December 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:4246-1: moderate: Recommended update for libgcrypt
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4246-1 Rating: moderate References: #1117355 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libgcrypt fixes the following issues: - Fail selftests when checksum file is missing in FIPS mode only (bsc#1117355) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1577=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgcrypt-cavs-1.8.2-lp150.5.6.1 libgcrypt-cavs-debuginfo-1.8.2-lp150.5.6.1 libgcrypt-debugsource-1.8.2-lp150.5.6.1 libgcrypt-devel-1.8.2-lp150.5.6.1 libgcrypt-devel-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-1.8.2-lp150.5.6.1 libgcrypt20-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-hmac-1.8.2-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): libgcrypt-devel-32bit-1.8.2-lp150.5.6.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-32bit-1.8.2-lp150.5.6.1 libgcrypt20-32bit-debuginfo-1.8.2-lp150.5.6.1 libgcrypt20-hmac-32bit-1.8.2-lp150.5.6.1 References: https://bugzilla.suse.com/1117355

1 0

openSUSE-RU-2018:4245-1: moderate: Recommended update for openCryptoki
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for openCryptoki ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4245-1 Rating: moderate References: #1096378 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openCryptoki fixes the following issues: - Adapt pid file creation on demonize for systemd (bsc#1096378) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1580=1 Package List: - openSUSE Leap 15.0 (x86_64): openCryptoki-3.8.2-lp150.4.3.1 openCryptoki-64bit-3.8.2-lp150.4.3.1 openCryptoki-64bit-debuginfo-3.8.2-lp150.4.3.1 openCryptoki-debuginfo-3.8.2-lp150.4.3.1 openCryptoki-debugsource-3.8.2-lp150.4.3.1 openCryptoki-devel-3.8.2-lp150.4.3.1 References: https://bugzilla.suse.com/1096378

1 0

openSUSE-RU-2018:4244-1: moderate: Recommended update for polkit-default-privs
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for polkit-default-privs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4244-1 Rating: moderate References: #1083066 #1088648 #1118117 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for polkit-default-privs fixes the following issues: - Backport relaxed polkit rules regarding blueman settings and locally logged-in users should be able to run blueman without any password entry (bsc#1083066) - Backport of tuned polkit rules extensions for SLE-15-SP1 (bsc#1088648, bsc#1118117) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1586=1 Package List: - openSUSE Leap 15.0 (noarch): polkit-default-privs-13.2-lp150.8.9.1 References: https://bugzilla.suse.com/1083066 https://bugzilla.suse.com/1088648 https://bugzilla.suse.com/1118117

1 0

openSUSE-RU-2018:4243-1: important: Recommended update for suse-module-tools
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for suse-module-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4243-1 Rating: important References: #1116665 #1119371 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for suse-module-tools fixes the following issues: - Move "weak-modules" script to -legacy subpackage to avoid dependency on binutils (bsc#1116665, bsc#1119371) - Require mkinitrd (provided also by dracut) directly instead of file requires. This is fixing image build failures This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1584=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): suse-module-tools-15.0.2-lp150.2.6.1 suse-module-tools-legacy-15.0.2-lp150.2.6.1 References: https://bugzilla.suse.com/1116665 https://bugzilla.suse.com/1119371

1 0

openSUSE-SU-2018:4242-1: moderate: Security update for tryton
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4242-1 Rating: moderate References: #1117105 Cross-References: CVE-2018-19443 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tryton to version 4.2.19 fixes the following issues: Security issue fixed: - CVE-2018-19443: Fixed an information leakage by attemping to initiate an unencrypted connection, which would fail eventually, but might leak session information of the user (boo#1117105) This update also contains newer versions of tryton related packages with general bug fixes and updates: - trytond 4.2.17 - trytond_account 4.2.10 - trytond_account_invoice 4.2.7 - trytond_purchase_request 4.2.4 - trytond_stock 4.2.8 - trytond_stock_supply 4.2.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1588=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1588=1 Package List: - openSUSE Leap 15.0 (noarch): tryton-4.2.19-lp150.2.10.1 trytond-4.2.17-lp150.2.15.1 trytond_account-4.2.10-lp150.2.3.1 trytond_account_invoice-4.2.7-lp150.2.3.1 trytond_purchase_request-4.2.4-lp150.2.3.1 trytond_stock-4.2.8-lp150.2.3.1 trytond_stock_supply-4.2.3-lp150.2.7.1 - openSUSE Backports SLE-15 (noarch): tryton-4.2.19-bp150.2.6.1 trytond-4.2.17-bp150.2.6.1 trytond_account-4.2.10-bp150.3.3.1 trytond_account_invoice-4.2.7-bp150.3.3.1 trytond_purchase_request-4.2.4-bp150.3.3.1 trytond_stock-4.2.8-bp150.3.3.1 trytond_stock_supply-4.2.3-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19443.html https://bugzilla.suse.com/1117105

