December 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:4046-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4046-1 Rating: moderate References: #1115416 Cross-References: CVE-2018-19141 CVE-2018-19143 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for otrs fixes the following issues: Update to version 4.0.33. Security issues fixed: - CVE-2018-19141: Fixed privilege escalation, that an attacker who is logged into OTRS as an admin user cannot manipulate the URL to cause execution of JavaScript in the context of OTRS. - CVE-2018-19143: Fixed remote file deletion, that an attacker who is logged into OTRS as a user cannot manipulate the submission form to cause deletion of arbitrary files that the OTRS web server user has write access to. Non-security issues fixed: - Full release notes can be found at: * https://community.otrs.com/release-notes-otrs-4-patch-level-33/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1503=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1503=1 Package List: - openSUSE Leap 15.0 (noarch): otrs-4.0.33-lp150.2.6.1 otrs-doc-4.0.33-lp150.2.6.1 otrs-itsm-4.0.33-lp150.2.6.1 - openSUSE Backports SLE-15 (noarch): otrs-4.0.33-bp150.3.6.1 otrs-doc-4.0.33-bp150.3.6.1 otrs-itsm-4.0.33-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19141.html https://www.suse.com/security/cve/CVE-2018-19143.html https://bugzilla.suse.com/1115416

1 0

openSUSE-SU-2018:4045-1: moderate: Security update for dom4j
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4045-1 Rating: moderate References: #1105443 Cross-References: CVE-2018-1000632 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection that could have resulted in an attacker tampering with XML documents (bsc#1105443). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1492=1 Package List: - openSUSE Backports SLE-15 (noarch): dom4j-1.6.1-bp150.2.3.1 dom4j-demo-1.6.1-bp150.2.3.1 dom4j-javadoc-1.6.1-bp150.2.3.1 dom4j-manual-1.6.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000632.html https://bugzilla.suse.com/1105443

1 0

openSUSE-RU-2018:4044-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4044-1 Rating: moderate References: #1102589 #1107753 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for open-iscsi fixes the following issues: - iscsiuio: Do not flush tx queue on each uio interrupt. This makes ping to such NICs work better (bsc#1102589) - Not allow multiple sessions just because they were started in parallel (bsc#1107753) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1505=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): iscsiuio-0.7.8.2-lp150.9.6.1 iscsiuio-debuginfo-0.7.8.2-lp150.9.6.1 libopeniscsiusr0_2_0-2.0.876-lp150.9.6.1 libopeniscsiusr0_2_0-debuginfo-2.0.876-lp150.9.6.1 open-iscsi-2.0.876-lp150.9.6.1 open-iscsi-debuginfo-2.0.876-lp150.9.6.1 open-iscsi-debugsource-2.0.876-lp150.9.6.1 open-iscsi-devel-2.0.876-lp150.9.6.1 References: https://bugzilla.suse.com/1102589 https://bugzilla.suse.com/1107753

1 0

openSUSE-SU-2018:4043-1: important: Security update for pam
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for pam ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4043-1 Rating: important References: #1115640 Cross-References: CVE-2018-17953 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pam fixes the following issue: Security issue fixed: - CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified (bsc#1115640). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1511=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): pam-1.3.0-lp150.5.6.1 pam-debuginfo-1.3.0-lp150.5.6.1 pam-debugsource-1.3.0-lp150.5.6.1 pam-devel-1.3.0-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): pam-32bit-1.3.0-lp150.5.6.1 pam-32bit-debuginfo-1.3.0-lp150.5.6.1 pam-devel-32bit-1.3.0-lp150.5.6.1 - openSUSE Leap 15.0 (noarch): pam-doc-1.3.0-lp150.5.6.1 References: https://www.suse.com/security/cve/CVE-2018-17953.html https://bugzilla.suse.com/1115640

1 0

openSUSE-SU-2018:4042-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4042-1 Rating: moderate References: #1110850 Cross-References: CVE-2018-11784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat to 9.0.12 fixes the following issues: See the full changelog at: http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.12_(markt ) Security issues fixed: - CVE-2018-11784: When the default servlet in Apache Tomcat returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. (bsc#1110850) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1504=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.12-lp150.2.6.1 tomcat-admin-webapps-9.0.12-lp150.2.6.1 tomcat-docs-webapp-9.0.12-lp150.2.6.1 tomcat-el-3_0-api-9.0.12-lp150.2.6.1 tomcat-embed-9.0.12-lp150.2.6.1 tomcat-javadoc-9.0.12-lp150.2.6.1 tomcat-jsp-2_3-api-9.0.12-lp150.2.6.1 tomcat-jsvc-9.0.12-lp150.2.6.1 tomcat-lib-9.0.12-lp150.2.6.1 tomcat-servlet-4_0-api-9.0.12-lp150.2.6.1 tomcat-webapps-9.0.12-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-11784.html https://bugzilla.suse.com/1110850

1 0

openSUSE-SU-2018:4041-1: Security update for rubygem-activejob-5_1
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for rubygem-activejob-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4041-1 Rating: low References: #1117632 Cross-References: CVE-2018-16476 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-activejob-5_1 fixes the following issues: Security issue fixed: - CVE-2018-16476: Fixed broken access control vulnerability (bsc#1117632). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1502=1 Package List: - openSUSE Leap 15.0 (x86_64): ruby2.5-rubygem-activejob-5_1-5.1.4-lp150.2.3.1 ruby2.5-rubygem-activejob-doc-5_1-5.1.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16476.html https://bugzilla.suse.com/1117632

