December 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:4197-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 19 Dec '18

19 Dec '18

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4197-1 Rating: moderate References: #1104491 #1107333 #1108557 #1108834 #1108995 #1109893 #1110938 #1112874 #1113698 #1113699 #1113784 #1114197 #1114824 Cross-References: CVE-2018-15750 CVE-2018-15751 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 11 fixes is now available. Description: This update for salt fixes the following issues: - Crontab module fix: file attributes option missing (boo#1114824) - Fix git_pillar merging across multiple __env__ repositories (boo#1112874) - Bugfix: unable to detect os arch when RPM is not installed (boo#1114197) - Fix LDAP authentication issue when a valid token is generated by the salt-api even when invalid user credentials are passed. (U#48901) - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations. (boo#1113784) - Fix remote command execution and incorrect access control when using salt-api. (boo#1113699) (CVE-2018-15751) - Fix Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events. (boo#1113698) (CVE-2018-15750) - Add multi-file support and globbing to the filetree (U#50018) - Bugfix: supportconfig non-root permission issues (U#50095) - Open profiles permissions to everyone for read-only - Preserving signature in "module.run" state (U#50049) - Install default salt-support profiles - Remove unit test, came from a wrong branch. Fix merging failure. - Add CPE_NAME for osversion* grain parsing - Get os_family for RPM distros from the RPM macros - Install support profiles - Fix async call to process manager (boo#1110938) - Salt-based supportconfig implementation (technology preview) - Bugfix: any unicode string of length 16 will raise TypeError - Fix IPv6 scope (boo#1108557) - Handle zypper ZYPPER_EXIT_NO_REPOS exit code (boo#1108834, boo#1109893) - Bugfix for pkg_resources crash (boo#1104491) - Fix loosen azure sdk dependencies in azurearm cloud driver (boo#1107333) - Fix broken "resolve_capabilities" on Python 3 (boo#1108995) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1574=1 Package List: - openSUSE Leap 42.3 (noarch): salt-bash-completion-2018.3.0-23.1 salt-fish-completion-2018.3.0-23.1 salt-zsh-completion-2018.3.0-23.1 - openSUSE Leap 42.3 (x86_64): python2-salt-2018.3.0-23.1 python3-salt-2018.3.0-23.1 salt-2018.3.0-23.1 salt-api-2018.3.0-23.1 salt-cloud-2018.3.0-23.1 salt-doc-2018.3.0-23.1 salt-master-2018.3.0-23.1 salt-minion-2018.3.0-23.1 salt-proxy-2018.3.0-23.1 salt-ssh-2018.3.0-23.1 salt-syndic-2018.3.0-23.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://bugzilla.suse.com/1104491 https://bugzilla.suse.com/1107333 https://bugzilla.suse.com/1108557 https://bugzilla.suse.com/1108834 https://bugzilla.suse.com/1108995 https://bugzilla.suse.com/1109893 https://bugzilla.suse.com/1110938 https://bugzilla.suse.com/1112874 https://bugzilla.suse.com/1113698 https://bugzilla.suse.com/1113699 https://bugzilla.suse.com/1113784 https://bugzilla.suse.com/1114197 https://bugzilla.suse.com/1114824

1 0

openSUSE-RU-2018:4192-1: moderate: Recommended update for trustedgrub2
by maintenance＠opensuse.org 19 Dec '18

19 Dec '18

openSUSE Recommended Update: Recommended update for trustedgrub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4192-1 Rating: moderate References: #1052420 #1084632 #1100984 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for trustedgrub2 fixes the following issues: - Fix "no symbol table" error on new binutil, backport patches (boo#1100984) - Fix packed-not-aligned error on GCC 8 (boo#1084632) - Allow to execute menuentry unrestricted as default (fate#318574) (boo#1052420) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1573=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1573=1 Package List: - openSUSE Leap 15.0 (noarch): trustedgrub2-i386-pc-1.4.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): trustedgrub2-1.4.0-lp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): trustedgrub2-1.4.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): trustedgrub2-i386-pc-1.4.0-bp150.3.3.1 References: https://bugzilla.suse.com/1052420 https://bugzilla.suse.com/1084632 https://bugzilla.suse.com/1100984

1 0

openSUSE-SU-2018:4181-1: important: Security update for go1.11
by opensuse-security＠opensuse.org 19 Dec '18

