March 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0736-1: moderate: Security update for postgresql95
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for postgresql95 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0736-1 Rating: moderate References: #1081925 Cross-References: CVE-2018-1058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql95 fixes the following issues: Security issue fixed in PostgreSQL 9.5.12: - CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications (boo#1081925). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-279=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql95-9.5.12-2.6.1 postgresql95-contrib-9.5.12-2.6.1 postgresql95-contrib-debuginfo-9.5.12-2.6.1 postgresql95-debuginfo-9.5.12-2.6.1 postgresql95-debugsource-9.5.12-2.6.1 postgresql95-devel-9.5.12-2.6.1 postgresql95-devel-debuginfo-9.5.12-2.6.1 postgresql95-libs-debugsource-9.5.12-2.6.1 postgresql95-plperl-9.5.12-2.6.1 postgresql95-plperl-debuginfo-9.5.12-2.6.1 postgresql95-plpython-9.5.12-2.6.1 postgresql95-plpython-debuginfo-9.5.12-2.6.1 postgresql95-pltcl-9.5.12-2.6.1 postgresql95-pltcl-debuginfo-9.5.12-2.6.1 postgresql95-server-9.5.12-2.6.1 postgresql95-server-debuginfo-9.5.12-2.6.1 postgresql95-test-9.5.12-2.6.1 - openSUSE Leap 42.3 (noarch): postgresql95-docs-9.5.12-2.6.1 References: https://www.suse.com/security/cve/CVE-2018-1058.html https://bugzilla.suse.com/1081925

1 0

openSUSE-SU-2018:0735-1: moderate: Security update for libid3tag
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for libid3tag ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0735-1 Rating: moderate References: #1081959 #1081961 #1081962 #387731 Cross-References: CVE-2004-2779 CVE-2008-2109 CVE-2017-11550 CVE-2017-11551 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libid3tag fixes the following issues: - CVE-2004-2779 CVE-2017-11551: Fixed id3_utf16_deserialize() in utf16.c, which previously misparsed ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until OOM leading to DoS. (bsc#1081959 bsc#1081961) - CVE-2017-11550 CVE-2008-2109: Fixed the handling of unknown encodings when parsing ID3 tags. (bsc#1081962 bsc#387731) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-277=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libid3tag-debugsource-0.15.1b-188.3.1 libid3tag-devel-0.15.1b-188.3.1 libid3tag0-0.15.1b-188.3.1 libid3tag0-debuginfo-0.15.1b-188.3.1 - openSUSE Leap 42.3 (x86_64): libid3tag0-32bit-0.15.1b-188.3.1 libid3tag0-debuginfo-32bit-0.15.1b-188.3.1 References: https://www.suse.com/security/cve/CVE-2004-2779.html https://www.suse.com/security/cve/CVE-2008-2109.html https://www.suse.com/security/cve/CVE-2017-11550.html https://www.suse.com/security/cve/CVE-2017-11551.html https://bugzilla.suse.com/1081959 https://bugzilla.suse.com/1081961 https://bugzilla.suse.com/1081962 https://bugzilla.suse.com/387731

1 0

openSUSE-SU-2018:0734-1: important: Security update for SDL2, SDL2_image
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for SDL2, SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0734-1 Rating: important References: #1025413 #1084256 #1084257 #1084282 #1084288 #1084297 #1084303 #1084304 Cross-References: CVE-2017-12122 CVE-2017-14440 CVE-2017-14441 CVE-2017-14442 CVE-2017-14448 CVE-2017-14449 CVE-2017-14450 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for SDL2 and SDL2_image fixes the following issues: - CVE-2017-14441: Code execution in the ICO image rendering (bsc#1084282). - CVE-2017-14440: Potential code execution in the ILBM image rendering functionality (bsc#1084257). - CVE-2017-12122: Potential code execution in the ILBM image rendering fuctionality (bsc#1084256). - CVE-2017-14448: Heap buffer overflow in the XCF image rendering functionality (bsc#1084303). - CVE-2017-14449: Double-Free in the XCF image rendering (bsc#1084297). - CVE-2017-14442: Stack buffer overflow the BMP image rendering functionality (bsc#1084304). - CVE-2017-14450: Buffer overflow in the GIF image parsing (bsc#1084288). Bug fixes: - boo#1025413: Add dbus-ime.diff and build with fcitx. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): SDL2-debugsource-2.0.8-18.1 SDL2_image-debugsource-2.0.3-13.10.1 libSDL2-2_0-0-2.0.8-18.1 libSDL2-2_0-0-debuginfo-2.0.8-18.1 libSDL2-devel-2.0.8-18.1 libSDL2_image-2_0-0-2.0.3-13.10.1 libSDL2_image-2_0-0-debuginfo-2.0.3-13.10.1 libSDL2_image-devel-2.0.3-13.10.1 - openSUSE Leap 42.3 (x86_64): libSDL2-2_0-0-32bit-2.0.8-18.1 libSDL2-2_0-0-debuginfo-32bit-2.0.8-18.1 libSDL2-devel-32bit-2.0.8-18.1 libSDL2_image-2_0-0-32bit-2.0.3-13.10.1 libSDL2_image-2_0-0-debuginfo-32bit-2.0.3-13.10.1 libSDL2_image-devel-32bit-2.0.3-13.10.1 References: https://www.suse.com/security/cve/CVE-2017-12122.html https://www.suse.com/security/cve/CVE-2017-14440.html https://www.suse.com/security/cve/CVE-2017-14441.html https://www.suse.com/security/cve/CVE-2017-14442.html https://www.suse.com/security/cve/CVE-2017-14448.html https://www.suse.com/security/cve/CVE-2017-14449.html https://www.suse.com/security/cve/CVE-2017-14450.html https://bugzilla.suse.com/1025413 https://bugzilla.suse.com/1084256 https://bugzilla.suse.com/1084257 https://bugzilla.suse.com/1084282 https://bugzilla.suse.com/1084288 https://bugzilla.suse.com/1084297 https://bugzilla.suse.com/1084303 https://bugzilla.suse.com/1084304