1 0

openSUSE-RU-2018:4241-1: moderate: Recommended update for psmisc
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for psmisc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4241-1 Rating: moderate References: #1098697 #1112780 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for psmisc provides the following fix: - Make the fuser option -m <block_device> work even with mountinfo. (bsc#1098697) - Support also btrFS entries in mountinfo, that is use stat(2) to determine the device of the mounted subvolume (bsc#1098697, bsc#1112780) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1583=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): psmisc-23.0-lp150.4.6.1 psmisc-debuginfo-23.0-lp150.4.6.1 psmisc-debugsource-23.0-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): psmisc-lang-23.0-lp150.4.6.1 References: https://bugzilla.suse.com/1098697 https://bugzilla.suse.com/1112780

1 0

openSUSE-SU-2018:4240-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4240-1 Rating: moderate References: #1115916 #1115917 #1117998 Cross-References: CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916). - CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917). - CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917). - CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917). Non security issues fixed: - Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1590=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.9.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.9.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.9.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2017-5731.html https://www.suse.com/security/cve/CVE-2017-5732.html https://www.suse.com/security/cve/CVE-2017-5733.html https://www.suse.com/security/cve/CVE-2017-5734.html https://www.suse.com/security/cve/CVE-2017-5735.html https://www.suse.com/security/cve/CVE-2018-3613.html https://bugzilla.suse.com/1115916 https://bugzilla.suse.com/1115917 https://bugzilla.suse.com/1117998

1 0

openSUSE-RU-2018:4239-1: Recommended update for perl-Bootloader
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for perl-Bootloader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4239-1 Rating: low References: #1079321 #1108777 #994322 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for perl-Bootloader fixes the following issues: - Create temporary files in /tmp (bsc#1108777) - Work without /etc/default/grub_installdevice (bsc#1079321, bsc#994322) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1581=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): perl-Bootloader-0.923-lp150.3.6.1 perl-Bootloader-YAML-0.923-lp150.3.6.1 References: https://bugzilla.suse.com/1079321 https://bugzilla.suse.com/1108777 https://bugzilla.suse.com/994322

1 0

openSUSE-SU-2018:4213-1: moderate: Security update for keepalived
by opensuse-security＠opensuse.org 21 Dec '18

21 Dec '18

openSUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4213-1 Rating: moderate References: #1015141 #1069468 #949238 Cross-References: CVE-2018-19044 CVE-2018-19045 CVE-2018-19046 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for keepalived to version 2.0.10 fixes the following issues: Security issues fixed (bsc#1015141): - CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats - CVE-2018-19045: Fixed mode when creating new temporary files upon a call to PrintData or PrintStats - CVE-2018-19046: Fixed a check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats Non-security issues fixed: - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (bsc#949238) For the full list of changes refer to: http://www.keepalived.org/changelog.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1575=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): keepalived-2.0.10-6.1 References: https://www.suse.com/security/cve/CVE-2018-19044.html https://www.suse.com/security/cve/CVE-2018-19045.html https://www.suse.com/security/cve/CVE-2018-19046.html https://bugzilla.suse.com/1015141 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/949238

1 0

openSUSE-SU-2018:4212-1: moderate: Security update for keepalived
by opensuse-security＠opensuse.org 21 Dec '18

21 Dec '18

openSUSE Security Update: Security update for keepalived ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4212-1 Rating: moderate References: #1015141 #1069468 #949238 Cross-References: CVE-2018-19044 CVE-2018-19045 CVE-2018-19046 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for keepalived to version 2.0.10 fixes the following issues: Security issues fixed (bsc#1015141): - CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats - CVE-2018-19045: Fixed mode when creating new temporary files upon a call to PrintData or PrintStats - CVE-2018-19046: Fixed a check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats Non-security issues fixed: - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (bsc#949238) For the full list of changes refer to: http://www.keepalived.org/changelog.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1575=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1575=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1575=1 Package List: - openSUSE Leap 42.3 (x86_64): keepalived-2.0.10-7.3.1 keepalived-debuginfo-2.0.10-7.3.1 keepalived-debugsource-2.0.10-7.3.1 - openSUSE Leap 15.0 (x86_64): keepalived-2.0.10-lp150.3.4.1 keepalived-debuginfo-2.0.10-lp150.3.4.1 keepalived-debugsource-2.0.10-lp150.3.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): keepalived-2.0.10-bp150.3.4.1 References: https://www.suse.com/security/cve/CVE-2018-19044.html https://www.suse.com/security/cve/CVE-2018-19045.html https://www.suse.com/security/cve/CVE-2018-19046.html https://bugzilla.suse.com/1015141 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/949238

1 0

openSUSE-SU-2018:4197-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 19 Dec '18

