December 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:4122-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 14 Dec '18

14 Dec '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4122-1 Rating: important References: #1119364 Cross-References: CVE-2018-17481 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to Chromium 71.0.3578.98 fixes on security issue. - CVE-2018-17481: Use after free in PDFium - a follow-up fix to Chromiun 70 (boo#1119364) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1546=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1546=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-71.0.3578.98-lp150.2.33.1 chromedriver-debuginfo-71.0.3578.98-lp150.2.33.1 chromium-71.0.3578.98-lp150.2.33.1 chromium-debuginfo-71.0.3578.98-lp150.2.33.1 chromium-debugsource-71.0.3578.98-lp150.2.33.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-71.0.3578.98-bp150.2.26.1 chromedriver-debuginfo-71.0.3578.98-bp150.2.26.1 chromium-71.0.3578.98-bp150.2.26.1 chromium-debuginfo-71.0.3578.98-bp150.2.26.1 chromium-debugsource-71.0.3578.98-bp150.2.26.1 References: https://www.suse.com/security/cve/CVE-2018-17481.html https://bugzilla.suse.com/1119364

1 0

openSUSE-SU-2018:4117-1: moderate: Security update for mozilla-nss
by opensuse-security＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4117-1 Rating: moderate References: #1106873 #1119069 Cross-References: CVE-2018-12384 CVE-2018-12404 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mozilla-nss to version 3.36.6 fixes the following issues: Security issues fixed: - CVE-2018-12384: NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random (bmo#1483128, boo#1106873) - CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bmo#1485864, boo#1119069) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1540=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1540=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libfreebl3-3.36.6-54.1 libfreebl3-debuginfo-3.36.6-54.1 libsoftokn3-3.36.6-54.1 libsoftokn3-debuginfo-3.36.6-54.1 mozilla-nss-3.36.6-54.1 mozilla-nss-certs-3.36.6-54.1 mozilla-nss-certs-debuginfo-3.36.6-54.1 mozilla-nss-debuginfo-3.36.6-54.1 mozilla-nss-debugsource-3.36.6-54.1 mozilla-nss-devel-3.36.6-54.1 mozilla-nss-sysinit-3.36.6-54.1 mozilla-nss-sysinit-debuginfo-3.36.6-54.1 mozilla-nss-tools-3.36.6-54.1 mozilla-nss-tools-debuginfo-3.36.6-54.1 - openSUSE Leap 42.3 (x86_64): libfreebl3-32bit-3.36.6-54.1 libfreebl3-debuginfo-32bit-3.36.6-54.1 libsoftokn3-32bit-3.36.6-54.1 libsoftokn3-debuginfo-32bit-3.36.6-54.1 mozilla-nss-32bit-3.36.6-54.1 mozilla-nss-certs-32bit-3.36.6-54.1 mozilla-nss-certs-debuginfo-32bit-3.36.6-54.1 mozilla-nss-debuginfo-32bit-3.36.6-54.1 mozilla-nss-sysinit-32bit-3.36.6-54.1 mozilla-nss-sysinit-debuginfo-32bit-3.36.6-54.1 - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.36.6-lp150.2.6.1 libfreebl3-debuginfo-3.36.6-lp150.2.6.1 libsoftokn3-3.36.6-lp150.2.6.1 libsoftokn3-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-3.36.6-lp150.2.6.1 mozilla-nss-certs-3.36.6-lp150.2.6.1 mozilla-nss-certs-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-debugsource-3.36.6-lp150.2.6.1 mozilla-nss-devel-3.36.6-lp150.2.6.1 mozilla-nss-sysinit-3.36.6-lp150.2.6.1 mozilla-nss-sysinit-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-tools-3.36.6-lp150.2.6.1 mozilla-nss-tools-debuginfo-3.36.6-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.36.6-lp150.2.6.1 libfreebl3-32bit-debuginfo-3.36.6-lp150.2.6.1 libsoftokn3-32bit-3.36.6-lp150.2.6.1 libsoftokn3-32bit-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-32bit-3.36.6-lp150.2.6.1 mozilla-nss-32bit-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-certs-32bit-3.36.6-lp150.2.6.1 mozilla-nss-certs-32bit-debuginfo-3.36.6-lp150.2.6.1 mozilla-nss-sysinit-32bit-3.36.6-lp150.2.6.1 mozilla-nss-sysinit-32bit-debuginfo-3.36.6-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-12384.html https://www.suse.com/security/cve/CVE-2018-12404.html https://bugzilla.suse.com/1106873 https://bugzilla.suse.com/1119069