1 0

openSUSE-SU-2018:0733-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0733-1 Rating: moderate References: #1058630 #1059735 #1066168 #1066170 #1082283 #1082291 #1084060 #1084062 #1085233 Cross-References: CVE-2017-14314 CVE-2017-14505 CVE-2017-15016 CVE-2017-15017 CVE-2017-16352 CVE-2017-16353 CVE-2017-18219 CVE-2017-18220 CVE-2017-18230 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2017-18230: Specially crafted CINEON images may have caused a Null pointer dereference (boo#1085233) - CVE-2017-16353: Specially crafted MIFF images could have allowed for information disclosure (boo#1066170) - CVE-2017-16352: Specially crafted MIFF images may have caused a heap-based buffer overflow (boo#1066168) - CVE-2017-14314: Specially crafted image files may have caused a denial of service (boo#1058630) - CVE-2017-14505: Specially crafted image files may have caused a Null pointer dereference (boo#1059735) - CVE-2017-15016: Specially crafted EMF images may have caused a Null pointer dereference (boo#1082291) - CVE-2017-15017: Specially crafted MSG images may have caused a Null pointer dereference (boo#1082283) - CVE-2017-18219: Specially crafted image files may have been used to cause an application crash (boo#1084060) - CVE-2017-18220: Specially crafted PNG images may have been used to cause a denial of service (boo#1084062) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-79.1 GraphicsMagick-debuginfo-1.3.25-79.1 GraphicsMagick-debugsource-1.3.25-79.1 GraphicsMagick-devel-1.3.25-79.1 libGraphicsMagick++-Q16-12-1.3.25-79.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-79.1 libGraphicsMagick++-devel-1.3.25-79.1 libGraphicsMagick-Q16-3-1.3.25-79.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-79.1 libGraphicsMagick3-config-1.3.25-79.1 libGraphicsMagickWand-Q16-2-1.3.25-79.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-79.1 perl-GraphicsMagick-1.3.25-79.1 perl-GraphicsMagick-debuginfo-1.3.25-79.1 References: https://www.suse.com/security/cve/CVE-2017-14314.html https://www.suse.com/security/cve/CVE-2017-14505.html https://www.suse.com/security/cve/CVE-2017-15016.html https://www.suse.com/security/cve/CVE-2017-15017.html https://www.suse.com/security/cve/CVE-2017-16352.html https://www.suse.com/security/cve/CVE-2017-16353.html https://www.suse.com/security/cve/CVE-2017-18219.html https://www.suse.com/security/cve/CVE-2017-18220.html https://www.suse.com/security/cve/CVE-2017-18230.html https://bugzilla.suse.com/1058630 https://bugzilla.suse.com/1059735 https://bugzilla.suse.com/1066168 https://bugzilla.suse.com/1066170 https://bugzilla.suse.com/1082283 https://bugzilla.suse.com/1082291 https://bugzilla.suse.com/1084060 https://bugzilla.suse.com/1084062 https://bugzilla.suse.com/1085233

1 0

openSUSE-SU-2018:0732-1: moderate: Security update for exempi
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for exempi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0732-1 Rating: moderate References: #1085295 #1085297 Cross-References: CVE-2018-7728 CVE-2018-7730 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for exempi fixes the following issues: - CVE-2018-7728: Specially crafted TIFF images could have been used to cause a denial of service via a heap-based buffer overflow (boo#1085297) - CVE-2018-7730: Specially crafted Excel files could have been used cause a denial of service via a heap-based buffer overflow (boo#1085295) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): exempi-debugsource-2.2.2-6.3.1 exempi-tools-2.2.2-6.3.1 exempi-tools-debuginfo-2.2.2-6.3.1 libexempi-devel-2.2.2-6.3.1 libexempi3-2.2.2-6.3.1 libexempi3-debuginfo-2.2.2-6.3.1 - openSUSE Leap 42.3 (x86_64): libexempi3-32bit-2.2.2-6.3.1 libexempi3-debuginfo-32bit-2.2.2-6.3.1 References: https://www.suse.com/security/cve/CVE-2018-7728.html https://www.suse.com/security/cve/CVE-2018-7730.html https://bugzilla.suse.com/1085295 https://bugzilla.suse.com/1085297

1 0

openSUSE-SU-2018:0731-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0731-1 Rating: moderate References: #1084688 #1084690 #1084691 Cross-References: CVE-2018-5800 CVE-2018-5801 CVE-2018-5802 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libraw fixes the following issues: - CVE-2018-5800: Specially crafted RAW files may have caused an application crash via a heap-based buffer overflow (boo#1084690) - CVE-2018-5801: Specially crafted RAW files may have been used to trigger a NULL pointer de-reference (boo#1084691) - CVE-2018-5802: Specially crafted RAW files may have caused an application crash via a heap-based buffer overflow (boo#1084688) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-281=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-17.1 libraw-devel-0.17.1-17.1 libraw-devel-static-0.17.1-17.1 libraw-tools-0.17.1-17.1 libraw-tools-debuginfo-0.17.1-17.1 libraw15-0.17.1-17.1 libraw15-debuginfo-0.17.1-17.1 References: https://www.suse.com/security/cve/CVE-2018-5800.html https://www.suse.com/security/cve/CVE-2018-5801.html https://www.suse.com/security/cve/CVE-2018-5802.html https://bugzilla.suse.com/1084688 https://bugzilla.suse.com/1084690 https://bugzilla.suse.com/1084691