19 Dec '18

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4197-1 Rating: moderate References: #1104491 #1107333 #1108557 #1108834 #1108995 #1109893 #1110938 #1112874 #1113698 #1113699 #1113784 #1114197 #1114824 Cross-References: CVE-2018-15750 CVE-2018-15751 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 11 fixes is now available. Description: This update for salt fixes the following issues: - Crontab module fix: file attributes option missing (boo#1114824) - Fix git_pillar merging across multiple __env__ repositories (boo#1112874) - Bugfix: unable to detect os arch when RPM is not installed (boo#1114197) - Fix LDAP authentication issue when a valid token is generated by the salt-api even when invalid user credentials are passed. (U#48901) - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations. (boo#1113784) - Fix remote command execution and incorrect access control when using salt-api. (boo#1113699) (CVE-2018-15751) - Fix Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events. (boo#1113698) (CVE-2018-15750) - Add multi-file support and globbing to the filetree (U#50018) - Bugfix: supportconfig non-root permission issues (U#50095) - Open profiles permissions to everyone for read-only - Preserving signature in "module.run" state (U#50049) - Install default salt-support profiles - Remove unit test, came from a wrong branch. Fix merging failure. - Add CPE_NAME for osversion* grain parsing - Get os_family for RPM distros from the RPM macros - Install support profiles - Fix async call to process manager (boo#1110938) - Salt-based supportconfig implementation (technology preview) - Bugfix: any unicode string of length 16 will raise TypeError - Fix IPv6 scope (boo#1108557) - Handle zypper ZYPPER_EXIT_NO_REPOS exit code (boo#1108834, boo#1109893) - Bugfix for pkg_resources crash (boo#1104491) - Fix loosen azure sdk dependencies in azurearm cloud driver (boo#1107333) - Fix broken "resolve_capabilities" on Python 3 (boo#1108995) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1574=1 Package List: - openSUSE Leap 42.3 (noarch): salt-bash-completion-2018.3.0-23.1 salt-fish-completion-2018.3.0-23.1 salt-zsh-completion-2018.3.0-23.1 - openSUSE Leap 42.3 (x86_64): python2-salt-2018.3.0-23.1 python3-salt-2018.3.0-23.1 salt-2018.3.0-23.1 salt-api-2018.3.0-23.1 salt-cloud-2018.3.0-23.1 salt-doc-2018.3.0-23.1 salt-master-2018.3.0-23.1 salt-minion-2018.3.0-23.1 salt-proxy-2018.3.0-23.1 salt-ssh-2018.3.0-23.1 salt-syndic-2018.3.0-23.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://bugzilla.suse.com/1104491 https://bugzilla.suse.com/1107333 https://bugzilla.suse.com/1108557 https://bugzilla.suse.com/1108834 https://bugzilla.suse.com/1108995 https://bugzilla.suse.com/1109893 https://bugzilla.suse.com/1110938 https://bugzilla.suse.com/1112874 https://bugzilla.suse.com/1113698 https://bugzilla.suse.com/1113699 https://bugzilla.suse.com/1113784 https://bugzilla.suse.com/1114197 https://bugzilla.suse.com/1114824

1 0

openSUSE-RU-2018:4192-1: moderate: Recommended update for trustedgrub2
by maintenance＠opensuse.org 19 Dec '18

19 Dec '18

openSUSE Recommended Update: Recommended update for trustedgrub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4192-1 Rating: moderate References: #1052420 #1084632 #1100984 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for trustedgrub2 fixes the following issues: - Fix "no symbol table" error on new binutil, backport patches (boo#1100984) - Fix packed-not-aligned error on GCC 8 (boo#1084632) - Allow to execute menuentry unrestricted as default (fate#318574) (boo#1052420) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1573=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1573=1 Package List: - openSUSE Leap 15.0 (noarch): trustedgrub2-i386-pc-1.4.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): trustedgrub2-1.4.0-lp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): trustedgrub2-1.4.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): trustedgrub2-i386-pc-1.4.0-bp150.3.3.1 References: https://bugzilla.suse.com/1052420 https://bugzilla.suse.com/1084632 https://bugzilla.suse.com/1100984

1 0

openSUSE-SU-2018:4181-1: important: Security update for go1.11
by opensuse-security＠opensuse.org 19 Dec '18

19 Dec '18

openSUSE Security Update: Security update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4181-1 Rating: important References: #1098017 #1113978 #1118897 #1118898 #1118899 #1119634 #1119706 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This new package for go1.11 fixes the following issues: Security issues fixed: - CVE-2018-16873: Fixed a remote code execution in go get, when executed with the -u flag (bsc#1118897) - CVE-2018-16874: Fixed an arbitrary filesystem write in go get, which could lead to code execution (bsc#1118898) - CVE-2018-16875: Fixed a Denial of Service in the crypto/x509 package during certificate chain validation(bsc#1118899) Non-security issues fixed: - Fixed build error with PIE linker flags on ppc64le (bsc#1113978 bsc#1098017) - Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (bsc#1119634) The following tracked regression fix is included: - Fix a regression that broke go get for import path patterns containing "..." (bsc#1119706) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1572=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1572=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): go1.11-1.11.4-2.1 go1.11-doc-1.11.4-2.1 - openSUSE Leap 42.3 (x86_64): go1.11-race-1.11.4-2.1 - openSUSE Leap 15.0 (x86_64): go1.11-1.11.4-lp150.2.1 go1.11-doc-1.11.4-lp150.2.1 go1.11-race-1.11.4-lp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1098017 https://bugzilla.suse.com/1113978 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1119706