1 0

openSUSE-RU-2018:4040-1: Recommended update for Mesa
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for Mesa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4040-1 Rating: low References: #1113211 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Mesa fixes the following issues: - Disallow rgb10 configs for chromium with radeonsi to prevent broken colors in video. (bsc#1113211) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1501=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): Mesa-18.0.2-lp150.18.3.1 Mesa-debugsource-18.0.2-lp150.18.3.1 Mesa-devel-18.0.2-lp150.18.3.1 Mesa-dri-18.0.2-lp150.18.3.1 Mesa-dri-debuginfo-18.0.2-lp150.18.3.1 Mesa-dri-devel-18.0.2-lp150.18.3.1 Mesa-dri-nouveau-18.0.2-lp150.18.3.1 Mesa-dri-nouveau-debuginfo-18.0.2-lp150.18.3.1 Mesa-drivers-debugsource-18.0.2-lp150.18.3.1 Mesa-gallium-18.0.2-lp150.18.3.1 Mesa-gallium-debuginfo-18.0.2-lp150.18.3.1 Mesa-libEGL-devel-18.0.2-lp150.18.3.1 Mesa-libEGL1-18.0.2-lp150.18.3.1 Mesa-libEGL1-debuginfo-18.0.2-lp150.18.3.1 Mesa-libGL-devel-18.0.2-lp150.18.3.1 Mesa-libGL1-18.0.2-lp150.18.3.1 Mesa-libGL1-debuginfo-18.0.2-lp150.18.3.1 Mesa-libGLESv1_CM-devel-18.0.2-lp150.18.3.1 Mesa-libGLESv1_CM1-18.0.2-lp150.18.3.1 Mesa-libGLESv2-2-18.0.2-lp150.18.3.1 Mesa-libGLESv2-devel-18.0.2-lp150.18.3.1 Mesa-libGLESv3-devel-18.0.2-lp150.18.3.1 Mesa-libOpenCL-18.0.2-lp150.18.3.1 Mesa-libOpenCL-debuginfo-18.0.2-lp150.18.3.1 Mesa-libVulkan-devel-18.0.2-lp150.18.3.1 Mesa-libd3d-18.0.2-lp150.18.3.1 Mesa-libd3d-debuginfo-18.0.2-lp150.18.3.1 Mesa-libd3d-devel-18.0.2-lp150.18.3.1 Mesa-libglapi-devel-18.0.2-lp150.18.3.1 Mesa-libglapi0-18.0.2-lp150.18.3.1 Mesa-libglapi0-debuginfo-18.0.2-lp150.18.3.1 Mesa-libva-18.0.2-lp150.18.3.1 Mesa-libva-debuginfo-18.0.2-lp150.18.3.1 libOSMesa-devel-18.0.2-lp150.18.3.1 libOSMesa8-18.0.2-lp150.18.3.1 libOSMesa8-debuginfo-18.0.2-lp150.18.3.1 libXvMC_nouveau-18.0.2-lp150.18.3.1 libXvMC_nouveau-debuginfo-18.0.2-lp150.18.3.1 libXvMC_r600-18.0.2-lp150.18.3.1 libXvMC_r600-debuginfo-18.0.2-lp150.18.3.1 libgbm-devel-18.0.2-lp150.18.3.1 libgbm1-18.0.2-lp150.18.3.1 libgbm1-debuginfo-18.0.2-lp150.18.3.1 libvdpau_nouveau-18.0.2-lp150.18.3.1 libvdpau_nouveau-debuginfo-18.0.2-lp150.18.3.1 libvdpau_r300-18.0.2-lp150.18.3.1 libvdpau_r300-debuginfo-18.0.2-lp150.18.3.1 libvdpau_r600-18.0.2-lp150.18.3.1 libvdpau_r600-debuginfo-18.0.2-lp150.18.3.1 libvdpau_radeonsi-18.0.2-lp150.18.3.1 libvdpau_radeonsi-debuginfo-18.0.2-lp150.18.3.1 libvulkan_intel-18.0.2-lp150.18.3.1 libvulkan_intel-debuginfo-18.0.2-lp150.18.3.1 libvulkan_radeon-18.0.2-lp150.18.3.1 libvulkan_radeon-debuginfo-18.0.2-lp150.18.3.1 libwayland-egl-devel-18.0.2-lp150.18.3.1 libwayland-egl1-18.0.2-lp150.18.3.1 libwayland-egl1-debuginfo-18.0.2-lp150.18.3.1 libxatracker-devel-1.0.0-lp150.18.3.1 libxatracker2-1.0.0-lp150.18.3.1 libxatracker2-debuginfo-1.0.0-lp150.18.3.1 - openSUSE Leap 15.0 (x86_64): Mesa-32bit-18.0.2-lp150.18.3.1 Mesa-dri-32bit-18.0.2-lp150.18.3.1 Mesa-dri-32bit-debuginfo-18.0.2-lp150.18.3.1 Mesa-dri-nouveau-32bit-18.0.2-lp150.18.3.1 Mesa-dri-nouveau-32bit-debuginfo-18.0.2-lp150.18.3.1 Mesa-gallium-32bit-18.0.2-lp150.18.3.1 Mesa-gallium-32bit-debuginfo-18.0.2-lp150.18.3.1 Mesa-libEGL1-32bit-18.0.2-lp150.18.3.1 Mesa-libEGL1-32bit-debuginfo-18.0.2-lp150.18.3.1 Mesa-libGL1-32bit-18.0.2-lp150.18.3.1 Mesa-libGL1-32bit-debuginfo-18.0.2-lp150.18.3.1 Mesa-libd3d-32bit-18.0.2-lp150.18.3.1 Mesa-libd3d-32bit-debuginfo-18.0.2-lp150.18.3.1 Mesa-libd3d-devel-32bit-18.0.2-lp150.18.3.1 Mesa-libglapi-devel-32bit-18.0.2-lp150.18.3.1 Mesa-libglapi0-32bit-18.0.2-lp150.18.3.1 Mesa-libglapi0-32bit-debuginfo-18.0.2-lp150.18.3.1 libOSMesa-devel-32bit-18.0.2-lp150.18.3.1 libOSMesa8-32bit-18.0.2-lp150.18.3.1 libOSMesa8-32bit-debuginfo-18.0.2-lp150.18.3.1 libXvMC_nouveau-32bit-18.0.2-lp150.18.3.1 libXvMC_nouveau-32bit-debuginfo-18.0.2-lp150.18.3.1 libXvMC_r600-32bit-18.0.2-lp150.18.3.1 libXvMC_r600-32bit-debuginfo-18.0.2-lp150.18.3.1 libgbm-devel-32bit-18.0.2-lp150.18.3.1 libgbm1-32bit-18.0.2-lp150.18.3.1 libgbm1-32bit-debuginfo-18.0.2-lp150.18.3.1 libvdpau_nouveau-32bit-18.0.2-lp150.18.3.1 libvdpau_nouveau-32bit-debuginfo-18.0.2-lp150.18.3.1 libvdpau_r300-32bit-18.0.2-lp150.18.3.1 libvdpau_r300-32bit-debuginfo-18.0.2-lp150.18.3.1 libvdpau_r600-32bit-18.0.2-lp150.18.3.1 libvdpau_r600-32bit-debuginfo-18.0.2-lp150.18.3.1 libvdpau_radeonsi-32bit-18.0.2-lp150.18.3.1 libvdpau_radeonsi-32bit-debuginfo-18.0.2-lp150.18.3.1 libvulkan_intel-32bit-18.0.2-lp150.18.3.1 libvulkan_intel-32bit-debuginfo-18.0.2-lp150.18.3.1 libvulkan_radeon-32bit-18.0.2-lp150.18.3.1 libvulkan_radeon-32bit-debuginfo-18.0.2-lp150.18.3.1 libwayland-egl-devel-32bit-18.0.2-lp150.18.3.1 libwayland-egl1-32bit-18.0.2-lp150.18.3.1 libwayland-egl1-32bit-debuginfo-18.0.2-lp150.18.3.1 References: https://bugzilla.suse.com/1113211