1 0

openSUSE-SU-2018:0730-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0730-1 Rating: important References: #1078431 Cross-References: CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: MariaDB was updated to 10.0.34 (bsc#1078431) The following security vulnerabilities are fixed: - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The MariaDB external release notes and changelog for this release: * https://kb.askmonty.org/en/mariadb-10034-release-notes * https://kb.askmonty.org/en/mariadb-10034-changelog This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysqlclient-devel-10.0.34-32.2 libmysqlclient18-10.0.34-32.2 libmysqlclient18-debuginfo-10.0.34-32.2 libmysqlclient_r18-10.0.34-32.2 libmysqld-devel-10.0.34-32.2 libmysqld18-10.0.34-32.2 libmysqld18-debuginfo-10.0.34-32.2 mariadb-10.0.34-32.2 mariadb-bench-10.0.34-32.2 mariadb-bench-debuginfo-10.0.34-32.2 mariadb-client-10.0.34-32.2 mariadb-client-debuginfo-10.0.34-32.2 mariadb-debuginfo-10.0.34-32.2 mariadb-debugsource-10.0.34-32.2 mariadb-errormessages-10.0.34-32.2 mariadb-test-10.0.34-32.2 mariadb-test-debuginfo-10.0.34-32.2 mariadb-tools-10.0.34-32.2 mariadb-tools-debuginfo-10.0.34-32.2 - openSUSE Leap 42.3 (x86_64): libmysqlclient18-32bit-10.0.34-32.2 libmysqlclient18-debuginfo-32bit-10.0.34-32.2 libmysqlclient_r18-32bit-10.0.34-32.2 References: https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1078431

1 0

openSUSE-RU-2018:0729-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0729-1 Rating: moderate References: #1051350 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - boo#1051350: The active cell may not have been shown in LibreOffice Calc running on graphics hardware supporting GLAMOR, including Intel Gen4/5 and Radeio G300-G400 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-275=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): xorg-x11-server-7.6_1.18.3-31.1 xorg-x11-server-debuginfo-7.6_1.18.3-31.1 xorg-x11-server-debugsource-7.6_1.18.3-31.1 xorg-x11-server-extra-7.6_1.18.3-31.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-31.1 xorg-x11-server-sdk-7.6_1.18.3-31.1 xorg-x11-server-source-7.6_1.18.3-31.1 References: https://bugzilla.suse.com/1051350

1 0

openSUSE-RU-2018:0728-1: Recommended update for python3-six
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for python3-six ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0728-1 Rating: low References: #1011342 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-six to version 1.10.0 updates the package to the one used in SLE. It contains the following improvements: - Improve the performance of `six.int2byte` on Python 3 - Various other bug fixes - split out -doc package This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-274=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-six-1.10.0-5.3.1 python3-six-doc-1.10.0-5.3.1 References: https://bugzilla.suse.com/1011342

1 0

openSUSE-RU-2018:0727-1: moderate: Recommended update for python-CherryPy
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for python-CherryPy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0727-1 Rating: moderate References: #1043589 #1046667 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-CherryPy fixes an SSL compatibility issue with CPython 2.7 and its built-in version of pyOpenSSL. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-273=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-CherryPy-3.6.0-7.3.1 References: https://bugzilla.suse.com/1043589 https://bugzilla.suse.com/1046667

1 0

openSUSE-RU-2018:0726-1: Recommended update for python3-py
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for python3-py ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0726-1 Rating: low References: Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python3-py to version 1.4.31 updates the sources to those used in SLE. This version also fixes the following issues: - fix local().copy(dest, mode=True) to also work with unicode. - pass better error message with svn EEXIST paths This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-272=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-py-1.4.31-6.3.1 python3-py-doc-1.4.31-6.3.1 References:

1 0

openSUSE-SU-2018:0725-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0725-1 Rating: moderate References: #1083639 Cross-References: CVE-2018-7584 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: Security issues fixed: - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex (bsc#1083639). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-269=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-97.1 apache2-mod_php5-debuginfo-5.5.14-97.1 php5-5.5.14-97.1 php5-bcmath-5.5.14-97.1 php5-bcmath-debuginfo-5.5.14-97.1 php5-bz2-5.5.14-97.1 php5-bz2-debuginfo-5.5.14-97.1 php5-calendar-5.5.14-97.1 php5-calendar-debuginfo-5.5.14-97.1 php5-ctype-5.5.14-97.1 php5-ctype-debuginfo-5.5.14-97.1 php5-curl-5.5.14-97.1 php5-curl-debuginfo-5.5.14-97.1 php5-dba-5.5.14-97.1 php5-dba-debuginfo-5.5.14-97.1 php5-debuginfo-5.5.14-97.1 php5-debugsource-5.5.14-97.1 php5-devel-5.5.14-97.1 php5-dom-5.5.14-97.1 php5-dom-debuginfo-5.5.14-97.1 php5-enchant-5.5.14-97.1 php5-enchant-debuginfo-5.5.14-97.1 php5-exif-5.5.14-97.1 php5-exif-debuginfo-5.5.14-97.1 php5-fastcgi-5.5.14-97.1 php5-fastcgi-debuginfo-5.5.14-97.1 php5-fileinfo-5.5.14-97.1 php5-fileinfo-debuginfo-5.5.14-97.1 php5-firebird-5.5.14-97.1 php5-firebird-debuginfo-5.5.14-97.1 php5-fpm-5.5.14-97.1 php5-fpm-debuginfo-5.5.14-97.1 php5-ftp-5.5.14-97.1 php5-ftp-debuginfo-5.5.14-97.1 php5-gd-5.5.14-97.1 php5-gd-debuginfo-5.5.14-97.1 php5-gettext-5.5.14-97.1 php5-gettext-debuginfo-5.5.14-97.1 php5-gmp-5.5.14-97.1 php5-gmp-debuginfo-5.5.14-97.1 php5-iconv-5.5.14-97.1 php5-iconv-debuginfo-5.5.14-97.1 php5-imap-5.5.14-97.1 php5-imap-debuginfo-5.5.14-97.1 php5-intl-5.5.14-97.1 php5-intl-debuginfo-5.5.14-97.1 php5-json-5.5.14-97.1 php5-json-debuginfo-5.5.14-97.1 php5-ldap-5.5.14-97.1 php5-ldap-debuginfo-5.5.14-97.1 php5-mbstring-5.5.14-97.1 php5-mbstring-debuginfo-5.5.14-97.1 php5-mcrypt-5.5.14-97.1 php5-mcrypt-debuginfo-5.5.14-97.1 php5-mssql-5.5.14-97.1 php5-mssql-debuginfo-5.5.14-97.1 php5-mysql-5.5.14-97.1 php5-mysql-debuginfo-5.5.14-97.1 php5-odbc-5.5.14-97.1 php5-odbc-debuginfo-5.5.14-97.1 php5-opcache-5.5.14-97.1 php5-opcache-debuginfo-5.5.14-97.1 php5-openssl-5.5.14-97.1 php5-openssl-debuginfo-5.5.14-97.1 php5-pcntl-5.5.14-97.1 php5-pcntl-debuginfo-5.5.14-97.1 php5-pdo-5.5.14-97.1 php5-pdo-debuginfo-5.5.14-97.1 php5-pgsql-5.5.14-97.1 php5-pgsql-debuginfo-5.5.14-97.1 php5-phar-5.5.14-97.1 php5-phar-debuginfo-5.5.14-97.1 php5-posix-5.5.14-97.1 php5-posix-debuginfo-5.5.14-97.1 php5-pspell-5.5.14-97.1 php5-pspell-debuginfo-5.5.14-97.1 php5-readline-5.5.14-97.1 php5-readline-debuginfo-5.5.14-97.1 php5-shmop-5.5.14-97.1 php5-shmop-debuginfo-5.5.14-97.1 php5-snmp-5.5.14-97.1 php5-snmp-debuginfo-5.5.14-97.1 php5-soap-5.5.14-97.1 php5-soap-debuginfo-5.5.14-97.1 php5-sockets-5.5.14-97.1 php5-sockets-debuginfo-5.5.14-97.1 php5-sqlite-5.5.14-97.1 php5-sqlite-debuginfo-5.5.14-97.1 php5-suhosin-5.5.14-97.1 php5-suhosin-debuginfo-5.5.14-97.1 php5-sysvmsg-5.5.14-97.1 php5-sysvmsg-debuginfo-5.5.14-97.1 php5-sysvsem-5.5.14-97.1 php5-sysvsem-debuginfo-5.5.14-97.1 php5-sysvshm-5.5.14-97.1 php5-sysvshm-debuginfo-5.5.14-97.1 php5-tidy-5.5.14-97.1 php5-tidy-debuginfo-5.5.14-97.1 php5-tokenizer-5.5.14-97.1 php5-tokenizer-debuginfo-5.5.14-97.1 php5-wddx-5.5.14-97.1 php5-wddx-debuginfo-5.5.14-97.1 php5-xmlreader-5.5.14-97.1 php5-xmlreader-debuginfo-5.5.14-97.1 php5-xmlrpc-5.5.14-97.1 php5-xmlrpc-debuginfo-5.5.14-97.1 php5-xmlwriter-5.5.14-97.1 php5-xmlwriter-debuginfo-5.5.14-97.1 php5-xsl-5.5.14-97.1 php5-xsl-debuginfo-5.5.14-97.1 php5-zip-5.5.14-97.1 php5-zip-debuginfo-5.5.14-97.1 php5-zlib-5.5.14-97.1 php5-zlib-debuginfo-5.5.14-97.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-97.1 References: https://www.suse.com/security/cve/CVE-2018-7584.html https://bugzilla.suse.com/1083639

1 0

openSUSE-RU-2018:0724-1: Recommended update for salt dependencies
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for salt dependencies ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0724-1 Rating: low References: #989693 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains updates to Python modules used by salt, making them identical to SLE sources: - apache-libcloud 0.19.0 - python-tornado 4.2.1 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-271=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): python-tornado-4.2.1-5.3.1 python-tornado-debuginfo-4.2.1-5.3.1 python-tornado-debugsource-4.2.1-5.3.1 - openSUSE Leap 42.3 (noarch): python-apache-libcloud-0.19.0-7.3.1 References: https://bugzilla.suse.com/989693

1 0

openSUSE-RU-2018:0713-1: Recommended update for python-rtslib
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for python-rtslib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0713-1 Rating: low References: #1058995 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rtslib fixes the following issues: - targetcli: fix parsing error with newer pyparsing module (bsc#1058995) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-267=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-rtslib-2.2-19.3.1 References: https://bugzilla.suse.com/1058995