1 0

openSUSE-SU-2018:4177-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4177-1 Rating: moderate References: #1114157 #1114169 #1114170 #1116592 Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 CVE-2018-16855 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). - CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1570=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.2-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://www.suse.com/security/cve/CVE-2018-14644.html https://www.suse.com/security/cve/CVE-2018-16855.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 https://bugzilla.suse.com/1114170 https://bugzilla.suse.com/1116592

1 0

openSUSE-SU-2018:4175-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4175-1 Rating: moderate References: #1114157 #1114169 Cross-References: CVE-2018-10851 CVE-2018-14626 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1571=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.3.1 pdns-backend-geoip-4.1.2-bp150.2.3.1 pdns-backend-godbc-4.1.2-bp150.2.3.1 pdns-backend-ldap-4.1.2-bp150.2.3.1 pdns-backend-lua-4.1.2-bp150.2.3.1 pdns-backend-mydns-4.1.2-bp150.2.3.1 pdns-backend-mysql-4.1.2-bp150.2.3.1 pdns-backend-postgresql-4.1.2-bp150.2.3.1 pdns-backend-remote-4.1.2-bp150.2.3.1 pdns-backend-sqlite3-4.1.2-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169

1 0

openSUSE-SU-2018:4174-1: important: Security update for salt
by opensuse-security＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4174-1 Rating: important References: #1110938 #1112874 #1113698 #1113699 #1113784 #1114197 #1114824 Cross-References: CVE-2018-15750 CVE-2018-15751 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has 5 fixes is now available. Description: This update for salt fixes the following issues: Security issues fixed: - CVE-2018-15750: Fixed directory traversal vulnerability in salt-api (bsc#1113698). - CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi) that allows to execute arbitrary commands (bsc#1113699). Non-security issues fixed: - Improved handling of LDAP group id. gid is no longer treated as a string, which could have lead to faulty group creations (bsc#1113784). - Fixed async call to process manager (bsc#1110938) - Fixed OS arch detection when RPM is not installed (bsc#1114197) - Crontab module fix: file attributes option missing (bsc#1114824) - Fix git_pillar merging across multiple __env__ repositories (bsc#1112874) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1569=1 Package List: - openSUSE Leap 15.0 (x86_64): python2-salt-2018.3.0-lp150.3.17.1 python3-salt-2018.3.0-lp150.3.17.1 salt-2018.3.0-lp150.3.17.1 salt-api-2018.3.0-lp150.3.17.1 salt-cloud-2018.3.0-lp150.3.17.1 salt-doc-2018.3.0-lp150.3.17.1 salt-master-2018.3.0-lp150.3.17.1 salt-minion-2018.3.0-lp150.3.17.1 salt-proxy-2018.3.0-lp150.3.17.1 salt-ssh-2018.3.0-lp150.3.17.1 salt-syndic-2018.3.0-lp150.3.17.1 - openSUSE Leap 15.0 (noarch): salt-bash-completion-2018.3.0-lp150.3.17.1 salt-fish-completion-2018.3.0-lp150.3.17.1 salt-zsh-completion-2018.3.0-lp150.3.17.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://bugzilla.suse.com/1110938 https://bugzilla.suse.com/1112874 https://bugzilla.suse.com/1113698 https://bugzilla.suse.com/1113699 https://bugzilla.suse.com/1113784 https://bugzilla.suse.com/1114197 https://bugzilla.suse.com/1114824

1 0

openSUSE-RU-2018:4173-1: moderate: Recommended update for zynaddsubfx
by maintenance＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Recommended Update: Recommended update for zynaddsubfx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4173-1 Rating: moderate References: #1116460 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for zynaddsubfx fixes the following issues: - Require zynaddsubfx-common subpackage which is needed to run and fixes boo#1116460. - README.adoc states license is GPL 2+, updated %License field. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1567=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1567=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1567=1 Package List: - openSUSE Leap 42.3 (x86_64): zynaddsubfx-3.0.1-2.3.1 zynaddsubfx-debuginfo-3.0.1-2.3.1 zynaddsubfx-debugsource-3.0.1-2.3.1 zynaddsubfx-dssi-3.0.1-2.3.1 zynaddsubfx-dssi-debuginfo-3.0.1-2.3.1 zynaddsubfx-lv2-3.0.1-2.3.1 zynaddsubfx-lv2-debuginfo-3.0.1-2.3.1 zynaddsubfx-vst-3.0.1-2.3.1 zynaddsubfx-vst-debuginfo-3.0.1-2.3.1 - openSUSE Leap 42.3 (noarch): zynaddsubfx-common-3.0.1-2.3.1 - openSUSE Leap 15.0 (noarch): zynaddsubfx-common-3.0.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): zynaddsubfx-3.0.3-lp150.2.3.1 zynaddsubfx-debuginfo-3.0.3-lp150.2.3.1 zynaddsubfx-debugsource-3.0.3-lp150.2.3.1 zynaddsubfx-dssi-3.0.3-lp150.2.3.1 zynaddsubfx-dssi-debuginfo-3.0.3-lp150.2.3.1 zynaddsubfx-lv2-3.0.3-lp150.2.3.1 zynaddsubfx-lv2-debuginfo-3.0.3-lp150.2.3.1 zynaddsubfx-vst-3.0.3-lp150.2.3.1 zynaddsubfx-vst-debuginfo-3.0.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): zynaddsubfx-3.0.3-bp150.3.3.1 zynaddsubfx-dssi-3.0.3-bp150.3.3.1 zynaddsubfx-lv2-3.0.3-bp150.3.3.1 zynaddsubfx-vst-3.0.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): zynaddsubfx-common-3.0.3-bp150.3.3.1 References: https://bugzilla.suse.com/1116460