19 Dec '18

openSUSE Security Update: Security update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4181-1 Rating: important References: #1098017 #1113978 #1118897 #1118898 #1118899 #1119634 #1119706 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This new package for go1.11 fixes the following issues: Security issues fixed: - CVE-2018-16873: Fixed a remote code execution in go get, when executed with the -u flag (bsc#1118897) - CVE-2018-16874: Fixed an arbitrary filesystem write in go get, which could lead to code execution (bsc#1118898) - CVE-2018-16875: Fixed a Denial of Service in the crypto/x509 package during certificate chain validation(bsc#1118899) Non-security issues fixed: - Fixed build error with PIE linker flags on ppc64le (bsc#1113978 bsc#1098017) - Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (bsc#1119634) The following tracked regression fix is included: - Fix a regression that broke go get for import path patterns containing "..." (bsc#1119706) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1572=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1572=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): go1.11-1.11.4-2.1 go1.11-doc-1.11.4-2.1 - openSUSE Leap 42.3 (x86_64): go1.11-race-1.11.4-2.1 - openSUSE Leap 15.0 (x86_64): go1.11-1.11.4-lp150.2.1 go1.11-doc-1.11.4-lp150.2.1 go1.11-race-1.11.4-lp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1098017 https://bugzilla.suse.com/1113978 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1119706

1 0

openSUSE-SU-2018:4177-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4177-1 Rating: moderate References: #1114157 #1114169 #1114170 #1116592 Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 CVE-2018-16855 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). - CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1570=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.2-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://www.suse.com/security/cve/CVE-2018-14644.html https://www.suse.com/security/cve/CVE-2018-16855.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 https://bugzilla.suse.com/1114170 https://bugzilla.suse.com/1116592

1 0

openSUSE-SU-2018:4175-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4175-1 Rating: moderate References: #1114157 #1114169 Cross-References: CVE-2018-10851 CVE-2018-14626 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1571=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.3.1 pdns-backend-geoip-4.1.2-bp150.2.3.1 pdns-backend-godbc-4.1.2-bp150.2.3.1 pdns-backend-ldap-4.1.2-bp150.2.3.1 pdns-backend-lua-4.1.2-bp150.2.3.1 pdns-backend-mydns-4.1.2-bp150.2.3.1 pdns-backend-mysql-4.1.2-bp150.2.3.1 pdns-backend-postgresql-4.1.2-bp150.2.3.1 pdns-backend-remote-4.1.2-bp150.2.3.1 pdns-backend-sqlite3-4.1.2-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169

1 0

openSUSE-SU-2018:4174-1: important: Security update for salt
by opensuse-security＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4174-1 Rating: important References: #1110938 #1112874 #1113698 #1113699 #1113784 #1114197 #1114824 Cross-References: CVE-2018-15750 CVE-2018-15751 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has 5 fixes is now available. Description: This update for salt fixes the following issues: Security issues fixed: - CVE-2018-15750: Fixed directory traversal vulnerability in salt-api (bsc#1113698). - CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi) that allows to execute arbitrary commands (bsc#1113699). Non-security issues fixed: - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations (bsc#1113784). - Fixed async call to process manager (bsc#1110938) - Fixed OS arch detection when RPM is not installed (bsc#1114197) - Crontab module fix: file attributes option missing (bsc#1114824) - Fix git_pillar merging across multiple __env__ repositories (bsc#1112874) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1569=1 Package List: - openSUSE Leap 15.0 (x86_64): python2-salt-2018.3.0-lp150.3.17.1 python3-salt-2018.3.0-lp150.3.17.1 salt-2018.3.0-lp150.3.17.1 salt-api-2018.3.0-lp150.3.17.1 salt-cloud-2018.3.0-lp150.3.17.1 salt-doc-2018.3.0-lp150.3.17.1 salt-master-2018.3.0-lp150.3.17.1 salt-minion-2018.3.0-lp150.3.17.1 salt-proxy-2018.3.0-lp150.3.17.1 salt-ssh-2018.3.0-lp150.3.17.1 salt-syndic-2018.3.0-lp150.3.17.1 - openSUSE Leap 15.0 (noarch): salt-bash-completion-2018.3.0-lp150.3.17.1 salt-fish-completion-2018.3.0-lp150.3.17.1 salt-zsh-completion-2018.3.0-lp150.3.17.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://bugzilla.suse.com/1110938 https://bugzilla.suse.com/1112874 https://bugzilla.suse.com/1113698 https://bugzilla.suse.com/1113699 https://bugzilla.suse.com/1113784 https://bugzilla.suse.com/1114197 https://bugzilla.suse.com/1114824