1 0

openSUSE-RU-2018:0711-1: Recommended update for python-rtslib-fb
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for python-rtslib-fb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0711-1 Rating: low References: #1076455 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rtslib-fb provides the following fix: - Fix incorrect naming for XEN (bsc#1076455) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-268=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): python-rtslib-fb-2.1.63-6.1 - openSUSE Leap 42.3 (noarch): python-rtslib-fb-doc-2.1.63-6.1 References: https://bugzilla.suse.com/1076455

1 0

openSUSE-SU-2018:0710-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0710-1 Rating: important References: #1085207 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ucode-intel-20180312-22.1 ucode-intel-blob-20180312-22.1 ucode-intel-debuginfo-20180312-22.1 ucode-intel-debugsource-20180312-22.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1085207

1 0

openSUSE-RU-2018:0709-1: moderate: Recommended update for nsd
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for nsd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0709-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for nsd to version 4.1.20 fixes the following issues: - memory leak in zone file read of unknown rr formatted RRs - memory leak when rehashing nsec3 after axfr or zonefile Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-265=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nsd-4.1.20-5.1 nsd-debuginfo-4.1.20-5.1 nsd-debugsource-4.1.20-5.1 References:

1 0

openSUSE-SU-2018:0704-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0704-1 Rating: important References: #1084296 Cross-References: CVE-2017-11215 CVE-2017-11225 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073 CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077 CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081 CVE-2018-6082 CVE-2018-6083 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for Chromium to version 65.0.3325.162 fixes the following issues: - CVE-2017-11215: Use after free in Flash - CVE-2017-11225: Use after free in Flash - CVE-2018-6060: Use after free in Blink - CVE-2018-6061: Race condition in V8 - CVE-2018-6062: Heap buffer overflow in Skia - CVE-2018-6057: Incorrect permissions on shared memory - CVE-2018-6063: Incorrect permissions on shared memory - CVE-2018-6064: Type confusion in V8 - CVE-2018-6065: Integer overflow in V8 - CVE-2018-6066: Same Origin Bypass via canvas - CVE-2018-6067: Buffer overflow in Skia - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab - CVE-2018-6069: Stack buffer overflow in Skia - CVE-2018-6070: CSP bypass through extensions - CVE-2018-6071: Heap bufffer overflow in Skia - CVE-2018-6072: Integer overflow in PDFium - CVE-2018-6073: Heap bufffer overflow in WebGL - CVE-2018-6074: Mark-of-the-Web bypass - CVE-2018-6075: Overly permissive cross origin downloads - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink - CVE-2018-6077: Timing attack using SVG filters - CVE-2018-6078: URL Spoof in OmniBox - CVE-2018-6079: Information disclosure via texture data in WebGL - CVE-2018-6080: Information disclosure in IPC call - CVE-2018-6081: XSS in interstitials - CVE-2018-6082: Circumvention of port blocking - CVE-2018-6083: Incorrect processing of AppManifests Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-65.0.3325.162-146.1 chromedriver-debuginfo-65.0.3325.162-146.1 chromium-65.0.3325.162-146.1 chromium-debuginfo-65.0.3325.162-146.1 chromium-debugsource-65.0.3325.162-146.1 References: https://www.suse.com/security/cve/CVE-2017-11215.html https://www.suse.com/security/cve/CVE-2017-11225.html https://www.suse.com/security/cve/CVE-2018-6057.html https://www.suse.com/security/cve/CVE-2018-6060.html https://www.suse.com/security/cve/CVE-2018-6061.html https://www.suse.com/security/cve/CVE-2018-6062.html https://www.suse.com/security/cve/CVE-2018-6063.html https://www.suse.com/security/cve/CVE-2018-6064.html https://www.suse.com/security/cve/CVE-2018-6065.html https://www.suse.com/security/cve/CVE-2018-6066.html https://www.suse.com/security/cve/CVE-2018-6067.html https://www.suse.com/security/cve/CVE-2018-6068.html https://www.suse.com/security/cve/CVE-2018-6069.html https://www.suse.com/security/cve/CVE-2018-6070.html https://www.suse.com/security/cve/CVE-2018-6071.html https://www.suse.com/security/cve/CVE-2018-6072.html https://www.suse.com/security/cve/CVE-2018-6073.html https://www.suse.com/security/cve/CVE-2018-6074.html https://www.suse.com/security/cve/CVE-2018-6075.html https://www.suse.com/security/cve/CVE-2018-6076.html https://www.suse.com/security/cve/CVE-2018-6077.html https://www.suse.com/security/cve/CVE-2018-6078.html https://www.suse.com/security/cve/CVE-2018-6079.html https://www.suse.com/security/cve/CVE-2018-6080.html https://www.suse.com/security/cve/CVE-2018-6081.html https://www.suse.com/security/cve/CVE-2018-6082.html https://www.suse.com/security/cve/CVE-2018-6083.html https://bugzilla.suse.com/1084296

1 0

openSUSE-SU-2018:0703-1: moderate: Security update for kernel-firmware
by opensuse-security＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0703-1 Rating: moderate References: #1077355 Cross-References: CVE-2015-1142857 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kernel-firmware fixes the following issues: - CVE-2015-1142857: Add 7.13.1.0 bnx2x firmware files to fix a ethernet flow control vulnerability in SRIOV devices (bsc#1077355) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-262=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): kernel-firmware-20170530-17.1 ucode-amd-20170530-17.1 References: https://www.suse.com/security/cve/CVE-2015-1142857.html https://bugzilla.suse.com/1077355