1 0

openSUSE-RU-2018:4116-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4116-1 Rating: moderate References: #1026807 #1084527 #1085786 #1095818 #1102871 #1107579 #1109147 #972463 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for wicked fixes the following issues: - wickedd: fix netdev detection bootstrap race (bsc#1107579) - wireless: fix eap peap auth mapping for wpa-supplicant (bsc#1026807) - firewall: do not assign default zone, but pass as is (bsc#1109147) - nanny: fix memory leaks on fast create-delete calls (bsc#1095818) - extensions: do not use /etc/HOSTNAME artifact (bsc#972463) - ethtool: add missing pause support (bsc#1102871) - man: improved create-cid docs in wicked-config(5) (bsc#1084527) - ethtool: streamline options available on all devices (bsc#1085786) - and several other minor bug fixes - wickedd: fix netdev detection bootstrap race (bsc#1107579) - compat: fix ifcfg parsing crash if network/config is missed This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1541=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwicked-0-6-0.6.52-lp150.2.3.1 libwicked-0-6-debuginfo-0.6.52-lp150.2.3.1 wicked-0.6.52-lp150.2.3.1 wicked-debuginfo-0.6.52-lp150.2.3.1 wicked-debugsource-0.6.52-lp150.2.3.1 wicked-service-0.6.52-lp150.2.3.1 References: https://bugzilla.suse.com/1026807 https://bugzilla.suse.com/1084527 https://bugzilla.suse.com/1085786 https://bugzilla.suse.com/1095818 https://bugzilla.suse.com/1102871 https://bugzilla.suse.com/1107579 https://bugzilla.suse.com/1109147 https://bugzilla.suse.com/972463

1 0

openSUSE-RU-2018:4115-1: moderate: Recommended update for plymouth
by maintenance＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Recommended Update: Recommended update for plymouth ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4115-1 Rating: moderate References: #1110199 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plymouth provides the following fixes: - Make sure plymouthd stops throbber animation at the first opportunity after receiving quit command, instead of looping multiple times. (bsc#1110199) - drm: Use preferred mode for outputs. - drm: Refactor ply_renderer_connector_get_rotation. - drm: Reset LUT/gamma table before the first drmModeSetCrtc call. - libply: Move kernel command line parsing functions to libply/ply-utils. - throbber: Don't skip last frame when waiting for end. - systemd-units: Add "ConditionVirtualization=!container" in systemd-ask-password-plymouth.path. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1543=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libply-boot-client4-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply-boot-client4-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply-splash-core4-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply-splash-core4-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply-splash-graphics4-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply-splash-graphics4-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply4-0.9.4+git20181111.118c5ca-lp150.3.6.1 libply4-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-debugsource-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-devel-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-dracut-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-fade-throbber-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-fade-throbber-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-label-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-label-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-label-ft-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-label-ft-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-script-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-script-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-space-flares-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-space-flares-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-throbgress-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-throbgress-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-tribar-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-tribar-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-two-step-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-plugin-two-step-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-scripts-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-x11-renderer-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-x11-renderer-debuginfo-0.9.4+git20181111.118c5ca-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): plymouth-theme-fade-in-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-theme-script-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-theme-solar-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-theme-spinfinity-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-theme-spinner-0.9.4+git20181111.118c5ca-lp150.3.6.1 plymouth-theme-tribar-0.9.4+git20181111.118c5ca-lp150.3.6.1 References: https://bugzilla.suse.com/1110199

