
by opensuse-security＠opensuse.org 21 Dec '18

21 Dec '18

openSUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4213-1 Rating: moderate References: #1015141 #1069468 #949238 Cross-References: CVE-2018-19044 CVE-2018-19045 CVE-2018-19046 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for keepalived to version 2.0.10 fixes the following issues: Security issues fixed (bsc#1015141): - CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats - CVE-2018-19045: Fixed mode when creating new temporary files upon a call to PrintData or PrintStats - CVE-2018-19046: Fixed a check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats Non-security issues fixed: - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (bsc#949238) For the full list of changes refer to: http://www.keepalived.org/changelog.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1575=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): keepalived-2.0.10-6.1 References: https://www.suse.com/security/cve/CVE-2018-19044.html https://www.suse.com/security/cve/CVE-2018-19045.html https://www.suse.com/security/cve/CVE-2018-19046.html https://bugzilla.suse.com/1015141 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/949238

1 0

openSUSE-SU-2018:4212-1: moderate: Security update for keepalived
by opensuse-security＠opensuse.org 21 Dec '18

21 Dec '18

openSUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4212-1 Rating: moderate References: #1015141 #1069468 #949238 Cross-References: CVE-2018-19044 CVE-2018-19045 CVE-2018-19046 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for keepalived to version 2.0.10 fixes the following issues: Security issues fixed (bsc#1015141): - CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats - CVE-2018-19045: Fixed mode when creating new temporary files upon a call to PrintData or PrintStats - CVE-2018-19046: Fixed a check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats Non-security issues fixed: - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (bsc#949238) For the full list of changes refer to: http://www.keepalived.org/changelog.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1575=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1575=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1575=1 Package List: - openSUSE Leap 42.3 (x86_64): keepalived-2.0.10-7.3.1 keepalived-debuginfo-2.0.10-7.3.1 keepalived-debugsource-2.0.10-7.3.1 - openSUSE Leap 15.0 (x86_64): keepalived-2.0.10-lp150.3.4.1 keepalived-debuginfo-2.0.10-lp150.3.4.1 keepalived-debugsource-2.0.10-lp150.3.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): keepalived-2.0.10-bp150.3.4.1 References: https://www.suse.com/security/cve/CVE-2018-19044.html https://www.suse.com/security/cve/CVE-2018-19045.html https://www.suse.com/security/cve/CVE-2018-19046.html https://bugzilla.suse.com/1015141 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/949238

1 0