1 0

openSUSE-RU-2018:4039-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4039-1 Rating: moderate References: #1055834 #1090884 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut fixes the following issues: - 98dracut-systemd: Start systemd-vconsole-setup before dracut-cmdline-ask (bsc#1055834) - Mark the DASD udev rules host-only and handle backslashes in paths for hostonly files (bsc#1090884) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1497=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dracut-044.1-lp150.14.9.1 dracut-debuginfo-044.1-lp150.14.9.1 dracut-debugsource-044.1-lp150.14.9.1 dracut-fips-044.1-lp150.14.9.1 dracut-ima-044.1-lp150.14.9.1 dracut-tools-044.1-lp150.14.9.1 References: https://bugzilla.suse.com/1055834 https://bugzilla.suse.com/1090884

1 0

openSUSE-SU-2018:4038-1: moderate: Recommended update for php5
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Recommended update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4038-1 Rating: moderate References: #1117107 Cross-References: CVE-2018-19518 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: Security issue fixed: - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1506=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-109.1 apache2-mod_php5-debuginfo-5.5.14-109.1 php5-5.5.14-109.1 php5-bcmath-5.5.14-109.1 php5-bcmath-debuginfo-5.5.14-109.1 php5-bz2-5.5.14-109.1 php5-bz2-debuginfo-5.5.14-109.1 php5-calendar-5.5.14-109.1 php5-calendar-debuginfo-5.5.14-109.1 php5-ctype-5.5.14-109.1 php5-ctype-debuginfo-5.5.14-109.1 php5-curl-5.5.14-109.1 php5-curl-debuginfo-5.5.14-109.1 php5-dba-5.5.14-109.1 php5-dba-debuginfo-5.5.14-109.1 php5-debuginfo-5.5.14-109.1 php5-debugsource-5.5.14-109.1 php5-devel-5.5.14-109.1 php5-dom-5.5.14-109.1 php5-dom-debuginfo-5.5.14-109.1 php5-enchant-5.5.14-109.1 php5-enchant-debuginfo-5.5.14-109.1 php5-exif-5.5.14-109.1 php5-exif-debuginfo-5.5.14-109.1 php5-fastcgi-5.5.14-109.1 php5-fastcgi-debuginfo-5.5.14-109.1 php5-fileinfo-5.5.14-109.1 php5-fileinfo-debuginfo-5.5.14-109.1 php5-firebird-5.5.14-109.1 php5-firebird-debuginfo-5.5.14-109.1 php5-fpm-5.5.14-109.1 php5-fpm-debuginfo-5.5.14-109.1 php5-ftp-5.5.14-109.1 php5-ftp-debuginfo-5.5.14-109.1 php5-gd-5.5.14-109.1 php5-gd-debuginfo-5.5.14-109.1 php5-gettext-5.5.14-109.1 php5-gettext-debuginfo-5.5.14-109.1 php5-gmp-5.5.14-109.1 php5-gmp-debuginfo-5.5.14-109.1 php5-iconv-5.5.14-109.1 php5-iconv-debuginfo-5.5.14-109.1 php5-imap-5.5.14-109.1 php5-imap-debuginfo-5.5.14-109.1 php5-intl-5.5.14-109.1 php5-intl-debuginfo-5.5.14-109.1 php5-json-5.5.14-109.1 php5-json-debuginfo-5.5.14-109.1 php5-ldap-5.5.14-109.1 php5-ldap-debuginfo-5.5.14-109.1 php5-mbstring-5.5.14-109.1 php5-mbstring-debuginfo-5.5.14-109.1 php5-mcrypt-5.5.14-109.1 php5-mcrypt-debuginfo-5.5.14-109.1 php5-mssql-5.5.14-109.1 php5-mssql-debuginfo-5.5.14-109.1 php5-mysql-5.5.14-109.1 php5-mysql-debuginfo-5.5.14-109.1 php5-odbc-5.5.14-109.1 php5-odbc-debuginfo-5.5.14-109.1 php5-opcache-5.5.14-109.1 php5-opcache-debuginfo-5.5.14-109.1 php5-openssl-5.5.14-109.1 php5-openssl-debuginfo-5.5.14-109.1 php5-pcntl-5.5.14-109.1 php5-pcntl-debuginfo-5.5.14-109.1 php5-pdo-5.5.14-109.1 php5-pdo-debuginfo-5.5.14-109.1 php5-pgsql-5.5.14-109.1 php5-pgsql-debuginfo-5.5.14-109.1 php5-phar-5.5.14-109.1 php5-phar-debuginfo-5.5.14-109.1 php5-posix-5.5.14-109.1 php5-posix-debuginfo-5.5.14-109.1 php5-pspell-5.5.14-109.1 php5-pspell-debuginfo-5.5.14-109.1 php5-readline-5.5.14-109.1 php5-readline-debuginfo-5.5.14-109.1 php5-shmop-5.5.14-109.1 php5-shmop-debuginfo-5.5.14-109.1 php5-snmp-5.5.14-109.1 php5-snmp-debuginfo-5.5.14-109.1 php5-soap-5.5.14-109.1 php5-soap-debuginfo-5.5.14-109.1 php5-sockets-5.5.14-109.1 php5-sockets-debuginfo-5.5.14-109.1 php5-sqlite-5.5.14-109.1 php5-sqlite-debuginfo-5.5.14-109.1 php5-suhosin-5.5.14-109.1 php5-suhosin-debuginfo-5.5.14-109.1 php5-sysvmsg-5.5.14-109.1 php5-sysvmsg-debuginfo-5.5.14-109.1 php5-sysvsem-5.5.14-109.1 php5-sysvsem-debuginfo-5.5.14-109.1 php5-sysvshm-5.5.14-109.1 php5-sysvshm-debuginfo-5.5.14-109.1 php5-tidy-5.5.14-109.1 php5-tidy-debuginfo-5.5.14-109.1 php5-tokenizer-5.5.14-109.1 php5-tokenizer-debuginfo-5.5.14-109.1 php5-wddx-5.5.14-109.1 php5-wddx-debuginfo-5.5.14-109.1 php5-xmlreader-5.5.14-109.1 php5-xmlreader-debuginfo-5.5.14-109.1 php5-xmlrpc-5.5.14-109.1 php5-xmlrpc-debuginfo-5.5.14-109.1 php5-xmlwriter-5.5.14-109.1 php5-xmlwriter-debuginfo-5.5.14-109.1 php5-xsl-5.5.14-109.1 php5-xsl-debuginfo-5.5.14-109.1 php5-zip-5.5.14-109.1 php5-zip-debuginfo-5.5.14-109.1 php5-zlib-5.5.14-109.1 php5-zlib-debuginfo-5.5.14-109.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-109.1 References: https://www.suse.com/security/cve/CVE-2018-19518.html https://bugzilla.suse.com/1117107