1 0

openSUSE-RU-2018:4173-1: moderate: Recommended update for zynaddsubfx
by maintenance＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Recommended Update: Recommended update for zynaddsubfx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4173-1 Rating: moderate References: #1116460 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for zynaddsubfx fixes the following issues: - Require zynaddsubfx-common subpackage which is needed to run and fixes boo#1116460. - README.adoc states license is GPL 2+, updated %License field. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1567=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1567=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1567=1 Package List: - openSUSE Leap 42.3 (x86_64): zynaddsubfx-3.0.1-2.3.1 zynaddsubfx-debuginfo-3.0.1-2.3.1 zynaddsubfx-debugsource-3.0.1-2.3.1 zynaddsubfx-dssi-3.0.1-2.3.1 zynaddsubfx-dssi-debuginfo-3.0.1-2.3.1 zynaddsubfx-lv2-3.0.1-2.3.1 zynaddsubfx-lv2-debuginfo-3.0.1-2.3.1 zynaddsubfx-vst-3.0.1-2.3.1 zynaddsubfx-vst-debuginfo-3.0.1-2.3.1 - openSUSE Leap 42.3 (noarch): zynaddsubfx-common-3.0.1-2.3.1 - openSUSE Leap 15.0 (noarch): zynaddsubfx-common-3.0.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): zynaddsubfx-3.0.3-lp150.2.3.1 zynaddsubfx-debuginfo-3.0.3-lp150.2.3.1 zynaddsubfx-debugsource-3.0.3-lp150.2.3.1 zynaddsubfx-dssi-3.0.3-lp150.2.3.1 zynaddsubfx-dssi-debuginfo-3.0.3-lp150.2.3.1 zynaddsubfx-lv2-3.0.3-lp150.2.3.1 zynaddsubfx-lv2-debuginfo-3.0.3-lp150.2.3.1 zynaddsubfx-vst-3.0.3-lp150.2.3.1 zynaddsubfx-vst-debuginfo-3.0.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): zynaddsubfx-3.0.3-bp150.3.3.1 zynaddsubfx-dssi-3.0.3-bp150.3.3.1 zynaddsubfx-lv2-3.0.3-bp150.3.3.1 zynaddsubfx-vst-3.0.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): zynaddsubfx-common-3.0.3-bp150.3.3.1 References: https://bugzilla.suse.com/1116460