1 0

openSUSE-RU-2018:0702-1: moderate: Recommended update for squidGuard
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for squidGuard ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0702-1 Rating: moderate References: #1081012 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for squidGuard provides the following fixes: - Enable LDAP support. (bsc#1081012) - Declare functions to use use correct pointer sizes on 64-bit architectures to fix LDAP support. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-261=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): squidGuard-1.4-11.1 squidGuard-debuginfo-1.4-11.1 squidGuard-debugsource-1.4-11.1 squidGuard-doc-1.4-11.1 References: https://bugzilla.suse.com/1081012

1 0

openSUSE-RU-2018:0701-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0701-1 Rating: moderate References: #1075743 #1078358 #1081170 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for systemd fixes the following issues: - Add dmi/id conditions to 80-acpi-container-hotplug.rules to restrict the rule that it can only be triggered on Huawei Kunlun 9008, 9016 and 9032 machines. (bsc#1078358, bsc#1081170, bsc#1075743) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-259=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-47.1 libsystemd0-debuginfo-228-47.1 libsystemd0-mini-228-47.1 libsystemd0-mini-debuginfo-228-47.1 libudev-devel-228-47.1 libudev-mini-devel-228-47.1 libudev-mini1-228-47.1 libudev-mini1-debuginfo-228-47.1 libudev1-228-47.1 libudev1-debuginfo-228-47.1 nss-myhostname-228-47.1 nss-myhostname-debuginfo-228-47.1 nss-mymachines-228-47.1 nss-mymachines-debuginfo-228-47.1 systemd-228-47.1 systemd-debuginfo-228-47.1 systemd-debugsource-228-47.1 systemd-devel-228-47.1 systemd-logger-228-47.1 systemd-mini-228-47.1 systemd-mini-debuginfo-228-47.1 systemd-mini-debugsource-228-47.1 systemd-mini-devel-228-47.1 systemd-mini-sysvinit-228-47.1 systemd-sysvinit-228-47.1 udev-228-47.1 udev-debuginfo-228-47.1 udev-mini-228-47.1 udev-mini-debuginfo-228-47.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-47.1 systemd-mini-bash-completion-228-47.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-47.1 libsystemd0-debuginfo-32bit-228-47.1 libudev1-32bit-228-47.1 libudev1-debuginfo-32bit-228-47.1 nss-myhostname-32bit-228-47.1 nss-myhostname-debuginfo-32bit-228-47.1 systemd-32bit-228-47.1 systemd-debuginfo-32bit-228-47.1 References: https://bugzilla.suse.com/1075743 https://bugzilla.suse.com/1078358 https://bugzilla.suse.com/1081170

1 0

openSUSE-RU-2018:0700-1: Recommended update for libsolv, libzypp, zypper
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for libsolv, libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0700-1 Rating: low References: #1074687 #1075449 #1076415 #1079334 #953130 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for libsolv, libzypp and zypper provides the following fixes: libsolv: - Fix a bug that could make fileconflict detection very slow in some cases. (bnc#953130) - Add new configuration options: ENABLE_RPMDB_LIBRPM and ENABLE_RPMPKG_LIBRPM. - Add a new function to change the whatprovides data: pool_set_whatprovides. - Significant improvements in the selection code. libzypp: - Make sure deleted keys are also removed from rpmdb. (bsc#1075449) - plugin: Don't reject header values containing ':'. (bsc#1074687) - RpmDb::checkPackage: Fix parsing localized rpm output. (bsc#1076415) zypper: - Do not recommend cron as it is not a direct dependency of zypper. (bsc#1079334) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-263=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsolv-debugsource-0.6.32-6.1 libsolv-demo-0.6.32-6.1 libsolv-demo-debuginfo-0.6.32-6.1 libsolv-devel-0.6.32-6.1 libsolv-devel-debuginfo-0.6.32-6.1 libsolv-tools-0.6.32-6.1 libsolv-tools-debuginfo-0.6.32-6.1 libzypp-16.17.10-21.1 libzypp-debuginfo-16.17.10-21.1 libzypp-debugsource-16.17.10-21.1 libzypp-devel-16.17.10-21.1 libzypp-devel-doc-16.17.10-21.1 perl-solv-0.6.32-6.1 perl-solv-debuginfo-0.6.32-6.1 python-solv-0.6.32-6.1 python-solv-debuginfo-0.6.32-6.1 python3-solv-0.6.32-6.1 python3-solv-debuginfo-0.6.32-6.1 ruby-solv-0.6.32-6.1 ruby-solv-debuginfo-0.6.32-6.1 zypper-1.13.40-17.2 zypper-debuginfo-1.13.40-17.2 zypper-debugsource-1.13.40-17.2 - openSUSE Leap 42.3 (noarch): zypper-aptitude-1.13.40-17.2 zypper-log-1.13.40-17.2 References: https://bugzilla.suse.com/1074687 https://bugzilla.suse.com/1075449 https://bugzilla.suse.com/1076415 https://bugzilla.suse.com/1079334 https://bugzilla.suse.com/953130

1 0

openSUSE-RU-2018:0699-1: Recommended update for wireless-regdb
by maintenance＠opensuse.org 16 Mar '18

16 Mar '18

openSUSE Recommended Update: Recommended update for wireless-regdb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0699-1 Rating: low References: #1074838 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update brings the latest version (2017.12.23) of regulatory domain data for wireless communication devices. (bsc#1074838) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-260=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): wireless-regdb-2017.12.23-5.3.2 References: https://bugzilla.suse.com/1074838