1 0

openSUSE-RU-2018:4172-1: Optional update for gcc8
by maintenance＠opensuse.org 18 Dec '18

18 Dec '18

openSUSE Recommended Update: Optional update for gcc8 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4172-1 Rating: low References: #1084812 #1084842 #1087550 #1094222 #1102564 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update adds the GNU Compiler GCC 8 to the distribution. The update also supplies gcc8 compatible libstdc++, libgcc_s1 and other gcc derived libraries to openSUSE Leap 15.0. Various optimizers have been improved in GCC 8, several of bugs fixed, quite some new warnings added and the error pin-pointing and fix-suggestions have been greatly improved. The GNU Compiler page for GCC 8 contains a summary of all the changes that have happened: https://gcc.gnu.org/gcc-8/changes.html Also changes needed or common pitfalls when porting software are described on: https://gcc.gnu.org/gcc-8/porting_to.html To use gcc8: - Install the "gcc8" (and likely also gcc8-c++) packages. - Use "gcc-8" or "g++-8" instead of the regular gcc / g++. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1568=1 Package List: - openSUSE Leap 15.0 (noarch): gcc8-info-8.2.1+r264010-lp150.2.3 - openSUSE Leap 15.0 (x86_64): cpp8-8.2.1+r264010-lp150.2.3 cpp8-debuginfo-8.2.1+r264010-lp150.2.3 cross-nvptx-gcc8-8.2.1+r264010-lp150.2.1 cross-nvptx-newlib8-devel-8.2.1+r264010-lp150.2.1 gcc8-32bit-8.2.1+r264010-lp150.2.3 gcc8-8.2.1+r264010-lp150.2.3 gcc8-ada-32bit-8.2.1+r264010-lp150.2.3 gcc8-ada-8.2.1+r264010-lp150.2.3 gcc8-ada-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-c++-32bit-8.2.1+r264010-lp150.2.3 gcc8-c++-8.2.1+r264010-lp150.2.3 gcc8-c++-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-debugsource-8.2.1+r264010-lp150.2.3 gcc8-fortran-32bit-8.2.1+r264010-lp150.2.3 gcc8-fortran-8.2.1+r264010-lp150.2.3 gcc8-fortran-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-go-32bit-8.2.1+r264010-lp150.2.3 gcc8-go-8.2.1+r264010-lp150.2.3 gcc8-go-debuginfo-8.2.1+r264010-lp150.2.3 gcc8-locale-8.2.1+r264010-lp150.2.3 libada8-32bit-8.2.1+r264010-lp150.2.3 libada8-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libada8-8.2.1+r264010-lp150.2.3 libada8-debuginfo-8.2.1+r264010-lp150.2.3 libasan5-32bit-8.2.1+r264010-lp150.2.3 libasan5-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libasan5-8.2.1+r264010-lp150.2.3 libasan5-debuginfo-8.2.1+r264010-lp150.2.3 libatomic1-32bit-8.2.1+r264010-lp150.2.3 libatomic1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libatomic1-8.2.1+r264010-lp150.2.3 libatomic1-debuginfo-8.2.1+r264010-lp150.2.3 libgcc_s1-32bit-8.2.1+r264010-lp150.2.3 libgcc_s1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgcc_s1-8.2.1+r264010-lp150.2.3 libgcc_s1-debuginfo-8.2.1+r264010-lp150.2.3 libgfortran5-32bit-8.2.1+r264010-lp150.2.3 libgfortran5-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgfortran5-8.2.1+r264010-lp150.2.3 libgfortran5-debuginfo-8.2.1+r264010-lp150.2.3 libgo13-32bit-8.2.1+r264010-lp150.2.3 libgo13-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgo13-8.2.1+r264010-lp150.2.3 libgo13-debuginfo-8.2.1+r264010-lp150.2.3 libgomp1-32bit-8.2.1+r264010-lp150.2.3 libgomp1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libgomp1-8.2.1+r264010-lp150.2.3 libgomp1-debuginfo-8.2.1+r264010-lp150.2.3 libitm1-32bit-8.2.1+r264010-lp150.2.3 libitm1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libitm1-8.2.1+r264010-lp150.2.3 libitm1-debuginfo-8.2.1+r264010-lp150.2.3 liblsan0-8.2.1+r264010-lp150.2.3 liblsan0-debuginfo-8.2.1+r264010-lp150.2.3 libmpx2-32bit-8.2.1+r264010-lp150.2.3 libmpx2-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libmpx2-8.2.1+r264010-lp150.2.3 libmpx2-debuginfo-8.2.1+r264010-lp150.2.3 libmpxwrappers2-32bit-8.2.1+r264010-lp150.2.3 libmpxwrappers2-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libmpxwrappers2-8.2.1+r264010-lp150.2.3 libmpxwrappers2-debuginfo-8.2.1+r264010-lp150.2.3 libquadmath0-32bit-8.2.1+r264010-lp150.2.3 libquadmath0-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libquadmath0-8.2.1+r264010-lp150.2.3 libquadmath0-debuginfo-8.2.1+r264010-lp150.2.3 libstdc++6-32bit-8.2.1+r264010-lp150.2.3 libstdc++6-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libstdc++6-8.2.1+r264010-lp150.2.3 libstdc++6-debuginfo-8.2.1+r264010-lp150.2.3 libstdc++6-devel-gcc8-32bit-8.2.1+r264010-lp150.2.3 libstdc++6-devel-gcc8-8.2.1+r264010-lp150.2.3 libstdc++6-locale-8.2.1+r264010-lp150.2.3 libtsan0-8.2.1+r264010-lp150.2.3 libtsan0-debuginfo-8.2.1+r264010-lp150.2.3 libubsan1-32bit-8.2.1+r264010-lp150.2.3 libubsan1-32bit-debuginfo-8.2.1+r264010-lp150.2.3 libubsan1-8.2.1+r264010-lp150.2.3 libubsan1-debuginfo-8.2.1+r264010-lp150.2.3 References: https://bugzilla.suse.com/1084812 https://bugzilla.suse.com/1084842 https://bugzilla.suse.com/1087550 https://bugzilla.suse.com/1094222 https://bugzilla.suse.com/1102564