1 0

openSUSE-RU-2018:4172-1: Optional update for gcc8
by maintenance＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Recommended Update: Optional update for gcc8 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4172-1 Rating: low References: #1084812 #1084842 #1087550 #1094222 #1102564 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update adds the GNU Compiler GCC 8 to the distribution. The update also supplies gcc8 compatible libstdc++, libgcc_s1 and other gcc derived libraries to openSUSE Leap 15.0. Various optimizers have been improved in GCC 8, several of bugs fixed, quite some new warnings added and the error pin-pointing and fix-suggestions have been greatly improved. The GNU Compiler page for GCC 8 contains a summary of all the changes that have happened: https://gcc.gnu.org/gcc-8/changes.html Also changes needed or common pitfalls when porting software are described on: https://gcc.gnu.org/gcc-8/porting_to.html To use gcc8: - Install the "gcc8" (and likely also gcc8-c++) packages. - Use "gcc-8" or "g++-8" instead of the regular gcc / g++. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1568=1 Package List: - openSUSE Leap 15.0 (noarch): gcc8-info-8.2.1+r264010-lp150.2.3 - openSUSE Leap 15.0 (x86_64): cpp8-8.2.1+r264010-lp150.2.3 cpp8-debuginfo-8.2.1+r264010-lp150.2.3 cross-nvptx-gcc8-8.2.1+r264010-lp150.2.1 cross-nvptx-newlib8-devel-8.2.1+r264010-lp150.2.1 gcc8-32bit-8.2.1+r264010-lp150.2.3 gcc8-8.2.1+r264010-lp150.2.3 gcc8-ada-32bit-8.2.1+r264010-lp150.2.3 gcc8-ada-8.2.1+r264010-lp150.2.3 gcc8-ada-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-c++-32bit-8.2.1+r264010-lp150.2.3 gcc8-c++-8.2.1+r264010-lp150.2.3 gcc8-c++-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-debugsource-8.2.1+r264010-lp150.2.3 gcc8-fortran-32bit-8.2.1+r264010-lp150.2.3 gcc8-fortran-8.2.1+r264010-lp150.2.3 gcc8-fortran-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-go-32bit-8.2.1+r264010-lp150.2.3 gcc8-go-8.2.1+r264010-lp150.2.3 gcc8-go-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-locale-8.2.1+r264010-lp150.2.3 libada8-32bit-8.2.1+r264010-lp150.2.3 libada8-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libada8-8.2.1+r264010-lp150.2.3 libada8-debuginfo-8.2.1+r264010-lp150.2.3 libasan5-32bit-8.2.1+r264010-lp150.2.3 libasan5-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libasan5-8.2.1+r264010-lp150.2.3 libasan5-debuginfo-8.2.1+r264010-lp150.2.3 libatomic1-32bit-8.2.1+r264010-lp150.2.3 libatomic1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libatomic1-8.2.1+r264010-lp150.2.3 libatomic1-debuginfo-8.2.1+r264010-lp150.2.3 libgcc_s1-32bit-8.2.1+r264010-lp150.2.3 libgcc_s1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgcc_s1-8.2.1+r264010-lp150.2.3 libgcc_s1-debuginfo-8.2.1+r264010-lp150.2.3 libgfortran5-32bit-8.2.1+r264010-lp150.2.3 libgfortran5-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgfortran5-8.2.1+r264010-lp150.2.3 libgfortran5-debuginfo-8.2.1+r264010-lp150.2.3 libgo13-32bit-8.2.1+r264010-lp150.2.3 libgo13-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgo13-8.2.1+r264010-lp150.2.3 libgo13-debuginfo-8.2.1+r264010-lp150.2.3 libgomp1-32bit-8.2.1+r264010-lp150.2.3 libgomp1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgomp1-8.2.1+r264010-lp150.2.3 libgomp1-debuginfo-8.2.1+r264010-lp150.2.3 libitm1-32bit-8.2.1+r264010-lp150.2.3 libitm1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libitm1-8.2.1+r264010-lp150.2.3 libitm1-debuginfo-8.2.1+r264010-lp150.2.3 liblsan0-8.2.1+r264010-lp150.2.3 liblsan0-debuginfo-8.2.1+r264010-lp150.2.3 libmpx2-32bit-8.2.1+r264010-lp150.2.3 libmpx2-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libmpx2-8.2.1+r264010-lp150.2.3 libmpx2-debuginfo-8.2.1+r264010-lp150.2.3 libmpxwrappers2-32bit-8.2.1+r264010-lp150.2.3 libmpxwrappers2-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libmpxwrappers2-8.2.1+r264010-lp150.2.3 libmpxwrappers2-debuginfo-8.2.1+r264010-lp150.2.3 libquadmath0-32bit-8.2.1+r264010-lp150.2.3 libquadmath0-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libquadmath0-8.2.1+r264010-lp150.2.3 libquadmath0-debuginfo-8.2.1+r264010-lp150.2.3 libstdc++6-32bit-8.2.1+r264010-lp150.2.3 libstdc++6-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libstdc++6-8.2.1+r264010-lp150.2.3 libstdc++6-debuginfo-8.2.1+r264010-lp150.2.3 libstdc++6-devel-gcc8-32bit-8.2.1+r264010-lp150.2.3 libstdc++6-devel-gcc8-8.2.1+r264010-lp150.2.3 libstdc++6-locale-8.2.1+r264010-lp150.2.3 libtsan0-8.2.1+r264010-lp150.2.3 libtsan0-debuginfo-8.2.1+r264010-lp150.2.3 libubsan1-32bit-8.2.1+r264010-lp150.2.3 libubsan1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libubsan1-8.2.1+r264010-lp150.2.3 libubsan1-debuginfo-8.2.1+r264010-lp150.2.3 References: https://bugzilla.suse.com/1084812 https://bugzilla.suse.com/1084842 https://bugzilla.suse.com/1087550 https://bugzilla.suse.com/1094222 https://bugzilla.suse.com/1102564

1 0

openSUSE-SU-2018:4156-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 17 Dec '18

17 Dec '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4156-1 Rating: moderate References: #1114157 #1114169 Cross-References: CVE-2018-10851 CVE-2018-14626 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1566=1 Package List: - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.6.1 pdns-backend-geoip-4.1.2-lp150.3.6.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-godbc-4.1.2-lp150.3.6.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-ldap-4.1.2-lp150.3.6.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-lua-4.1.2-lp150.3.6.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-mydns-4.1.2-lp150.3.6.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-mysql-4.1.2-lp150.3.6.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-postgresql-4.1.2-lp150.3.6.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-remote-4.1.2-lp150.3.6.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-sqlite3-4.1.2-lp150.3.6.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.6.1 pdns-debuginfo-4.1.2-lp150.3.6.1 pdns-debugsource-4.1.2-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169

1 0

openSUSE-SU-2018:4152-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 17 Dec '18

17 Dec '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4152-1 Rating: moderate References: #1114157 #1114169 #1114170 #1116592 Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 CVE-2018-16855 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). - CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1565=1 Package List: - openSUSE Leap 15.0 (x86_64): pdns-recursor-4.1.2-lp150.2.3.1 pdns-recursor-debuginfo-4.1.2-lp150.2.3.1 pdns-recursor-debugsource-4.1.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://www.suse.com/security/cve/CVE-2018-14644.html https://www.suse.com/security/cve/CVE-2018-16855.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 https://bugzilla.suse.com/1114170 https://bugzilla.suse.com/1116592

1 0