1 0

openSUSE-RU-2018:0696-1: moderate: Recommended update for messagelib
by maintenance＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Recommended Update: Recommended update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0696-1 Rating: moderate References: #1078174 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for messagelib fixes the following issues: - A previous update for boo#1078174 broke binary compatibility of the library. The change has been reverted. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-258=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): messagelib-17.04.2-9.1 messagelib-debuginfo-17.04.2-9.1 messagelib-debugsource-17.04.2-9.1 messagelib-devel-17.04.2-9.1 - openSUSE Leap 42.3 (noarch): messagelib-lang-17.04.2-9.1 References: https://bugzilla.suse.com/1078174

1 0

openSUSE-SU-2018:0688-1: moderate: Security update for postgresql94
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0688-1 Rating: moderate References: #1077983 Cross-References: CVE-2018-1053 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.15, the full release notes are here: https://www.postgresql.org/docs/9.4/static/release-9-4-15.html - CVE-2018-1053: Ensure that all temporary files made by pg_upgrade are non-world-readable. (bsc#1077983) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-257=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.16-18.1 postgresql94-contrib-9.4.16-18.1 postgresql94-contrib-debuginfo-9.4.16-18.1 postgresql94-debuginfo-9.4.16-18.1 postgresql94-debugsource-9.4.16-18.1 postgresql94-devel-9.4.16-18.1 postgresql94-devel-debuginfo-9.4.16-18.1 postgresql94-libs-debugsource-9.4.16-18.1 postgresql94-plperl-9.4.16-18.1 postgresql94-plperl-debuginfo-9.4.16-18.1 postgresql94-plpython-9.4.16-18.1 postgresql94-plpython-debuginfo-9.4.16-18.1 postgresql94-pltcl-9.4.16-18.1 postgresql94-pltcl-debuginfo-9.4.16-18.1 postgresql94-server-9.4.16-18.1 postgresql94-server-debuginfo-9.4.16-18.1 postgresql94-test-9.4.16-18.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.16-18.1 References: https://www.suse.com/security/cve/CVE-2018-1053.html https://bugzilla.suse.com/1077983

1 0

openSUSE-SU-2018:0684-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0684-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-256=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.171-48.3 java-1_7_0-openjdk-accessibility-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-devel-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-headless-1.7.0.171-48.3 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-debugsource-1.7.0.171-48.3 java-1_7_0-openjdk-demo-1.7.0.171-48.3 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-devel-1.7.0.171-48.3 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-headless-1.7.0.171-48.3 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-48.3 java-1_7_0-openjdk-src-1.7.0.171-48.3 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.171-48.3 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366

1 0

openSUSE-SU-2018:0681-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0681-1 Rating: important References: #1076907 #1085130 Cross-References: CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5130 CVE-2018-5131 CVE-2018-5144 CVE-2018-5145 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for Mozilla Firefox to version 52.7.0esr fixes multiple issues. Security issues fixed (bsc#1085130, MFSA 2018-07): - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption - CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources - CVE-2018-5144: Integer overflow during Unicode conversion - CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 - CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7 The following bug fixes are included: - bsc#1076907: provide mimehandler(text/html) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-255=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.7-78.1 MozillaFirefox-branding-upstream-52.7-78.1 MozillaFirefox-buildsymbols-52.7-78.1 MozillaFirefox-debuginfo-52.7-78.1 MozillaFirefox-debugsource-52.7-78.1 MozillaFirefox-devel-52.7-78.1 MozillaFirefox-translations-common-52.7-78.1 MozillaFirefox-translations-other-52.7-78.1 References: https://www.suse.com/security/cve/CVE-2018-5125.html https://www.suse.com/security/cve/CVE-2018-5127.html https://www.suse.com/security/cve/CVE-2018-5129.html https://www.suse.com/security/cve/CVE-2018-5130.html https://www.suse.com/security/cve/CVE-2018-5131.html https://www.suse.com/security/cve/CVE-2018-5144.html https://www.suse.com/security/cve/CVE-2018-5145.html https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1085130

1 0

openSUSE-SU-2018:0680-1: moderate: Security update for adminer
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for adminer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0680-1 Rating: moderate References: #1002214 #1083948 Cross-References: CVE-2018-7667 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for adminer fixes the following issues: * Sync up conditional sub-packages with devel package to disable uninstallable pacakges for boo#1002214. * Update to version v4.4.0 for boo#1083948 to resolve CVE-2018-7667 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-253=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): adminer-4.4.0-4.5.1 adminer-designs-4.4.0-4.5.1 adminer-editor-4.4.0-4.5.1 adminer-firebird-4.4.0-4.5.1 adminer-mysql-4.4.0-4.5.1 adminer-pgsql-4.4.0-4.5.1 adminer-sqlite-4.4.0-4.5.1 References: https://www.suse.com/security/cve/CVE-2018-7667.html https://bugzilla.suse.com/1002214 https://bugzilla.suse.com/1083948

1 0

openSUSE-SU-2018:0679-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 15 Mar '18

15 Mar '18

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0679-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Security issues fix in jdk8u161 (icedtea 3.7.0)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2582: Better interface invocations - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming deserialization cases This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-254=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.161-21.1 java-1_8_0-openjdk-accessibility-1.8.0.161-21.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-debugsource-1.8.0.161-21.1 java-1_8_0-openjdk-demo-1.8.0.161-21.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-devel-1.8.0.161-21.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-headless-1.8.0.161-21.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-21.1 java-1_8_0-openjdk-src-1.8.0.161-21.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.161-21.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366

1 0

openSUSE-RU-2018:0677-1: Recommended update for amazon-ssm-agent
by maintenance＠opensuse.org 14 Mar '18

