March 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0780-1: important: Security update for qemu
by opensuse-security＠opensuse.org 22 Mar '18

22 Mar '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0780-1 Rating: important References: #1040202 #1068032 #1068613 #1070144 #1071228 #1073489 #1074572 #1076114 #1076775 #1076813 #1082276 #1083291 Cross-References: CVE-2017-15119 CVE-2017-15124 CVE-2017-16845 CVE-2017-17381 CVE-2017-18043 CVE-2017-5715 CVE-2018-5683 CVE-2018-7550 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has four fixes is now available. Description: This update for qemu fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrate with corresponding changes in libvirt. (CVE-2017-5715 bsc#1068032) The January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl feature for all x86 vcpu types, which was the quick and dirty approach, but not the proper solution. We replaced our initial patch by the patches from upstream. This update defines spec_ctrl and ibpb cpu feature flags as well as new cpu models which are clones of existing models with either -IBRS or -IBPB added to the end of the model name. These new vcpu models explicitly include the new feature(s), whereas the feature flags can be added to the cpu parameter as with other features. In short, for continued Spectre v2 protection, ensure that either the appropriate cpu feature flag is added to the QEMU command-line, or one of the new cpu models is used. Although migration from older versions is supported, the new cpu features won't be properly exposed to the guest until it is restarted with the cpu features explicitly added. A reboot is insufficient. A warning patch is added which attempts to detect a migration from a qemu version which had the quick and dirty fix (it only detects certain cases, but hopefully is helpful.) For additional information on Spectre v2 as it relates to QEMU, see: https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/ A patch is added to continue to detect Spectre v2 mitigation features (as shown by cpuid), and if found provide that feature to guests, even if running on older KVM (kernel) versions which do not yet expose that feature to QEMU. (bsc#1082276) These two patches will be removed when we can reasonably assume everyone is running with the appropriate updates. Spectre fixes for IBM Z Series were included by providing more hw features to guests (bsc#1076813) Also security fixes for the following CVE issues are included: - CVE-2017-17381: The Virtio Vring implementation in QEMU allowed local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings. (bsc#1071228) - CVE-2017-16845: The PS2 driver in Qemu did not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access. (bsc#1068613) - CVE-2017-15119: The Network Block Device (NBD) server in Quick Emulator (QEMU), was vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS. (bsc#1070144) - CVE-2017-18043: Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allowed a user to cause a denial of service (Qemu process crash). (bsc#1076775) - CVE-2018-5683: The VGA driver in Qemu allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation. (bsc#1076114) - CVE-2018-7550: The multiboot functionality in Quick Emulator (aka QEMU) allowed local guest OS users to execute arbitrary code on the QEMU host via an out-of-bounds read or write memory access. (bsc#1083291) - CVE-2017-15124: VNC server implementation in Quick Emulator (QEMU) was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host. (bsc#1073489) Additional bugs fixed: - Fix pcihp for 1.6 and older machine types (bsc#1074572) - Fix packaging dependencies (coreutils) for qemu-ksm package (bsc#1040202) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-291=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-41.1 qemu-linux-user-debuginfo-2.9.1-41.1 qemu-linux-user-debugsource-2.9.1-41.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0-41.1 qemu-seabios-1.10.2-41.1 qemu-sgabios-8-41.1 qemu-vgabios-1.10.2-41.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-41.1 qemu-arm-2.9.1-41.1 qemu-arm-debuginfo-2.9.1-41.1 qemu-block-curl-2.9.1-41.1 qemu-block-curl-debuginfo-2.9.1-41.1 qemu-block-dmg-2.9.1-41.1 qemu-block-dmg-debuginfo-2.9.1-41.1 qemu-block-iscsi-2.9.1-41.1 qemu-block-iscsi-debuginfo-2.9.1-41.1 qemu-block-rbd-2.9.1-41.1 qemu-block-rbd-debuginfo-2.9.1-41.1 qemu-block-ssh-2.9.1-41.1 qemu-block-ssh-debuginfo-2.9.1-41.1 qemu-debugsource-2.9.1-41.1 qemu-extra-2.9.1-41.1 qemu-extra-debuginfo-2.9.1-41.1 qemu-guest-agent-2.9.1-41.1 qemu-guest-agent-debuginfo-2.9.1-41.1 qemu-ksm-2.9.1-41.1 qemu-kvm-2.9.1-41.1 qemu-lang-2.9.1-41.1 qemu-ppc-2.9.1-41.1 qemu-ppc-debuginfo-2.9.1-41.1 qemu-s390-2.9.1-41.1 qemu-s390-debuginfo-2.9.1-41.1 qemu-testsuite-2.9.1-41.1 qemu-tools-2.9.1-41.1 qemu-tools-debuginfo-2.9.1-41.1 qemu-x86-2.9.1-41.1 qemu-x86-debuginfo-2.9.1-41.1 References: https://www.suse.com/security/cve/CVE-2017-15119.html https://www.suse.com/security/cve/CVE-2017-15124.html https://www.suse.com/security/cve/CVE-2017-16845.html https://www.suse.com/security/cve/CVE-2017-17381.html https://www.suse.com/security/cve/CVE-2017-18043.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-5683.html https://www.suse.com/security/cve/CVE-2018-7550.html https://bugzilla.suse.com/1040202 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1068613 https://bugzilla.suse.com/1070144 https://bugzilla.suse.com/1071228 https://bugzilla.suse.com/1073489 https://bugzilla.suse.com/1074572 https://bugzilla.suse.com/1076114 https://bugzilla.suse.com/1076775 https://bugzilla.suse.com/1076813 https://bugzilla.suse.com/1082276 https://bugzilla.suse.com/1083291