1 0

openSUSE-RU-2018:4037-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4037-1 Rating: moderate References: #1052088 #1106946 #1109974 #1109975 #1110463 #1111579 #1112593 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for crmsh fixes the following issues: - cibconfig: Normalize - to _ in param names (bsc#1111579) - ra: Handle obsoletes attribute (bsc#1111579) - ui_cluster: restart cluster is added (bsc#1052088) - Auto-commit enabling/disabling maintenance mode for a whole cluster (bsc#1112593) - bootstrap: Skip netmask check on GCP (bsc#1106946) - utils: Detect local IP on GCP (bsc#1106946) - bootstrap: Correctly check rrp_mode flag (bsc#1110463) - bootstrap: Pick first match for multiple routes (bsc#1106946) - utils: Use cloud metadata service to discover IP (bsc#1106946) - bootstrap: change default ip address way for both mcast and unicat(bsc#1109975,bsc#1109974) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1495=1 Package List: - openSUSE Leap 15.0 (noarch): crmsh-4.0.0+git.1542103310.dd114188-lp150.2.9.1 crmsh-scripts-4.0.0+git.1542103310.dd114188-lp150.2.9.1 crmsh-test-4.0.0+git.1542103310.dd114188-lp150.2.9.1 References: https://bugzilla.suse.com/1052088 https://bugzilla.suse.com/1106946 https://bugzilla.suse.com/1109974 https://bugzilla.suse.com/1109975 https://bugzilla.suse.com/1110463 https://bugzilla.suse.com/1111579 https://bugzilla.suse.com/1112593

1 0

openSUSE-RU-2018:4036-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4036-1 Rating: moderate References: #1044232 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-build-key fixes the following issues: - Install the PTF key also to /usr/lib/rpm/gnupg/keys/ so it can exists also on systems where documentation is not installed. (bsc#1044232) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1496=1 Package List: - openSUSE Leap 42.3 (noarch): suse-build-key-12.0-14.6.1 References: https://bugzilla.suse.com/1044232

1 0

openSUSE-RU-2018:4035-1: moderate: Recommended update for permissions
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4035-1 Rating: moderate References: #1028304 #1047247 #1050467 #1097665 #1111251 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for permissions fixes the following issues: - Allow setuid root for start-suid tool of singularity (group only) bsc#1028304 - Allow setuid root for authbind binary (bsc#1111251) - A incorrect error message was adjusted (bsc#1047247 bsc#1097665) - Make btmp root:utmp (bsc#1050467) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1494=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): permissions-2015.09.28.1626-19.1 permissions-debuginfo-2015.09.28.1626-19.1 permissions-debugsource-2015.09.28.1626-19.1 References: https://bugzilla.suse.com/1028304 https://bugzilla.suse.com/1047247 https://bugzilla.suse.com/1050467 https://bugzilla.suse.com/1097665 https://bugzilla.suse.com/1111251