1 0

openSUSE-RU-2018:4114-1: moderate: Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer
by maintenance＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Recommended Update: Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4114-1 Rating: moderate References: #1088310 #1092493 #1098125 #1105988 #1118021 #1118027 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for aws-cli, python-boto3, python-botocore, python-s3transfer fixes the following issues: aws-cli: - Update to version 1.16.61. (bsc#1088310) + For detailed changes see https://github.com/aws/aws-cli/blob/1.16.1/CHANGELOG.rst - Update to version 1.16.1 (bsc#1105988, bsc#1092493) + CVE-2018-15869: An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, might have unintentionally loaded an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog. - Disable vendored versions of requests and six from botocore and use requests and six from the RPM packages. python-botocore: - Update to version 1.10.40 + For detailed changes, please refer to the changelog. + Remove the broken attempt to avoid using the bundeled requests module provided by the source (bsc#1088310) python-boto3: - Version update to 1.9.57 (bsc#1118021, bsc#1118027) + For detailed changes, please refer to the changelog. python-s3transfer: - Update to version 0.1.13 - Make sure to really not use any bundles. - enhancement:max_bandwidth: Add ability to set maximum bandwidth consumption for streaming of S3 uploads and downloads. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1545=1 Package List: - openSUSE Leap 15.0 (noarch): aws-cli-1.16.61-lp150.3.3.1 python2-boto3-1.9.57-lp150.2.3.1 python2-botocore-1.12.57-lp150.2.3.1 python2-s3transfer-0.1.13-lp150.2.3.1 python3-boto3-1.9.57-lp150.2.3.1 python3-botocore-1.12.57-lp150.2.3.1 python3-s3transfer-0.1.13-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-15869.html https://bugzilla.suse.com/1088310 https://bugzilla.suse.com/1092493 https://bugzilla.suse.com/1098125 https://bugzilla.suse.com/1105988 https://bugzilla.suse.com/1118021 https://bugzilla.suse.com/1118027

1 0

openSUSE-RU-2018:4113-1: moderate: Recommended update for suse-module-tools
by maintenance＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Recommended Update: Recommended update for suse-module-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4113-1 Rating: moderate References: #1036463 #1105495 #1111183 #1111300 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for suse-module-tools fixes the following issues: - Use /etc/modules-load.d/sg.conf for sg driver autoloading (bsc#1036463) - modsign-verify: support for parsing PKCS#7 signatures (bsc#1111300, bsc#1105495) - Fix logic for unsupported modules (bsc#1111183) - Add udev rule 81-sg.rules to make sure the sg module is always loaded (bsc#1036463) - Use path dependency that is not parsed by obs to ensure we are not pulling systemd everywhere - Grep os-release and not deprecated SuSE-release This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1542=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): suse-module-tools-15.0.1-lp150.2.3.1 References: https://bugzilla.suse.com/1036463 https://bugzilla.suse.com/1105495 https://bugzilla.suse.com/1111183 https://bugzilla.suse.com/1111300

1 0

openSUSE-SU-2018:4112-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4112-1 Rating: important References: #1119105 Cross-References: CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update to Mozilla Firefox 60.4.0 ESR fixes security issues and bugs. Security issues fixed as part of the MFSA 2018-30 advisory (boo#1119105): - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 The following changes are included: - now requires NSS >= 3.36.6 - Updated list of currency codes to include Unidad Previsional (UYW) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1544=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1544=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.4.0-125.1 MozillaFirefox-branding-upstream-60.4.0-125.1 MozillaFirefox-buildsymbols-60.4.0-125.1 MozillaFirefox-debuginfo-60.4.0-125.1 MozillaFirefox-debugsource-60.4.0-125.1 MozillaFirefox-devel-60.4.0-125.1 MozillaFirefox-translations-common-60.4.0-125.1 MozillaFirefox-translations-other-60.4.0-125.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.4.0-lp150.3.30.1 MozillaFirefox-branding-upstream-60.4.0-lp150.3.30.1 MozillaFirefox-buildsymbols-60.4.0-lp150.3.30.1 MozillaFirefox-debuginfo-60.4.0-lp150.3.30.1 MozillaFirefox-debugsource-60.4.0-lp150.3.30.1 MozillaFirefox-devel-60.4.0-lp150.3.30.1 MozillaFirefox-translations-common-60.4.0-lp150.3.30.1 MozillaFirefox-translations-other-60.4.0-lp150.3.30.1 References: https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://bugzilla.suse.com/1119105

