December 2018

openSUSE-SU-2018:4256-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4256-1 Rating: moderate References: #1017693 #1054594 #1115717 #990460 Cross-References: CVE-2016-10092 CVE-2016-10093 CVE-2016-10094 CVE-2016-6223 CVE-2017-12944 CVE-2018-19210 Affected Products: openSUSE Leap 42.3 … [View More]______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-19210: Fixed NULL pointer dereference in the TIFFWriteDirectorySec function (bsc#1115717). - CVE-2017-12944: Fixed denial of service issue in the TIFFReadDirEntryArray function (bsc#1054594). - CVE-2016-10094: Fixed heap-based buffer overflow in the _tiffWriteProc function (bsc#1017693). - CVE-2016-10093: Fixed heap-based buffer overflow in the _TIFFmemcpy function (bsc#1017693). - CVE-2016-10092: Fixed heap-based buffer overflow in the TIFFReverseBits function (bsc#1017693). - CVE-2016-6223: Fixed out-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1() (bsc#990460). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1598=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-43.1 libtiff5-4.0.9-43.1 libtiff5-debuginfo-4.0.9-43.1 tiff-4.0.9-43.1 tiff-debuginfo-4.0.9-43.1 tiff-debugsource-4.0.9-43.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-43.1 libtiff5-32bit-4.0.9-43.1 libtiff5-debuginfo-32bit-4.0.9-43.1 References: https://www.suse.com/security/cve/CVE-2016-10092.html https://www.suse.com/security/cve/CVE-2016-10093.html https://www.suse.com/security/cve/CVE-2016-10094.html https://www.suse.com/security/cve/CVE-2016-6223.html https://www.suse.com/security/cve/CVE-2017-12944.html https://www.suse.com/security/cve/CVE-2018-19210.html https://bugzilla.suse.com/1017693 https://bugzilla.suse.com/1054594 https://bugzilla.suse.com/1115717 https://bugzilla.suse.com/990460 [View Less]

1 0

openSUSE-SU-2018:4255-1: important: Security update for go1.10
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for go1.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4255-1 Rating: important References: #1082409 #1098017 #1113978 #1118897 #1118898 #1118899 #1119634 #1119706 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 42.3 … [View More]______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: This update for go1.10 fixes the following issues: Security vulnerabilities fixed: - CVE-2018-16873 (bsc#1118897): cmd/go: remote command execution during "go get -u". - CVE-2018-16874 (bsc#1118898): cmd/go: directory traversal in "go get" via curly braces in import paths - CVE-2018-16875 (bsc#1118899): crypto/x509: CPU denial of service Other issues fixed: - Fix build error with PIE linker flags on ppc64le. (bsc#1113978, bsc#1098017) - Review dependencies (requires, recommends and supports) (bsc#1082409) - Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634) - Fix a regression that broke go get for import path patterns containing "..." (bsc#1119706) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1593=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): go1.10-1.10.7-5.1 go1.10-doc-1.10.7-5.1 - openSUSE Leap 42.3 (x86_64): go1.10-race-1.10.7-5.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1082409 https://bugzilla.suse.com/1098017 https://bugzilla.suse.com/1113978 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1119706 [View Less]

1 0

openSUSE-SU-2018:4254-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4254-1 Rating: moderate References: #1115916 #1115917 Cross-References: CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 Affected Products: openSUSE Leap 42.3 … [View More]______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916). - CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917). - CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917). - CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917). - CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1591=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-13.1 ovmf-tools-2017+git1492060560.b6d11d7c46-13.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-13.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-13.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-13.1 References: https://www.suse.com/security/cve/CVE-2017-5731.html https://www.suse.com/security/cve/CVE-2017-5732.html https://www.suse.com/security/cve/CVE-2017-5733.html https://www.suse.com/security/cve/CVE-2017-5734.html https://www.suse.com/security/cve/CVE-2017-5735.html https://www.suse.com/security/cve/CVE-2018-3613.html https://bugzilla.suse.com/1115916 https://bugzilla.suse.com/1115917 [View Less]

1 0

openSUSE-RU-2018:4253-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4253-1 Rating: moderate References: #1105314 #1111384 #1113400 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This … [View More]

1 0

openSUSE-SU-2018:4252-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4252-1 Rating: moderate References: #1117267 Cross-References: CVE-2018-19519 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-RU-2018:4251-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4251-1 Rating: moderate References: #1053248 #937555 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut … [View More]

1 0

openSUSE-RU-2018:4250-1: moderate: Recommended update for pesign-obs-integration
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for pesign-obs-integration ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4250-1 Rating: moderate References: #1114605 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for … [View More]

1 0

openSUSE-RU-2018:4249-1: moderate: Recommended update for libmtp
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for libmtp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4249-1 Rating: moderate References: #1110868 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libmtp fixes the … [View More]

1 0

openSUSE-SU-2018:4248-1: moderate: Security update for tryton
by opensuse-security＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Security Update: Security update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:4248-1 Rating: moderate References: #1107771 #1117105 Cross-References: CVE-2018-19443 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available.… [View More]

1 0

openSUSE-RU-2018:4247-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 22 Dec '18

22 Dec '18

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:4247-1 Rating: moderate References: #1110073 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for grub2 fixes the … [View More]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Updates