1 0

openSUSE-SU-2018:4034-1: important: Security update for ncurses
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4034-1 Rating: important References: #1115929 Cross-References: CVE-2018-19211 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ncurses fixes the following issue: Security issue fixed: - CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function _nc_parse_entry (bsc#1115929). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1509=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libncurses5-5.9-66.1 libncurses5-debuginfo-5.9-66.1 libncurses6-5.9-66.1 libncurses6-debuginfo-5.9-66.1 ncurses-debugsource-5.9-66.1 ncurses-devel-5.9-66.1 ncurses-devel-debuginfo-5.9-66.1 ncurses-utils-5.9-66.1 ncurses-utils-debuginfo-5.9-66.1 tack-5.9-66.1 tack-debuginfo-5.9-66.1 terminfo-5.9-66.1 terminfo-base-5.9-66.1 - openSUSE Leap 42.3 (x86_64): libncurses5-32bit-5.9-66.1 libncurses5-debuginfo-32bit-5.9-66.1 libncurses6-32bit-5.9-66.1 libncurses6-debuginfo-32bit-5.9-66.1 ncurses-devel-32bit-5.9-66.1 ncurses-devel-debuginfo-32bit-5.9-66.1 References: https://www.suse.com/security/cve/CVE-2018-19211.html https://bugzilla.suse.com/1115929

1 0

openSUSE-RU-2018:4033-1: important: Recommended update for multipath-tools
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for multipath-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4033-1 Rating: important References: #1075539 #1093220 #1098177 #1098458 #1099007 #1099008 #1099026 #1099036 #1099484 #1108728 #1108875 #1110352 #1110354 #1110355 #1110418 #1110586 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: This update for multipath-tools provides the following fixes: - multipath-tools/tests: Add tests for get_unaligned_beXX. (bsc#1099036) - multipath: Print sysfs state in fast list mode. (bsc#1110354) - multipathd: Use nanosleep for strict timing. (bsc#1110418) - multipathd: Try SCSI persistent reservations for SCSI only. (bsc#1108875) - multipathd: Release uxsocket and resource when cancel thread. (bsc#1110355) - multipathd: Register threads that use rcu calls. (bsc#1110418) - multipath: Don't start multipathd unnecessarily. (bsc#1098177) - multipathd: Minor upstream bug fixes. (bsc#1110418) - multipathd: Function return value tweaks. (bsc#1110418) - multipathd: Fix reservation_key check. (bsc#1099008) - multipathd: Fix memory leak on error in configure. (bsc#1110418) - multipathd: Decrease the log level of uevent messages. (bsc#1110586) - libmultipath: Set dm_conf_verbosity. (bsc#1110418) - libmultipath: Print correct default for delay_*_checks. (bsc#1110418, bsc#1099026) - libmultipath/get_uid: Don't quit prematurely without udev. (bsc#1108728) - libmultipath: get_uid: Check VPD pages for SCSI only. (bsc#1108728) - libmultipath: Fix sgio_get_vpd(). (bsc#1099484) - libmultipath: Fix null dereference int alloc_path_group. (bsc#1110418) - libmultipath: Fix memory leak in process_config_dir(). (bsc#1110352) - libmultipath: Fix log_pthread processing. (bsc#1110418) - libmultipath: Fix length issues in get_vpd_sgio. (bsc#1110418) - libmultipath: Fix gcc 8.1 "truncated output" warnings. (bsc#1099007) - libmultipath: Fix basenamecpy. (bsc#1110418) - libmultipath: Don't use malformed uevents. (bsc#1110418) - libmultipath: Avoid error messages from RDAC check. (bsc#1075539) - libmultipath: Allow sysfs_pathinfo to return SKIPPED. (bsc#1098458) - libmultipath: Add (get|put)_unaligned_be64. (bsc#1099036) - libmultipath: pathinfo: Skip hidden devices. (bsc#1110586) - libmpathpersist: Use O_RDONLY file descriptors. (bsc#1093220) - libmpathpersist: Remove duplicate test in readfullstatus. (bsc#1099007) - libmpathpersist: Fix typo in mpath_format_readfullstatus. (bsc#1099007) - libmpathpersist: Fix stack overflow in mpath_format_readfullstatus(). (bsc#1099007) - libmpathpersist: Fix byte swapping for big endian systems. (bsc#1099036) - libmpathpersist: Decrease log level of various messages. (bsc#1099007) - libmpathpersist: Fix an off-by-one error in PRIN length check. (bsc#1099007) - Introduce the ibmultipath/unaligned.h header file. (bsc#1099036) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1498=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): kpartx-0.7.3+102+suse.be95116-lp150.2.3.1 kpartx-debuginfo-0.7.3+102+suse.be95116-lp150.2.3.1 libdmmp-devel-0.7.3+102+suse.be95116-lp150.2.3.1 libdmmp0_1_0-0.7.3+102+suse.be95116-lp150.2.3.1 libdmmp0_1_0-debuginfo-0.7.3+102+suse.be95116-lp150.2.3.1 multipath-tools-0.7.3+102+suse.be95116-lp150.2.3.1 multipath-tools-debuginfo-0.7.3+102+suse.be95116-lp150.2.3.1 multipath-tools-debugsource-0.7.3+102+suse.be95116-lp150.2.3.1 multipath-tools-devel-0.7.3+102+suse.be95116-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): multipath-tools-rbd-0.7.3+102+suse.be95116-lp150.2.3.1 multipath-tools-rbd-debuginfo-0.7.3+102+suse.be95116-lp150.2.3.1 References: https://bugzilla.suse.com/1075539 https://bugzilla.suse.com/1093220 https://bugzilla.suse.com/1098177 https://bugzilla.suse.com/1098458 https://bugzilla.suse.com/1099007 https://bugzilla.suse.com/1099008 https://bugzilla.suse.com/1099026 https://bugzilla.suse.com/1099036 https://bugzilla.suse.com/1099484 https://bugzilla.suse.com/1108728 https://bugzilla.suse.com/1108875 https://bugzilla.suse.com/1110352 https://bugzilla.suse.com/1110354 https://bugzilla.suse.com/1110355 https://bugzilla.suse.com/1110418 https://bugzilla.suse.com/1110586