1 0

openSUSE-SU-2018:0773-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 22 Mar '18

22 Mar '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0773-1 Rating: moderate References: #1086124 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 65.0.3325.181 fixes the following issue: - boo#1086124: Various security relevant fixes from audits, fuzzing and other initiatives Additionally, re2 was updated to the 2018-03-01 version. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-290=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libre2-0-20180301-15.1 libre2-0-debuginfo-20180301-15.1 re2-debugsource-20180301-15.1 re2-devel-20180301-15.1 - openSUSE Leap 42.3 (x86_64): chromedriver-65.0.3325.181-149.1 chromedriver-debuginfo-65.0.3325.181-149.1 chromium-65.0.3325.181-149.1 chromium-debuginfo-65.0.3325.181-149.1 chromium-debugsource-65.0.3325.181-149.1 libre2-0-32bit-20180301-15.1 libre2-0-debuginfo-32bit-20180301-15.1 References: https://bugzilla.suse.com/1086124

1 0

openSUSE-SU-2018:0765-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 21 Mar '18

21 Mar '18

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0765-1 Rating: moderate References: #1081925 Cross-References: CVE-2018-1058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql96 fixes the following issues: Security issues fixed: - CVE-2018-1058: Fixed uncontrolled search path element in pg_dump and other client applications (bsc#1081925). Bug fixes: - See release notes for details: * https://www.postgresql.org/docs/9.6/static/release-9-6-8.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-287=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libecpg6-9.6.8-15.1 libecpg6-debuginfo-9.6.8-15.1 libpq5-9.6.8-15.1 libpq5-debuginfo-9.6.8-15.1 postgresql96-9.6.8-15.1 postgresql96-contrib-9.6.8-15.1 postgresql96-contrib-debuginfo-9.6.8-15.1 postgresql96-debuginfo-9.6.8-15.1 postgresql96-debugsource-9.6.8-15.1 postgresql96-devel-9.6.8-15.1 postgresql96-devel-debuginfo-9.6.8-15.1 postgresql96-libs-debugsource-9.6.8-15.1 postgresql96-plperl-9.6.8-15.1 postgresql96-plperl-debuginfo-9.6.8-15.1 postgresql96-plpython-9.6.8-15.1 postgresql96-plpython-debuginfo-9.6.8-15.1 postgresql96-pltcl-9.6.8-15.1 postgresql96-pltcl-debuginfo-9.6.8-15.1 postgresql96-server-9.6.8-15.1 postgresql96-server-debuginfo-9.6.8-15.1 postgresql96-test-9.6.8-15.1 - openSUSE Leap 42.3 (x86_64): libecpg6-32bit-9.6.8-15.1 libecpg6-debuginfo-32bit-9.6.8-15.1 libpq5-32bit-9.6.8-15.1 libpq5-debuginfo-32bit-9.6.8-15.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.8-15.1 References: https://www.suse.com/security/cve/CVE-2018-1058.html https://bugzilla.suse.com/1081925

1 0

openSUSE-RU-2018:0764-1: moderate: Recommended update for go1.9
by maintenance＠opensuse.org 21 Mar '18

21 Mar '18

openSUSE Recommended Update: Recommended update for go1.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0764-1 Rating: moderate References: #1085785 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.9 fixes the following issues: - boo#1085785: various issues in go trace: * Ensure go binaries are not stripped (eg: go tools trace) * Ensure go trace html template is shipped as part of the installation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-288=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go1.9-1.9.4-8.1 go1.9-doc-1.9.4-8.1 go1.9-race-1.9.4-8.1 References: https://bugzilla.suse.com/1085785