1 0

openSUSE-SU-2018:4156-1: moderate: Security update for pdns
by opensuse-security＠opensuse.org 17 Dec '18

17 Dec '18

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4156-1 Rating: moderate References: #1114157 #1114169 Cross-References: CVE-2018-10851 CVE-2018-14626 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1566=1 Package List: - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.6.1 pdns-backend-geoip-4.1.2-lp150.3.6.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-godbc-4.1.2-lp150.3.6.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-ldap-4.1.2-lp150.3.6.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-lua-4.1.2-lp150.3.6.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-mydns-4.1.2-lp150.3.6.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-mysql-4.1.2-lp150.3.6.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-postgresql-4.1.2-lp150.3.6.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-remote-4.1.2-lp150.3.6.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.6.1 pdns-backend-sqlite3-4.1.2-lp150.3.6.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.6.1 pdns-debuginfo-4.1.2-lp150.3.6.1 pdns-debugsource-4.1.2-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169

1 0

openSUSE-SU-2018:4152-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 17 Dec '18

17 Dec '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4152-1 Rating: moderate References: #1114157 #1114169 #1114170 #1116592 Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 CVE-2018-16855 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). - CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1565=1 Package List: - openSUSE Leap 15.0 (x86_64): pdns-recursor-4.1.2-lp150.2.3.1 pdns-recursor-debuginfo-4.1.2-lp150.2.3.1 pdns-recursor-debugsource-4.1.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://www.suse.com/security/cve/CVE-2018-14644.html https://www.suse.com/security/cve/CVE-2018-16855.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 https://bugzilla.suse.com/1114170 https://bugzilla.suse.com/1116592

1 0

openSUSE-SU-2018:4151-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 17 Dec '18

17 Dec '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4151-1 Rating: moderate References: #1114157 #1114169 #1114170 Cross-References: CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). - CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). - CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1564=1 Package List: - openSUSE Leap 42.3 (x86_64): pdns-recursor-4.0.5-9.1 pdns-recursor-debuginfo-4.0.5-9.1 pdns-recursor-debugsource-4.0.5-9.1 References: https://www.suse.com/security/cve/CVE-2018-10851.html https://www.suse.com/security/cve/CVE-2018-14626.html https://www.suse.com/security/cve/CVE-2018-14644.html https://bugzilla.suse.com/1114157 https://bugzilla.suse.com/1114169 https://bugzilla.suse.com/1114170

1 0

openSUSE-SU-2018:4148-1: moderate: Security update for openvswitch
by opensuse-security＠opensuse.org 15 Dec '18

