February 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0536-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 24 Feb '18

24 Feb '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0536-1 Rating: moderate References: #1082188 Cross-References: CVE-2017-1000499 CVE-2018-7260 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin 4.7.8 fixes the following issues: - CVE-2018-7260: self-cross site scripting (XSS) vulnerability in the central columns feature (boo#1082188) This version also fixes some minor functionality bugs. The previous update already fixed CVE-2017-1000499. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-206=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.7.8-9.1 References: https://www.suse.com/security/cve/CVE-2017-1000499.html https://www.suse.com/security/cve/CVE-2018-7260.html https://bugzilla.suse.com/1082188

1 0

openSUSE-SU-2018:0535-1: moderate: Security update for timidity
by opensuse-security＠opensuse.org 24 Feb '18

24 Feb '18

openSUSE Security Update: Security update for timidity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0535-1 Rating: moderate References: #1081694 Cross-References: CVE-2017-11546 CVE-2017-11547 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for timidity fixes the following issues: Security issues fixed: - CVE-2017-11546: Fix division-by-zero with malformed MIDI file (boo#1081694) - CVE-2017-11547: Fix out-of-bound accesses in the resamplers (boo#1081694) Other issues fixed: - Drop tcl/tk dependency; it's already broken with Tcl/Tk 8.6 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-208=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): timidity-2.14.0-9.3.1 timidity-debuginfo-2.14.0-9.3.1 timidity-debugsource-2.14.0-9.3.1 References: https://www.suse.com/security/cve/CVE-2017-11546.html https://www.suse.com/security/cve/CVE-2017-11547.html https://bugzilla.suse.com/1081694

1 0

openSUSE-SU-2018:0534-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 24 Feb '18

24 Feb '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0534-1 Rating: moderate References: #1082188 Cross-References: CVE-2017-1000499 CVE-2018-7260 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin 4.7.8 fixes the following issues: - CVE-2018-7260: self-cross site scripting (XSS) vulnerability in the central columns feature (boo#1082188) This version also fixes some minor functionality bugs. The previous update already fixed CVE-2017-1000499. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-206=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.7.8-17.1 References: https://www.suse.com/security/cve/CVE-2017-1000499.html https://www.suse.com/security/cve/CVE-2018-7260.html https://bugzilla.suse.com/1082188

1 0

openSUSE-SU-2018:0529-1: important: Security update for postgresql95
by opensuse-security＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Security Update: Security update for postgresql95 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0529-1 Rating: important References: #1051684 #1051685 #1053259 #1067841 #1067844 #1077983 #1079757 Cross-References: CVE-2017-15098 CVE-2017-15099 CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 CVE-2018-1053 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for postgresql95 fixes the following issues: Upate to PostgreSQL 9.5.11: Security issues fixed: * https://www.postgresql.org/docs/9.5/static/release-9-5-11.html * CVE-2018-1053, boo#1077983: Ensure that all temporary files made by pg_upgrade are non-world-readable. * boo#1079757: Rename pg_rewind's copy_file_range function to avoid conflict with new Linux system call of that name. In version 9.5.10: * https://www.postgresql.org/docs/9.5/static/release-9-5-10.html * CVE-2017-15098, boo#1067844: Memory disclosure in JSON functions. * CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges. In version 9.5.9: * https://www.postgresql.org/docs/9.5/static/release-9-5-9.html * Show foreign tables in information_schema.table_privileges view. * Clean up handling of a fatal exit (e.g., due to receipt of SIGTERM) that occurs while trying to execute a ROLLBACK of a failed transaction. * Remove assertion that could trigger during a fatal exit. * Correctly identify columns that are of a range type or domain type over a composite type or domain type being searched for. * Fix crash in pg_restore when using parallel mode and using a list file to select a subset of items to restore. * Change ecpg's parser to allow RETURNING clauses without attached C variables. In version 9.5.8 * https://www.postgresql.org/docs/9.5/static/release-9-5-8.html * CVE-2017-7547, boo#1051685: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. * CVE-2017-7546, boo#1051684: Disallow empty passwords in all password-based authentication methods. * CVE-2017-7548, boo#1053259: lo_put() function ignores ACLs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-204=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql95-9.5.11-2.3.1 postgresql95-contrib-9.5.11-2.3.1 postgresql95-contrib-debuginfo-9.5.11-2.3.1 postgresql95-debuginfo-9.5.11-2.3.1 postgresql95-debugsource-9.5.11-2.3.1 postgresql95-devel-9.5.11-2.3.1 postgresql95-devel-debuginfo-9.5.11-2.3.1 postgresql95-libs-debugsource-9.5.11-2.3.1 postgresql95-plperl-9.5.11-2.3.1 postgresql95-plperl-debuginfo-9.5.11-2.3.1 postgresql95-plpython-9.5.11-2.3.1 postgresql95-plpython-debuginfo-9.5.11-2.3.1 postgresql95-pltcl-9.5.11-2.3.1 postgresql95-pltcl-debuginfo-9.5.11-2.3.1 postgresql95-server-9.5.11-2.3.1 postgresql95-server-debuginfo-9.5.11-2.3.1 postgresql95-test-9.5.11-2.3.1 - openSUSE Leap 42.3 (noarch): postgresql95-docs-9.5.11-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-15098.html https://www.suse.com/security/cve/CVE-2017-15099.html https://www.suse.com/security/cve/CVE-2017-7546.html https://www.suse.com/security/cve/CVE-2017-7547.html https://www.suse.com/security/cve/CVE-2017-7548.html https://www.suse.com/security/cve/CVE-2018-1053.html https://bugzilla.suse.com/1051684 https://bugzilla.suse.com/1051685 https://bugzilla.suse.com/1053259 https://bugzilla.suse.com/1067841 https://bugzilla.suse.com/1067844 https://bugzilla.suse.com/1077983 https://bugzilla.suse.com/1079757