1 0

openSUSE-RU-2018:0763-1: Recommended update for SUSEConnect
by maintenance＠opensuse.org 21 Mar '18

21 Mar '18

openSUSE Recommended Update: Recommended update for SUSEConnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0763-1 Rating: low References: #1047153 #914297 #964013 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for SUSEConnect provides the following fixes: - Fix the connection of virt-create-rootfs to SMT server. (bsc#914297) - Make the target_base_product parameter mandatory. - Add YaST.system_offline_migrations. - Improve the packaging. (bsc#964013) - Fix building SLE15. - Properly refresh zypper services when deactivating a product on SMT. (bsc#1047153) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-289=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): SUSEConnect-0.3.7-2.3.1 References: https://bugzilla.suse.com/1047153 https://bugzilla.suse.com/914297 https://bugzilla.suse.com/964013

1 0

openSUSE-RU-2018:0751-1: Recommended update for yast2-country
by maintenance＠opensuse.org 20 Mar '18

20 Mar '18

openSUSE Recommended Update: Recommended update for yast2-country ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0751-1 Rating: low References: #1054917 #1070305 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-country provides the following fixes: - Make sure the keyboard settings are properly applied in AutoYaST upgrades. (bsc#1070305) - Display "Uzhgorod" prefixed with its country (Ukraine) so that it is not seen as an unknown country. (bsc#1054917) - Make it possible to select the language in CaaS Platform 2. (FATE#323837) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-286=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-country-3.2.14-2.3.1 yast2-country-data-3.2.14-2.3.1 References: https://bugzilla.suse.com/1054917 https://bugzilla.suse.com/1070305

1 0

openSUSE-RU-2018:0750-1: Recommended update for rpmlint-mini
by maintenance＠opensuse.org 20 Mar '18

20 Mar '18

openSUSE Recommended Update: Recommended update for rpmlint-mini ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0750-1 Rating: low References: #1083531 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rpmlint-mini contains the following changes: - Update the list of valid licenses. (bsc#1083531) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-285=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rpmlint-mini-1.8-9.1 rpmlint-mini-debuginfo-1.8-9.1 rpmlint-mini-debugsource-1.8-9.1 References: https://bugzilla.suse.com/1083531

1 0

openSUSE-SU-2018:0745-1: important: Security update for various KMPs
by opensuse-security＠opensuse.org 19 Mar '18