15 Dec '18

openSUSE Security Update: Security update for openvswitch ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4148-1 Rating: moderate References: #1104467 Cross-References: CVE-2018-17204 CVE-2018-17205 CVE-2018-17206 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openvswitch to version 2.7.6 fixes the following issues: These security issues were fixed: - CVE-2018-17205: Prevent OVS crash when reverting old flows in bundle commit (bsc#1104467). - CVE-2018-17206: Avoid buffer overread in BUNDLE action decoding (bsc#1104467). - CVE-2018-17204:When decoding a group mod, it validated the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tried to use the type and command earlier, when it might still be invalid. This caused an assertion failure (via OVS_NOT_REACHED) (bsc#1104467). These non-security issues were fixed: - ofproto/bond: Fix bond reconfiguration race condition. - ofproto/bond: Fix bond post recirc rule leak. - ofproto/bond: fix interal flow leak of tcp-balance bond - systemd: Restart openvswitch service if a daemon crashes - conntrack: Fix checks for TCP, UDP, and IPv6 header sizes. - ofp-actions: Fix translation of set_field for nw_ecn - netdev-dpdk: Fix mempool segfault. - ofproto-dpif-upcall: Fix flow setup/delete race. - learn: Fix memory leak in learn_parse_sepc() - netdev-dpdk: fix mempool_configure error state - vswitchd: Add --cleanup option to the 'appctl exit' command - ofp-parse: Fix memory leak on error path in parse_ofp_group_mod_file(). - actions: Fix memory leak on error path in parse_ct_lb_action(). - dpif-netdev: Fix use-after-free error in reconfigure_datapath(). - bridge: Fix memory leak in bridge_aa_update_trunks(). - dpif-netlink: Fix multiple-free and fd leak on error path. - ofp-print: Avoid array overread in print_table_instruction_features(). - flow: Fix buffer overread in flow_hash_symmetric_l3l4(). - systemd: start vswitchd after udev - ofp-util: Check length of buckets in ofputil_pull_ofp15_group_mod(). - ovsdb-types: Fix memory leak on error path. - tnl-ports: Fix loss of tunneling upon removal of a single tunnel port. - netdev: check for NULL fields in netdev_get_addrs - netdev-dpdk: vhost get stats fix. - netdev-dpdk: use 64-bit arithmetic when converting rates. - ofp-util: Fix buffer overread in ofputil_decode_bundle_add(). - ofp-util: Fix memory leaks on error cases in ofputil_decode_group_mod(). - ofp-util: Fix memory leaks when parsing OF1.5 group properties. - ofp-actions: Fix buffer overread in decode_LEARN_specs(). - flow: Fix buffer overread for crafted IPv6 packets. - ofp-actions: Properly interpret "output:in_port". - ovs-ofctl: Avoid read overrun in ofperr_decode_msg(). - odp-util: Avoid misaligned references to ip6_hdr. - ofproto-dpif-upcall: Fix action attr iteration. - ofproto-dpif-upcall: Fix key attr iteration. - netdev-dpdk: vhost get stats fix. - netdev-dpdk: use 64-bit arithmetic when converting rates. - ofp-util: Fix buffer overread in ofputil_decode_bundle_add(). - ofp-util: Fix memory leaks on error cases in ofputil_decode_group_mod(). - ofp-util: Fix memory leaks when parsing OF1.5 group properties. - odp-util: Fix buffer overread in parsing string form of ODP flows. - ovs-vsctl: Fix segfault when attempting to del-port from parent bridge. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1562=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): openvswitch-2.7.6-19.1 openvswitch-debuginfo-2.7.6-19.1 openvswitch-debugsource-2.7.6-19.1 openvswitch-devel-2.7.6-19.1 openvswitch-ovn-central-2.7.6-19.1 openvswitch-ovn-central-debuginfo-2.7.6-19.1 openvswitch-ovn-common-2.7.6-19.1 openvswitch-ovn-common-debuginfo-2.7.6-19.1 openvswitch-ovn-docker-2.7.6-19.1 openvswitch-ovn-host-2.7.6-19.1 openvswitch-ovn-host-debuginfo-2.7.6-19.1 openvswitch-ovn-vtep-2.7.6-19.1 openvswitch-ovn-vtep-debuginfo-2.7.6-19.1 openvswitch-pki-2.7.6-19.1 openvswitch-test-2.7.6-19.1 openvswitch-test-debuginfo-2.7.6-19.1 openvswitch-vtep-2.7.6-19.1 openvswitch-vtep-debuginfo-2.7.6-19.1 python-openvswitch-2.7.6-19.1 python-openvswitch-test-2.7.6-19.1 References: https://www.suse.com/security/cve/CVE-2018-17204.html https://www.suse.com/security/cve/CVE-2018-17205.html https://www.suse.com/security/cve/CVE-2018-17206.html https://bugzilla.suse.com/1104467

1 0

openSUSE-SU-2018:4147-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 15 Dec '18

