March 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0842-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 29 Mar '18

29 Mar '18

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0842-1 Rating: moderate References: #1086792 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for cacti, cacti-spine fixes the following issues Security issues fixed: - bsc#1086792: Path-Based Cross-Site Scripting (XSS) issues This update also contains a number of upstream bug fixes and improvements in the 1.1.37 version. The minimum required php version is 5.4, in openSUSE Leap 42.3 this is provided by php7. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-321=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cacti-spine-1.1.37-23.1 cacti-spine-debuginfo-1.1.37-23.1 cacti-spine-debugsource-1.1.37-23.1 - openSUSE Leap 42.3 (noarch): cacti-1.1.37-32.1 cacti-doc-1.1.37-32.1 References: https://bugzilla.suse.com/1086792

1 0

openSUSE-SU-2018:0829-1: important: Security update for librelp
by opensuse-security＠opensuse.org 27 Mar '18

27 Mar '18

openSUSE Security Update: Security update for librelp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0829-1 Rating: important References: #1086730 Cross-References: CVE-2018-1000140 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librelp fixes the following issues: - CVE-2018-1000140: A stack-based buffer overflow in the code for checking of x509 certificates allowed a remote attacker with an access to the rsyslog logging facility to potentially execute arbitrary code by sending a specially crafted x509 certificate. (bsc#1086730) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-319=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): librelp-debugsource-1.2.12-2.3.1 librelp-devel-1.2.12-2.3.1 librelp0-1.2.12-2.3.1 librelp0-debuginfo-1.2.12-2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000140.html https://bugzilla.suse.com/1086730

1 0

openSUSE-SU-2018:0827-1: moderate: Security update for dhcp
by opensuse-security＠opensuse.org 27 Mar '18

27 Mar '18

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0827-1 Rating: moderate References: #1083302 #1083303 Cross-References: CVE-2018-5732 CVE-2018-5733 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dhcp fixes the following issues: Security issues fixed: - CVE-2018-5733: reference count overflow in dhcpd (bsc#1083303). - CVE-2018-5732: buffer overflow in dhclient (bsc#1083302). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-315=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dhcp-4.3.3-11.6.1 dhcp-client-4.3.3-11.6.1 dhcp-client-debuginfo-4.3.3-11.6.1 dhcp-debuginfo-4.3.3-11.6.1 dhcp-debugsource-4.3.3-11.6.1 dhcp-devel-4.3.3-11.6.1 dhcp-doc-4.3.3-11.6.1 dhcp-relay-4.3.3-11.6.1 dhcp-relay-debuginfo-4.3.3-11.6.1 dhcp-server-4.3.3-11.6.1 dhcp-server-debuginfo-4.3.3-11.6.1 References: https://www.suse.com/security/cve/CVE-2018-5732.html https://www.suse.com/security/cve/CVE-2018-5733.html https://bugzilla.suse.com/1083302 https://bugzilla.suse.com/1083303

1 0

openSUSE-SU-2018:0826-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 27 Mar '18

27 Mar '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0826-1 Rating: moderate References: #1001374 #1008047 #1008050 #1031450 #1031451 #1056284 #1083304 #1083305 #967999 #968000 Cross-References: CVE-2016-2048 CVE-2016-2512 CVE-2016-2513 CVE-2016-6186 CVE-2016-7401 CVE-2016-9013 CVE-2016-9014 CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-7536 CVE-2018-7537 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for python-Django to version 1.18.18 fixes multiple issues. Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters (bsc#1083304). - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374). - CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade (bsc#968000). - CVE-2016-2512: Fixed malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth (bsc#967999). - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050). - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047). - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451). - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450). - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-317=1 Package List: - openSUSE Leap 42.3 (noarch): python-Django-1.8.19-6.4.1 References: https://www.suse.com/security/cve/CVE-2016-2048.html https://www.suse.com/security/cve/CVE-2016-2512.html https://www.suse.com/security/cve/CVE-2016-2513.html https://www.suse.com/security/cve/CVE-2016-6186.html https://www.suse.com/security/cve/CVE-2016-7401.html https://www.suse.com/security/cve/CVE-2016-9013.html https://www.suse.com/security/cve/CVE-2016-9014.html https://www.suse.com/security/cve/CVE-2017-12794.html https://www.suse.com/security/cve/CVE-2017-7233.html https://www.suse.com/security/cve/CVE-2017-7234.html https://www.suse.com/security/cve/CVE-2018-7536.html https://www.suse.com/security/cve/CVE-2018-7537.html https://bugzilla.suse.com/1001374 https://bugzilla.suse.com/1008047 https://bugzilla.suse.com/1008050 https://bugzilla.suse.com/1031450 https://bugzilla.suse.com/1031451 https://bugzilla.suse.com/1056284 https://bugzilla.suse.com/1083304 https://bugzilla.suse.com/1083305 https://bugzilla.suse.com/967999 https://bugzilla.suse.com/968000