1 0

openSUSE-SU-2018:4032-1: important: Security update for apache2-mod_jk
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for apache2-mod_jk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4032-1 Rating: important References: #1114612 Cross-References: CVE-2018-11759 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2-mod_jk fixes the following issue: Security issue fixed: - CVE-2018-11759: Fixed connector path traversal due to mishandled HTTP requests in httpd (bsc#1114612). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1510=1 Package List: - openSUSE Leap 15.0 (x86_64): apache2-mod_jk-1.2.43-lp150.2.3.1 apache2-mod_jk-debuginfo-1.2.43-lp150.2.3.1 apache2-mod_jk-debugsource-1.2.43-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11759.html https://bugzilla.suse.com/1114612

1 0

openSUSE-SU-2018:4031-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4031-1 Rating: moderate References: #1114837 Cross-References: CVE-2018-16850 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2018-16850: Fixed improper quoting of transition table names when pg_dump emits CREATE TRIGGER could have caused privilege escalation (bsc#1114837). Non-security issues fixed: - Update to release 10.6: * https://www.postgresql.org/docs/current/static/release-10-6.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1493=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.6-lp150.3.6.1 libecpg6-debuginfo-10.6-lp150.3.6.1 libpq5-10.6-lp150.3.6.1 libpq5-debuginfo-10.6-lp150.3.6.1 postgresql10-10.6-lp150.3.6.1 postgresql10-contrib-10.6-lp150.3.6.1 postgresql10-contrib-debuginfo-10.6-lp150.3.6.1 postgresql10-debuginfo-10.6-lp150.3.6.1 postgresql10-debugsource-10.6-lp150.3.6.1 postgresql10-devel-10.6-lp150.3.6.1 postgresql10-devel-debuginfo-10.6-lp150.3.6.1 postgresql10-plperl-10.6-lp150.3.6.1 postgresql10-plperl-debuginfo-10.6-lp150.3.6.1 postgresql10-plpython-10.6-lp150.3.6.1 postgresql10-plpython-debuginfo-10.6-lp150.3.6.1 postgresql10-pltcl-10.6-lp150.3.6.1 postgresql10-pltcl-debuginfo-10.6-lp150.3.6.1 postgresql10-server-10.6-lp150.3.6.1 postgresql10-server-debuginfo-10.6-lp150.3.6.1 postgresql10-test-10.6-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.6-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.6-lp150.3.6.1 libecpg6-32bit-debuginfo-10.6-lp150.3.6.1 libpq5-32bit-10.6-lp150.3.6.1 libpq5-32bit-debuginfo-10.6-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-16850.html https://bugzilla.suse.com/1114837

1 0

openSUSE-SU-2018:4030-1: moderate: Recommended update for php7
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Recommended update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4030-1 Rating: moderate References: #1117107 Cross-References: CVE-2018-19518 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1507=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-52.1 apache2-mod_php7-debuginfo-7.0.7-52.1 php7-7.0.7-52.1 php7-bcmath-7.0.7-52.1 php7-bcmath-debuginfo-7.0.7-52.1 php7-bz2-7.0.7-52.1 php7-bz2-debuginfo-7.0.7-52.1 php7-calendar-7.0.7-52.1 php7-calendar-debuginfo-7.0.7-52.1 php7-ctype-7.0.7-52.1 php7-ctype-debuginfo-7.0.7-52.1 php7-curl-7.0.7-52.1 php7-curl-debuginfo-7.0.7-52.1 php7-dba-7.0.7-52.1 php7-dba-debuginfo-7.0.7-52.1 php7-debuginfo-7.0.7-52.1 php7-debugsource-7.0.7-52.1 php7-devel-7.0.7-52.1 php7-dom-7.0.7-52.1 php7-dom-debuginfo-7.0.7-52.1 php7-enchant-7.0.7-52.1 php7-enchant-debuginfo-7.0.7-52.1 php7-exif-7.0.7-52.1 php7-exif-debuginfo-7.0.7-52.1 php7-fastcgi-7.0.7-52.1 php7-fastcgi-debuginfo-7.0.7-52.1 php7-fileinfo-7.0.7-52.1 php7-fileinfo-debuginfo-7.0.7-52.1 php7-firebird-7.0.7-52.1 php7-firebird-debuginfo-7.0.7-52.1 php7-fpm-7.0.7-52.1 php7-fpm-debuginfo-7.0.7-52.1 php7-ftp-7.0.7-52.1 php7-ftp-debuginfo-7.0.7-52.1 php7-gd-7.0.7-52.1 php7-gd-debuginfo-7.0.7-52.1 php7-gettext-7.0.7-52.1 php7-gettext-debuginfo-7.0.7-52.1 php7-gmp-7.0.7-52.1 php7-gmp-debuginfo-7.0.7-52.1 php7-iconv-7.0.7-52.1 php7-iconv-debuginfo-7.0.7-52.1 php7-imap-7.0.7-52.1 php7-imap-debuginfo-7.0.7-52.1 php7-intl-7.0.7-52.1 php7-intl-debuginfo-7.0.7-52.1 php7-json-7.0.7-52.1 php7-json-debuginfo-7.0.7-52.1 php7-ldap-7.0.7-52.1 php7-ldap-debuginfo-7.0.7-52.1 php7-mbstring-7.0.7-52.1 php7-mbstring-debuginfo-7.0.7-52.1 php7-mcrypt-7.0.7-52.1 php7-mcrypt-debuginfo-7.0.7-52.1 php7-mysql-7.0.7-52.1 php7-mysql-debuginfo-7.0.7-52.1 php7-odbc-7.0.7-52.1 php7-odbc-debuginfo-7.0.7-52.1 php7-opcache-7.0.7-52.1 php7-opcache-debuginfo-7.0.7-52.1 php7-openssl-7.0.7-52.1 php7-openssl-debuginfo-7.0.7-52.1 php7-pcntl-7.0.7-52.1 php7-pcntl-debuginfo-7.0.7-52.1 php7-pdo-7.0.7-52.1 php7-pdo-debuginfo-7.0.7-52.1 php7-pgsql-7.0.7-52.1 php7-pgsql-debuginfo-7.0.7-52.1 php7-phar-7.0.7-52.1 php7-phar-debuginfo-7.0.7-52.1 php7-posix-7.0.7-52.1 php7-posix-debuginfo-7.0.7-52.1 php7-pspell-7.0.7-52.1 php7-pspell-debuginfo-7.0.7-52.1 php7-readline-7.0.7-52.1 php7-readline-debuginfo-7.0.7-52.1 php7-shmop-7.0.7-52.1 php7-shmop-debuginfo-7.0.7-52.1 php7-snmp-7.0.7-52.1 php7-snmp-debuginfo-7.0.7-52.1 php7-soap-7.0.7-52.1 php7-soap-debuginfo-7.0.7-52.1 php7-sockets-7.0.7-52.1 php7-sockets-debuginfo-7.0.7-52.1 php7-sqlite-7.0.7-52.1 php7-sqlite-debuginfo-7.0.7-52.1 php7-sysvmsg-7.0.7-52.1 php7-sysvmsg-debuginfo-7.0.7-52.1 php7-sysvsem-7.0.7-52.1 php7-sysvsem-debuginfo-7.0.7-52.1 php7-sysvshm-7.0.7-52.1 php7-sysvshm-debuginfo-7.0.7-52.1 php7-tidy-7.0.7-52.1 php7-tidy-debuginfo-7.0.7-52.1 php7-tokenizer-7.0.7-52.1 php7-tokenizer-debuginfo-7.0.7-52.1 php7-wddx-7.0.7-52.1 php7-wddx-debuginfo-7.0.7-52.1 php7-xmlreader-7.0.7-52.1 php7-xmlreader-debuginfo-7.0.7-52.1 php7-xmlrpc-7.0.7-52.1 php7-xmlrpc-debuginfo-7.0.7-52.1 php7-xmlwriter-7.0.7-52.1 php7-xmlwriter-debuginfo-7.0.7-52.1 php7-xsl-7.0.7-52.1 php7-xsl-debuginfo-7.0.7-52.1 php7-zip-7.0.7-52.1 php7-zip-debuginfo-7.0.7-52.1 php7-zlib-7.0.7-52.1 php7-zlib-debuginfo-7.0.7-52.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-52.1 php7-pear-Archive_Tar-7.0.7-52.1 References: https://www.suse.com/security/cve/CVE-2018-19518.html https://bugzilla.suse.com/1117107