1 0

openSUSE-SU-2018:4111-1: important: Security update for xen
by opensuse-security＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4111-1 Rating: important References: #1027519 #1108940 #1114405 #1114423 #1115040 #1115045 #1115047 Cross-References: CVE-2018-18849 CVE-2018-18883 CVE-2018-19961 CVE-2018-19962 CVE-2018-19965 CVE-2018-19966 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: Security issues fixed: - CVE-2018-18849: Fixed an out of bounds memory access issue was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin (bsc#1114423). - CVE-2018-18883: Fixed a NULL pointer dereference that could have been triggered by nested VT-x that where not properly restricted (XSA-278)(bsc#1114405). - CVE-2018-19965: Fixed denial of service issue from attempting to use INVPCID with a non-canonical addresses (XSA-279)(bsc#1115045). - CVE-2018-19966: Fixed issue introduced by XSA-240 that could have caused conflicts with shadow paging (XSA-280)(bsc#1115047). - CVE-2018-19961 CVE-2018-19962: Fixed insufficient TLB flushing / improper large page mappings with AMD IOMMUs (XSA-275)(bsc#1115040). Non-security issues fixed: - Added upstream bug fixes (bsc#1027519). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1530=1 Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.3_03-34.1 xen-debugsource-4.9.3_03-34.1 xen-devel-4.9.3_03-34.1 xen-doc-html-4.9.3_03-34.1 xen-libs-4.9.3_03-34.1 xen-libs-debuginfo-4.9.3_03-34.1 xen-tools-4.9.3_03-34.1 xen-tools-debuginfo-4.9.3_03-34.1 xen-tools-domU-4.9.3_03-34.1 xen-tools-domU-debuginfo-4.9.3_03-34.1 References: https://www.suse.com/security/cve/CVE-2018-18849.html https://www.suse.com/security/cve/CVE-2018-18883.html https://www.suse.com/security/cve/CVE-2018-19961.html https://www.suse.com/security/cve/CVE-2018-19962.html https://www.suse.com/security/cve/CVE-2018-19965.html https://www.suse.com/security/cve/CVE-2018-19966.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1108940 https://bugzilla.suse.com/1114405 https://bugzilla.suse.com/1114423 https://bugzilla.suse.com/1115040 https://bugzilla.suse.com/1115045 https://bugzilla.suse.com/1115047

1 0

openSUSE-RU-2018:4110-1: moderate: Recommended update for flatpak
by maintenance＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Recommended Update: Recommended update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4110-1 Rating: moderate References: #984817 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for flatpak fixes the following issues: Improve usability by allowing members of the group 'wheel' to bypass polkit authentication checks when locally logged in (bsc#984817). This adds a few polkit actions to the rules that are not covered by upstream, because they are set to 'yes' for active users by default. On SUSE we require 'auth_admin' for regular users, however. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1528=1 Package List: - openSUSE Leap 15.0 (x86_64): flatpak-0.10.4-lp150.3.3.1 flatpak-debuginfo-0.10.4-lp150.3.3.1 flatpak-debugsource-0.10.4-lp150.3.3.1 flatpak-devel-0.10.4-lp150.3.3.1 libflatpak0-0.10.4-lp150.3.3.1 libflatpak0-debuginfo-0.10.4-lp150.3.3.1 typelib-1_0-Flatpak-1_0-0.10.4-lp150.3.3.1 References: https://bugzilla.suse.com/984817

1 0

openSUSE-RU-2018:4109-1: moderate: Recommended update for yast2-packager
by maintenance＠opensuse.org 13 Dec '18

13 Dec '18

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4109-1 Rating: moderate References: #1116226 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-packager fixes the following issues: - sw_single_wrapper: fixed invalid variable reset causing a possible command injection vulnerability via environment variable (bsc#1116226) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1534=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-packager-4.0.71-lp150.2.12.1 References: https://bugzilla.suse.com/1116226

1 0