1 0

openSUSE-SU-2018:0825-1: important: Security update for clamav
by opensuse-security＠opensuse.org 27 Mar '18

27 Mar '18

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0825-1 Rating: important References: #1045315 #1049423 #1052449 #1082858 #1083915 Cross-References: CVE-2012-6706 CVE-2017-11423 CVE-2017-6419 CVE-2018-0202 CVE-2018-1000085 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for clamav fixes the following issues: Security issues fixed: - CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315). - CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449). - CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423). - CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858). - CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-314=1 Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.99.4-23.1 clamav-debuginfo-0.99.4-23.1 clamav-debugsource-0.99.4-23.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://www.suse.com/security/cve/CVE-2017-11423.html https://www.suse.com/security/cve/CVE-2017-6419.html https://www.suse.com/security/cve/CVE-2018-0202.html https://www.suse.com/security/cve/CVE-2018-1000085.html https://bugzilla.suse.com/1045315 https://bugzilla.suse.com/1049423 https://bugzilla.suse.com/1052449 https://bugzilla.suse.com/1082858 https://bugzilla.suse.com/1083915

1 0

openSUSE-SU-2018:0824-1: moderate: Security update for python3-Django
by opensuse-security＠opensuse.org 27 Mar '18

27 Mar '18

openSUSE Security Update: Security update for python3-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0824-1 Rating: moderate References: #1001374 #1008047 #1008050 #1031450 #1031451 #1056284 #1083304 #1083305 #967999 #968000 Cross-References: CVE-2016-2048 CVE-2016-2512 CVE-2016-2513 CVE-2016-6186 CVE-2016-7401 CVE-2016-9013 CVE-2016-9014 CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-7536 CVE-2018-7537 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for python3-Django to version 1.18.18 fixes multiple issues. Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters (bsc#1083304). - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374). - CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade (bsc#968000). - CVE-2016-2512: Fixed malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth (bsc#967999). - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050). - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047). - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451). - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450). - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-318=1 Package List: - openSUSE Leap 42.3 (noarch): python3-Django-1.8.19-5.3.1 References: https://www.suse.com/security/cve/CVE-2016-2048.html https://www.suse.com/security/cve/CVE-2016-2512.html https://www.suse.com/security/cve/CVE-2016-2513.html https://www.suse.com/security/cve/CVE-2016-6186.html https://www.suse.com/security/cve/CVE-2016-7401.html https://www.suse.com/security/cve/CVE-2016-9013.html https://www.suse.com/security/cve/CVE-2016-9014.html https://www.suse.com/security/cve/CVE-2017-12794.html https://www.suse.com/security/cve/CVE-2017-7233.html https://www.suse.com/security/cve/CVE-2017-7234.html https://www.suse.com/security/cve/CVE-2018-7536.html https://www.suse.com/security/cve/CVE-2018-7537.html https://bugzilla.suse.com/1001374 https://bugzilla.suse.com/1008047 https://bugzilla.suse.com/1008050 https://bugzilla.suse.com/1031450 https://bugzilla.suse.com/1031451 https://bugzilla.suse.com/1056284 https://bugzilla.suse.com/1083304 https://bugzilla.suse.com/1083305 https://bugzilla.suse.com/967999 https://bugzilla.suse.com/968000

1 0

openSUSE-SU-2018:0823-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 27 Mar '18