1 0

openSUSE-SU-2018:0528-1: moderate: Security update for libmad
by opensuse-security＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Security Update: Security update for libmad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0528-1 Rating: moderate References: #1036967 Cross-References: CVE-2017-8374 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmad fixes the following issues: - CVE-2017-8374: Fixed a heap-based buffer overflow (read) in mad_bit_skip (boo#1036967) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-205=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmad-debugsource-0.15.1b-5.1 libmad-devel-0.15.1b-5.1 libmad0-0.15.1b-5.1 libmad0-debuginfo-0.15.1b-5.1 - openSUSE Leap 42.3 (x86_64): libmad0-32bit-0.15.1b-5.1 libmad0-debuginfo-32bit-0.15.1b-5.1 References: https://www.suse.com/security/cve/CVE-2017-8374.html https://bugzilla.suse.com/1036967

1 0

openSUSE-SU-2018:0527-1: moderate: Security update for libmad
by opensuse-security＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Security Update: Security update for libmad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0527-1 Rating: moderate References: #1036967 Cross-References: CVE-2017-8374 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmad fixes the following issues: - CVE-2017-8374: Fixed a heap-based buffer overflow (read) in mad_bit_skip (boo#1036967) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-205=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libmad-debugsource-0.15.1b-5.1 libmad-devel-0.15.1b-5.1 libmad0-0.15.1b-5.1 libmad0-debuginfo-0.15.1b-5.1 References: https://www.suse.com/security/cve/CVE-2017-8374.html https://bugzilla.suse.com/1036967

1 0

openSUSE-SU-2018:0523-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0523-1 Rating: moderate References: #1077983 Cross-References: CVE-2018-1053 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql96 to version 9.6.7 fixes the following issues: - CVE-2018-1053: Ensure that all temporary files made by pg_upgrade are non-world-readable. (bsc#1077983) A full changelog is available here: https://www.postgresql.org/docs/9.6/static/release-9-6-7.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-203=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libecpg6-9.6.7-12.1 libecpg6-debuginfo-9.6.7-12.1 libpq5-9.6.7-12.1 libpq5-debuginfo-9.6.7-12.1 postgresql96-9.6.7-12.1 postgresql96-contrib-9.6.7-12.1 postgresql96-contrib-debuginfo-9.6.7-12.1 postgresql96-debuginfo-9.6.7-12.1 postgresql96-debugsource-9.6.7-12.1 postgresql96-devel-9.6.7-12.1 postgresql96-devel-debuginfo-9.6.7-12.1 postgresql96-libs-debugsource-9.6.7-12.1 postgresql96-plperl-9.6.7-12.1 postgresql96-plperl-debuginfo-9.6.7-12.1 postgresql96-plpython-9.6.7-12.1 postgresql96-plpython-debuginfo-9.6.7-12.1 postgresql96-pltcl-9.6.7-12.1 postgresql96-pltcl-debuginfo-9.6.7-12.1 postgresql96-server-9.6.7-12.1 postgresql96-server-debuginfo-9.6.7-12.1 postgresql96-test-9.6.7-12.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.7-12.1 - openSUSE Leap 42.3 (x86_64): libecpg6-32bit-9.6.7-12.1 libecpg6-debuginfo-32bit-9.6.7-12.1 libpq5-32bit-9.6.7-12.1 libpq5-debuginfo-32bit-9.6.7-12.1 References: https://www.suse.com/security/cve/CVE-2018-1053.html https://bugzilla.suse.com/1077983