19 Mar '18

openSUSE Security Update: Security update for various KMPs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0745-1 Rating: important References: #1068032 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The Spectre Variant 2 in the Linux Kernel is mitigated using "retpolines". This update rebuilds all openSUSE Leap 42.3 KMPs to use "retpolines" and so be able to mitigate the Spectre v2 attack. (bsc#1068032 CVE-2017-5715) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-284=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): crash-7.1.8-6.1 crash-debuginfo-7.1.8-6.1 crash-debugsource-7.1.8-6.1 crash-devel-7.1.8-6.1 crash-doc-7.1.8-6.1 crash-eppic-7.1.8-6.1 crash-eppic-debuginfo-7.1.8-6.1 crash-gcore-7.1.8-6.1 crash-gcore-debuginfo-7.1.8-6.1 - openSUSE Leap 42.3 (x86_64): bbswitch-0.8-12.2.1 bbswitch-debugsource-0.8-12.2.1 bbswitch-kmp-default-0.8_k4.4.114_42-12.2.1 bbswitch-kmp-default-debuginfo-0.8_k4.4.114_42-12.2.1 crash-kmp-default-7.1.8_k4.4.114_42-6.1 crash-kmp-default-debuginfo-7.1.8_k4.4.114_42-6.1 dpdk-16.11.1-6.2.1 dpdk-debuginfo-16.11.1-6.2.1 dpdk-debugsource-16.11.1-6.2.1 dpdk-devel-16.11.1-6.2.1 dpdk-devel-debuginfo-16.11.1-6.2.1 dpdk-examples-16.11.1-6.2.1 dpdk-examples-debuginfo-16.11.1-6.2.1 dpdk-kmp-default-16.11.1_k4.4.114_42-6.2.1 dpdk-kmp-default-debuginfo-16.11.1_k4.4.114_42-6.2.1 dpdk-tools-16.11.1-6.2.1 drbd-9.0.8+git.c8bc3670-2.2.1 drbd-debugsource-9.0.8+git.c8bc3670-2.2.1 drbd-kmp-default-9.0.8+git.c8bc3670_k4.4.114_42-2.2.1 drbd-kmp-default-debuginfo-9.0.8+git.c8bc3670_k4.4.114_42-2.2.1 drm-debugsource-4.9.33-7.1 drm-kmp-default-4.9.33_k4.4.114_42-7.1 drm-kmp-default-debuginfo-4.9.33_k4.4.114_42-7.1 ftsteutates-debugsource-20160601-4.2.1 ftsteutates-kmp-default-20160601_k4.4.114_42-4.2.1 ftsteutates-kmp-default-debuginfo-20160601_k4.4.114_42-4.2.1 hdjmod-debugsource-1.28-27.2.1 hdjmod-kmp-default-1.28_k4.4.114_42-27.2.1 hdjmod-kmp-default-debuginfo-1.28_k4.4.114_42-27.2.1 ipset-6.29-4.2.1 ipset-debuginfo-6.29-4.2.1 ipset-debugsource-6.29-4.2.1 ipset-devel-6.29-4.2.1 ipset-kmp-default-6.29_k4.4.114_42-4.2.1 ipset-kmp-default-debuginfo-6.29_k4.4.114_42-4.2.1 libipset3-6.29-4.2.1 libipset3-debuginfo-6.29-4.2.1 ndiswrapper-1.59-3.2.1 ndiswrapper-debuginfo-1.59-3.2.1 ndiswrapper-debugsource-1.59-3.2.1 ndiswrapper-kmp-default-1.59_k4.4.114_42-3.2.1 ndiswrapper-kmp-default-debuginfo-1.59_k4.4.114_42-3.2.1 pcfclock-0.44-272.2.1 pcfclock-debuginfo-0.44-272.2.1 pcfclock-debugsource-0.44-272.2.1 pcfclock-kmp-default-0.44_k4.4.114_42-272.2.1 pcfclock-kmp-default-debuginfo-0.44_k4.4.114_42-272.2.1 sysdig-0.17.0-10.1 sysdig-debuginfo-0.17.0-10.1 sysdig-debugsource-0.17.0-10.1 sysdig-kmp-default-0.17.0_k4.4.114_42-10.1 sysdig-kmp-default-debuginfo-0.17.0_k4.4.114_42-10.1 vhba-kmp-debugsource-20161009-9.2.1 vhba-kmp-default-20161009_k4.4.114_42-9.2.1 vhba-kmp-default-debuginfo-20161009_k4.4.114_42-9.2.1 xtables-addons-2.11-4.2.1 xtables-addons-debuginfo-2.11-4.2.1 xtables-addons-debugsource-2.11-4.2.1 xtables-addons-kmp-default-2.11_k4.4.114_42-4.2.1 xtables-addons-kmp-default-debuginfo-2.11_k4.4.114_42-4.2.1 - openSUSE Leap 42.3 (noarch): dpdk-doc-16.11.1-6.2.1 ftsteutates-sensors-20160601-4.2.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1068032

1 0

openSUSE-SU-2018:0738-1: moderate: Security update for xmltooling
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for xmltooling ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0738-1 Rating: moderate References: #1083247 Cross-References: CVE-2018-0486 CVE-2018-0489 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for xmltooling fixes the following issues: - CVE-2018-0489: Fixed a security bug when xmltooling mishandled digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. (bsc#1083247) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-276=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): libxmltooling-devel-1.5.6-9.1 libxmltooling6-1.5.6-9.1 libxmltooling6-debuginfo-1.5.6-9.1 xmltooling-debugsource-1.5.6-9.1 xmltooling-schemas-1.5.6-9.1 References: https://www.suse.com/security/cve/CVE-2018-0486.html https://www.suse.com/security/cve/CVE-2018-0489.html https://bugzilla.suse.com/1083247

1 0

openSUSE-SU-2018:0737-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0737-1 Rating: important References: #1085671 Cross-References: CVE-2018-5146 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Mozilla Firefox to version 52.7.2esr fixes security issues and bugs. Security issues fixed: - CVE-2018-5146: Specially crafted vorbis files could have been used to execute arbitrary code via an Out of bounds memory write (bsc#1085671, MFSA 2018-08) - CVE-2018-5147: Specially crafted vorbis files could have been used to execute arbitrary code via an Out of bounds memory write - used on ARM platforms (bsc#1085671, MFSA 2018-08) The following bug fixes are included: - Stability improvements in the Italian locale Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-278=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.7.2-81.1 MozillaFirefox-branding-upstream-52.7.2-81.1 MozillaFirefox-buildsymbols-52.7.2-81.1 MozillaFirefox-debuginfo-52.7.2-81.1 MozillaFirefox-debugsource-52.7.2-81.1 MozillaFirefox-devel-52.7.2-81.1 MozillaFirefox-translations-common-52.7.2-81.1 MozillaFirefox-translations-other-52.7.2-81.1 References: https://www.suse.com/security/cve/CVE-2018-5146.html https://bugzilla.suse.com/1085671

1 0