15 Dec '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4147-1 Rating: moderate References: #1100408 #1106222 #1110910 #1111006 #1111010 #1111013 #1114422 Cross-References: CVE-2018-10839 CVE-2018-15746 CVE-2018-17958 CVE-2018-17962 CVE-2018-17963 CVE-2018-18849 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS (bsc#1110910). - CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread (bsc#1106222). - CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used (bsc#1111006). - CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used (bsc#1111010). - CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111013) - CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value. A user/process could use this flaw to crash the Qemu process resulting in DoS (bsc#1114422). Non-security issues fixed: - Improving disk performance for qemu on xen (bsc#1100408) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1563=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-50.1 qemu-linux-user-debuginfo-2.9.1-50.1 qemu-linux-user-debugsource-2.9.1-50.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-50.1 qemu-arm-2.9.1-50.1 qemu-arm-debuginfo-2.9.1-50.1 qemu-block-curl-2.9.1-50.1 qemu-block-curl-debuginfo-2.9.1-50.1 qemu-block-dmg-2.9.1-50.1 qemu-block-dmg-debuginfo-2.9.1-50.1 qemu-block-iscsi-2.9.1-50.1 qemu-block-iscsi-debuginfo-2.9.1-50.1 qemu-block-rbd-2.9.1-50.1 qemu-block-rbd-debuginfo-2.9.1-50.1 qemu-block-ssh-2.9.1-50.1 qemu-block-ssh-debuginfo-2.9.1-50.1 qemu-debugsource-2.9.1-50.1 qemu-extra-2.9.1-50.1 qemu-extra-debuginfo-2.9.1-50.1 qemu-guest-agent-2.9.1-50.1 qemu-guest-agent-debuginfo-2.9.1-50.1 qemu-ksm-2.9.1-50.1 qemu-kvm-2.9.1-50.1 qemu-lang-2.9.1-50.1 qemu-ppc-2.9.1-50.1 qemu-ppc-debuginfo-2.9.1-50.1 qemu-s390-2.9.1-50.1 qemu-s390-debuginfo-2.9.1-50.1 qemu-testsuite-2.9.1-50.1 qemu-tools-2.9.1-50.1 qemu-tools-debuginfo-2.9.1-50.1 qemu-x86-2.9.1-50.1 qemu-x86-debuginfo-2.9.1-50.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0+-50.1 qemu-seabios-1.10.2-50.1 qemu-sgabios-8-50.1 qemu-vgabios-1.10.2-50.1 References: https://www.suse.com/security/cve/CVE-2018-10839.html https://www.suse.com/security/cve/CVE-2018-15746.html https://www.suse.com/security/cve/CVE-2018-17958.html https://www.suse.com/security/cve/CVE-2018-17962.html https://www.suse.com/security/cve/CVE-2018-17963.html https://www.suse.com/security/cve/CVE-2018-18849.html https://bugzilla.suse.com/1100408 https://bugzilla.suse.com/1106222 https://bugzilla.suse.com/1110910 https://bugzilla.suse.com/1111006 https://bugzilla.suse.com/1111010 https://bugzilla.suse.com/1111013 https://bugzilla.suse.com/1114422

1 0

openSUSE-RU-2018:4146-1: moderate: Recommended update for libcdio
by maintenance＠opensuse.org 15 Dec '18

15 Dec '18

openSUSE Recommended Update: Recommended update for libcdio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4146-1 Rating: moderate References: #1108134 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libcdio fixes the following issues: - Remove API/ABI breaking changes from libcdio patch (bsc#1108134). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1561=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libcdio++0-0.94-lp150.5.6.1 libcdio++0-debuginfo-0.94-lp150.5.6.1 libcdio-debugsource-0.94-lp150.5.6.1 libcdio-devel-0.94-lp150.5.6.1 libcdio16-0.94-lp150.5.6.1 libcdio16-debuginfo-0.94-lp150.5.6.1 libiso9660-10-0.94-lp150.5.6.1 libiso9660-10-debuginfo-0.94-lp150.5.6.1 libudf0-0.94-lp150.5.6.1 libudf0-debuginfo-0.94-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): cdio-utils-0.94-lp150.5.6.1 cdio-utils-debuginfo-0.94-lp150.5.6.1 cdio-utils-debugsource-0.94-lp150.5.6.1 libcdio++0-32bit-0.94-lp150.5.6.1 libcdio++0-32bit-debuginfo-0.94-lp150.5.6.1 libcdio16-32bit-0.94-lp150.5.6.1 libcdio16-32bit-debuginfo-0.94-lp150.5.6.1 libiso9660-10-32bit-0.94-lp150.5.6.1 libiso9660-10-32bit-debuginfo-0.94-lp150.5.6.1 libudf0-32bit-0.94-lp150.5.6.1 libudf0-32bit-debuginfo-0.94-lp150.5.6.1 References: https://bugzilla.suse.com/1108134

1 0

openSUSE-RU-2018:4145-1: moderate: Recommended update for yast2-storage-ng
by maintenance＠opensuse.org 15 Dec '18

15 Dec '18

openSUSE Recommended Update: Recommended update for yast2-storage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4145-1 Rating: moderate References: #1115508 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-storage-ng fixes the following issues: - SkipListValue.size_k returns the correct value. (bsc#1115508) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1560=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-storage-ng-4.0.215-lp150.2.18.1 References: https://bugzilla.suse.com/1115508

1 0