1 0

openSUSE-SU-2018:0522-1: moderate: Security update for python3-openpyxl
by opensuse-security＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Security Update: Security update for python3-openpyxl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0522-1 Rating: moderate References: #1025592 Cross-References: CVE-2017-5992 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3-openpyxl fixes one security issue: - CVE-2017-5992: Prevent resolving external entities by default, which allowed remote attackers to conduct XXE attacks via a crafted .xlsx document (bsc#1025592). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-202=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-openpyxl-2.2.4-7.3.1 References: https://www.suse.com/security/cve/CVE-2017-5992.html https://bugzilla.suse.com/1025592

1 0

openSUSE-RU-2018:0521-1: Recommended update for cloud-init
by maintenance＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0521-1 Rating: low References: #1035106 #1042913 #1047363 #1055649 #1063716 #1064594 #1064854 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update provides cloud-init 17.1, which brings fixes and enhancements: - Fix sed expression to set the distribution name in spec file. (bsc#1063716) - Support user processes running in cloud-init-final to consume a large number of threads. (bsc#1047363) - Start after dbus.service, needed by hostnamectl. (bsc#1055649) - Adjust SUSE template. (bsc#1064594) - Don't ignore network settings from config-drive in external network. (bsc#1064854) - Fix cc_resizefs to not fail if the current root is a read-only btrfs subvolume. (bsc#1042913) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-201=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): cloud-init-17.1-34.2 cloud-init-config-suse-17.1-34.2 cloud-init-doc-17.1-34.2 References: https://bugzilla.suse.com/1035106 https://bugzilla.suse.com/1042913 https://bugzilla.suse.com/1047363 https://bugzilla.suse.com/1055649 https://bugzilla.suse.com/1063716 https://bugzilla.suse.com/1064594 https://bugzilla.suse.com/1064854

1 0

openSUSE-SU-2018:0520-1: moderate: Security update for libdb-4_8
by opensuse-security＠opensuse.org 22 Feb '18

22 Feb '18

openSUSE Security Update: Security update for libdb-4_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0520-1 Rating: moderate References: #1043886 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libdb-4_8 fixes the following issues: - A DB_CONFIG file in the current working directory allowed local users to obtain sensitive information via a symlink attack involving a setgid or setuid application using libdb-4_8. (bsc#1043886) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-199=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): db48-utils-4.8.30-34.3.1 libdb-4_8-4.8.30-34.3.1 libdb-4_8-debuginfo-4.8.30-34.3.1 libdb-4_8-debugsource-4.8.30-34.3.1 libdb-4_8-devel-4.8.30-34.3.1 libdb_java-4_8-4.8.30-34.3.1 libdb_java-4_8-debuginfo-4.8.30-34.3.1 libdb_java-4_8-debugsource-4.8.30-34.3.1 libdb_java-4_8-devel-4.8.30-34.3.1 - openSUSE Leap 42.3 (noarch): db48-doc-4.8.30-34.3.1 - openSUSE Leap 42.3 (x86_64): libdb-4_8-32bit-4.8.30-34.3.1 libdb-4_8-debuginfo-32bit-4.8.30-34.3.1 libdb-4_8-devel-32bit-4.8.30-34.3.1 References: https://bugzilla.suse.com/1043886

1 0