1 0

openSUSE-SU-2018:4029-1: Security update for messagelib
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4029-1 Rating: low References: #1117958 Cross-References: CVE-2018-19516 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for messagelib fixes the following issues: The following security vulnerability was addressed: - CVE-2018-19516: Fix a potential issue with opening messages in a new browser window when displaying mails as HTML (boo#1117958). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1508=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1508=1 Package List: - openSUSE Leap 15.0 (x86_64): messagelib-17.12.3-lp150.2.6.1 messagelib-debuginfo-17.12.3-lp150.2.6.1 messagelib-debugsource-17.12.3-lp150.2.6.1 messagelib-devel-17.12.3-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): messagelib-lang-17.12.3-lp150.2.6.1 - openSUSE Backports SLE-15 (x86_64): messagelib-17.12.3-bp150.3.6.1 messagelib-devel-17.12.3-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): messagelib-lang-17.12.3-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19516.html https://bugzilla.suse.com/1117958

1 0

openSUSE-OU-2018:4028-1: Optional update for python-mutt-ics
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Optional Update: Optional update for python-mutt-ics ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:4028-1 Rating: low References: #1117044 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for python-mutt-ics introduces pakage to distribution: - python-mutt-ics can be used to read ics invitations in mutt Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1512=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1512=1 Package List: - openSUSE Leap 15.0 (noarch): python2-mutt-ics-0.8-lp150.2.1 python3-mutt-ics-0.8-lp150.2.1 - openSUSE Backports SLE-15 (noarch): python2-mutt-ics-0.8-bp150.2.1 python3-mutt-ics-0.8-bp150.2.1 References: https://bugzilla.suse.com/1117044

1 0

openSUSE-RU-2018:4027-1: moderate: Recommended update for transactional-update
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for transactional-update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4027-1 Rating: moderate References: #1088676 #1097619 #1105992 #1111319 #1111321 #1111786 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for transactional-update fixes the following issues: - Update to version 2.11 - Update man page to explain new /etc overlay handling - Add special handling for migrating away from old overlay directory - Read default update method for systemd service from config file - Add package "transactional-update-zypp-config" to prevent accidental transactional-update uninstallation on transactional systems (boo#1111319) - Use "up" for systemd service on non-rolling release distributions (boo#1111321) - Introduce /etc overlays - Add compatibility with snapper >= 0.7.0 - Correctly detect BTRFS ID when using multiple snapper configurations - Fix disappearing prompt in "shell" command when application was updated - Prevent accidental rollback on fast reboots (boo#1111786) - Use zypper attribute packages-to-change if available (boo#1105992 and boo#1097619) - Add kexec as reboot alternative - Added explicit --with-doc / --without-doc build configure opttions for enforcing or excluding documentation build - Removed precompiled documentation (boo#1088676) - Added more dependency checks to configure script - Small improvements to documentation - Restored compatibility with older rsync versions not supporting the -x filter - Small bugfixes for cleanup in error situations - Fix possible incorrect detection of snapshots numbers during cleanup - Mention parent in snapshot description - Add dependencies for documentation build (boo#1088676) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1513=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1513=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): transactional-update-2.11-lp150.2.9.1 transactional-update-debuginfo-2.11-lp150.2.9.1 transactional-update-debugsource-2.11-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): transactional-update-zypp-config-2.11-lp150.2.9.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): transactional-update-2.11-bp150.2.6.1 transactional-update-debuginfo-2.11-bp150.2.6.1 transactional-update-debugsource-2.11-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): transactional-update-zypp-config-2.11-bp150.2.6.1 References: https://bugzilla.suse.com/1088676 https://bugzilla.suse.com/1097619 https://bugzilla.suse.com/1105992 https://bugzilla.suse.com/1111319 https://bugzilla.suse.com/1111321 https://bugzilla.suse.com/1111786