27 Mar '18

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0823-1 Rating: moderate References: #1048265 #1057831 #1059685 Cross-References: CVE-2017-7529 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for nginx to version 1.13.9 fixes the following issues: - CVE-2017-7529: nginx: Integer overflow in nginx range filter module allowed memory disclosure (bsc#1048265) This update also contains all updates and improvements in 1.13.9 upstream release. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-316=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nginx-1.13.9-2.3.1 nginx-debuginfo-1.13.9-2.3.1 nginx-debugsource-1.13.9-2.3.1 - openSUSE Leap 42.3 (noarch): vim-plugin-nginx-1.13.9-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-7529.html https://bugzilla.suse.com/1048265 https://bugzilla.suse.com/1057831 https://bugzilla.suse.com/1059685

1 0

openSUSE-SU-2018:0819-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 26 Mar '18

26 Mar '18

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0819-1 Rating: moderate References: #1085130 #1085671 Cross-References: CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5144 CVE-2018-5145 CVE-2018-5146 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.7 fixes multiple issues. The following bugs were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, did not find content in message attachments - Better error handling for Yahoo accounts The following security fixes are included as part of the mozilla platform. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts (MFSA 2018-09, bsc#1085130, bsc#1085671): - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5144: Integer overflow during Unicode conversion - CVE-2018-5146: Out of bounds memory write in libvorbis - CVE-2018-5125: Memory safety bugs fixed in Thunderbird 52.7 - CVE-2018-5145: Memory safety bugs fixed in Thunderbird 52.7 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-313=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): MozillaThunderbird-52.7-60.1 MozillaThunderbird-buildsymbols-52.7-60.1 MozillaThunderbird-debuginfo-52.7-60.1 MozillaThunderbird-debugsource-52.7-60.1 MozillaThunderbird-devel-52.7-60.1 MozillaThunderbird-translations-common-52.7-60.1 MozillaThunderbird-translations-other-52.7-60.1 References: https://www.suse.com/security/cve/CVE-2018-5125.html https://www.suse.com/security/cve/CVE-2018-5127.html https://www.suse.com/security/cve/CVE-2018-5129.html https://www.suse.com/security/cve/CVE-2018-5144.html https://www.suse.com/security/cve/CVE-2018-5145.html https://www.suse.com/security/cve/CVE-2018-5146.html https://bugzilla.suse.com/1085130 https://bugzilla.suse.com/1085671

1 0

openSUSE-SU-2018:0818-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 26 Mar '18

26 Mar '18

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0818-1 Rating: moderate References: #1085130 #1085671 Cross-References: CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5144 CVE-2018-5145 CVE-2018-5146 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.7 fixes multiple issues. The following bugs were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, did not find content in message attachments - Better error handling for Yahoo accounts The following security fixes are included as part of the mozilla platform. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts (MFSA 2018-09, bsc#1085130, bsc#1085671): - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5144: Integer overflow during Unicode conversion - CVE-2018-5146: Out of bounds memory write in libvorbis - CVE-2018-5125: Memory safety bugs fixed in Thunderbird 52.7 - CVE-2018-5145: Memory safety bugs fixed in Thunderbird 52.7 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-313=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.7-57.1 MozillaThunderbird-buildsymbols-52.7-57.1 MozillaThunderbird-debuginfo-52.7-57.1 MozillaThunderbird-debugsource-52.7-57.1 MozillaThunderbird-devel-52.7-57.1 MozillaThunderbird-translations-common-52.7-57.1 MozillaThunderbird-translations-other-52.7-57.1 References: https://www.suse.com/security/cve/CVE-2018-5125.html https://www.suse.com/security/cve/CVE-2018-5127.html https://www.suse.com/security/cve/CVE-2018-5129.html https://www.suse.com/security/cve/CVE-2018-5144.html https://www.suse.com/security/cve/CVE-2018-5145.html https://www.suse.com/security/cve/CVE-2018-5146.html https://bugzilla.suse.com/1085130 https://bugzilla.suse.com/1085671

1 0

openSUSE-RU-2018:0816-1: moderate: Recommended update for docker-compose
by maintenance＠opensuse.org 26 Mar '18

26 Mar '18

openSUSE Recommended Update: Recommended update for docker-compose ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0816-1 Rating: moderate References: #1085734 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for docker-compose fixes the following issues: - bsc#1085734: Avoid python errors when running docker-compose on SLE 12 SP3 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-312=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): docker-compose-1.2.0-5.1 References: https://bugzilla.suse.com/1085734

1 0