1 0

openSUSE-RU-2018:4025-1: Recommended update for prosody
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4025-1 Rating: low References: #1117774 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for prosody fixes the following issues: Security issue fixed: - Fixed information disclosure list of members of members-only and password-protected rooms (boo#1117774). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1491=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1491=1 Package List: - openSUSE Leap 15.0 (x86_64): prosody-0.10.3-lp150.3.9.1 prosody-debuginfo-0.10.3-lp150.3.9.1 prosody-debugsource-0.10.3-lp150.3.9.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): prosody-0.10.3-bp150.2.3.1 prosody-debuginfo-0.10.3-bp150.2.3.1 prosody-debugsource-0.10.3-bp150.2.3.1 References: https://bugzilla.suse.com/1117774

1 0

openSUSE-RU-2018:4015-1: moderate: Recommended update for festival
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for festival ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4015-1 Rating: moderate References: #1116010 #1116808 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for festival fixes the following issues: - festival triggered a segfault when synthesizing speec (boo#1116808) - the SysV init script was converted into a native systemd service (boo#1116010) This update also contains all upstream improvements and fixes in the 2.5.0 release. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1488=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1488=1 Package List: - openSUSE Leap 15.0 (x86_64): festival-2.5.0-lp150.3.3.1 festival-debuginfo-2.5.0-lp150.3.3.1 festival-debugsource-2.5.0-lp150.3.3.1 festival-devel-2.5.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): festival-2.5.0-bp150.3.3.1 festival-debuginfo-2.5.0-bp150.3.3.1 festival-debugsource-2.5.0-bp150.3.3.1 festival-devel-2.5.0-bp150.3.3.1 References: https://bugzilla.suse.com/1116010 https://bugzilla.suse.com/1116808

1 0

openSUSE-RU-2018:4014-1: moderate: Recommended update for claws-mail
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4014-1 Rating: moderate References: #1116917 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for claws-mail fixes the following issues: - When replying to an e-mail, the quoted message and the recipient addresses may unexpectedly mismatch (boo#1116917) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1489=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1489=1 Package List: - openSUSE Leap 15.0 (noarch): claws-mail-lang-3.16.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): claws-mail-3.16.0-lp150.2.3.1 claws-mail-debuginfo-3.16.0-lp150.2.3.1 claws-mail-debugsource-3.16.0-lp150.2.3.1 claws-mail-devel-3.16.0-lp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): claws-mail-3.16.0-bp150.2.3.1 claws-mail-debuginfo-3.16.0-bp150.2.3.1 claws-mail-debugsource-3.16.0-bp150.2.3.1 claws-mail-devel-3.16.0-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): claws-mail-lang-3.16.0-bp150.2.3.1 References: https://bugzilla.suse.com/1116917

1 0

openSUSE-RU-2018:4013-1: moderate: Recommended update for aaa_base
by maintenance＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Recommended Update: Recommended update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4013-1 Rating: moderate References: #1040613 #1095969 #1102310 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for aaa_base provides the following fixes: - Get mixed use case of service wrapper script straight. (bsc#1040613) - Fix an error at login if java system directory is empty. (bsc#1102310) - Add a test for xdgdir/applications before adding data directory (bsc#1095969) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1490=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aaa_base-13.2+git20140911.61c1681-28.9.1 aaa_base-debuginfo-13.2+git20140911.61c1681-28.9.1 aaa_base-debugsource-13.2+git20140911.61c1681-28.9.1 aaa_base-extras-13.2+git20140911.61c1681-28.9.1 aaa_base-malloccheck-13.2+git20140911.61c1681-28.9.1 References: https://bugzilla.suse.com/1040613 https://bugzilla.suse.com/1095969 https://bugzilla.suse.com/1102310

1 0

openSUSE-SU-2018:4007-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 07 Dec '18

07 Dec '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4007-1 Rating: important References: #1104199 Cross-References: CVE-2018-10915 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql94 to 9.4.19 fixes the following security issue: - CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could have bypassed client-side connection security features, obtain access to higher privileged connections or potentially cause other impact SQL injection, by causing the PQescape() functions to malfunction (bsc#1104199). A dump/restore is not required for this update unless you use the functions query_to_xml, cursor_to_xml, cursor_to_xmlschema, query_to_xmlschema, and query_to_xml_and_xmlschema. In this case please see the first entry of https://www.postgresql.org/docs/9.4/static/release-9-4-18.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1482=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.19-24.1 postgresql94-contrib-9.4.19-24.1 postgresql94-contrib-debuginfo-9.4.19-24.1 postgresql94-debuginfo-9.4.19-24.1 postgresql94-debugsource-9.4.19-24.1 postgresql94-devel-9.4.19-24.1 postgresql94-devel-debuginfo-9.4.19-24.1 postgresql94-libs-debugsource-9.4.19-24.1 postgresql94-plperl-9.4.19-24.1 postgresql94-plperl-debuginfo-9.4.19-24.1 postgresql94-plpython-9.4.19-24.1 postgresql94-plpython-debuginfo-9.4.19-24.1 postgresql94-pltcl-9.4.19-24.1 postgresql94-pltcl-debuginfo-9.4.19-24.1 postgresql94-server-9.4.19-24.1 postgresql94-server-debuginfo-9.4.19-24.1 postgresql94-test-9.4.19-24.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.19-24.1 References: https://www.suse.com/security/cve/CVE-2018-10915.html https://bugzilla.suse.com/1104199

1 0