14 Mar '18

openSUSE Recommended Update: Recommended update for amazon-ssm-agent ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0677-1 Rating: low References: #1067256 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for amazon-ssm-agent provides version 2.2.45.0 and brings the following fixes and improvements: - Added versioning support for Parameter Store. - Added additional gatherers for inventory, including windows service gatherer, windows registry gatherer, file metadata gatherer, windows role gatherer. - Added support for aws:downloadContent plugin to download content from GitHub, S3 and documents from SSM documents. - Added support for aws:runDocument plugin to execute SSM documents. - Improved speed of initial association application on boot. - Various aws:configurePackage service integration changes. - Improved home directory detection in non-x64 linux platforms to address cases where shared AWS SDK credentials were not available in on-prem instances. - Added exponential backoff in bucket region check for s3 upload. - Fixed an issue with orchestration directory cleanup for RunCommand. - Support for command execution out-of-process This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-252=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): amazon-ssm-agent-2.2.45.0-2.3.1 References: https://bugzilla.suse.com/1067256

1 0

openSUSE-RU-2018:0676-1: moderate: Recommended update for gcc7
by maintenance＠opensuse.org 14 Mar '18

14 Mar '18

openSUSE Recommended Update: Recommended update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0676-1 Rating: moderate References: #1074621 #1083290 #1083946 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gcc7 to 7.3 contains a number of fixes and improvements. The following features were added: Mitigations for Spectre Variant 2: - retpoline support via -mindirect-branch=, -mfunction-return= and friends was added which can be used to mitigate Spectre Variant 2.2. This feature was implemented for x86 (bnc#1074621) and also for the IBM Z platform (bnc#1083946). The following issues were fixed: - nvptx offload target compiler install issues - newlib parts split into cross-nvptx-newlib7-devel - Chromium build failures (bnc#1083290) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-251=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp7-7.3.1+r258313-6.1 cpp7-debuginfo-7.3.1+r258313-6.1 gcc7-7.3.1+r258313-6.1 gcc7-ada-7.3.1+r258313-6.1 gcc7-ada-debuginfo-7.3.1+r258313-6.1 gcc7-c++-7.3.1+r258313-6.1 gcc7-c++-debuginfo-7.3.1+r258313-6.1 gcc7-debuginfo-7.3.1+r258313-6.1 gcc7-debugsource-7.3.1+r258313-6.1 gcc7-fortran-7.3.1+r258313-6.1 gcc7-fortran-debuginfo-7.3.1+r258313-6.1 gcc7-go-7.3.1+r258313-6.1 gcc7-go-debuginfo-7.3.1+r258313-6.1 gcc7-locale-7.3.1+r258313-6.1 gcc7-obj-c++-7.3.1+r258313-6.1 gcc7-obj-c++-debuginfo-7.3.1+r258313-6.1 gcc7-objc-7.3.1+r258313-6.1 gcc7-objc-debuginfo-7.3.1+r258313-6.1 gcc7-testresults-7.3.1+r258313-6.1 libada7-7.3.1+r258313-6.1 libada7-debuginfo-7.3.1+r258313-6.1 libasan4-7.3.1+r258313-6.1 libasan4-debuginfo-7.3.1+r258313-6.1 libatomic1-7.3.1+r258313-6.1 libatomic1-debuginfo-7.3.1+r258313-6.1 libcilkrts5-7.3.1+r258313-6.1 libcilkrts5-debuginfo-7.3.1+r258313-6.1 libgcc_s1-7.3.1+r258313-6.1 libgcc_s1-debuginfo-7.3.1+r258313-6.1 libgfortran4-7.3.1+r258313-6.1 libgfortran4-debuginfo-7.3.1+r258313-6.1 libgo11-7.3.1+r258313-6.1 libgo11-debuginfo-7.3.1+r258313-6.1 libgomp1-7.3.1+r258313-6.1 libgomp1-debuginfo-7.3.1+r258313-6.1 libitm1-7.3.1+r258313-6.1 libitm1-debuginfo-7.3.1+r258313-6.1 libmpx2-7.3.1+r258313-6.1 libmpx2-debuginfo-7.3.1+r258313-6.1 libmpxwrappers2-7.3.1+r258313-6.1 libmpxwrappers2-debuginfo-7.3.1+r258313-6.1 libobjc4-gcc7-7.3.1+r258313-6.1 libobjc4-gcc7-debuginfo-7.3.1+r258313-6.1 libquadmath0-7.3.1+r258313-6.1 libquadmath0-debuginfo-7.3.1+r258313-6.1 libstdc++6-7.3.1+r258313-6.1 libstdc++6-debuginfo-7.3.1+r258313-6.1 libstdc++6-devel-gcc7-7.3.1+r258313-6.1 libstdc++6-locale-7.3.1+r258313-6.1 libubsan0-7.3.1+r258313-6.1 libubsan0-debuginfo-7.3.1+r258313-6.1 - openSUSE Leap 42.3 (noarch): gcc7-info-7.3.1+r258313-6.1 - openSUSE Leap 42.3 (x86_64): cross-nvptx-gcc7-7.3.1+r258313-6.1 cross-nvptx-newlib7-devel-7.3.1+r258313-6.1 gcc7-32bit-7.3.1+r258313-6.1 gcc7-ada-32bit-7.3.1+r258313-6.1 gcc7-c++-32bit-7.3.1+r258313-6.1 gcc7-fortran-32bit-7.3.1+r258313-6.1 gcc7-go-32bit-7.3.1+r258313-6.1 gcc7-obj-c++-32bit-7.3.1+r258313-6.1 gcc7-objc-32bit-7.3.1+r258313-6.1 libada7-32bit-7.3.1+r258313-6.1 libada7-32bit-debuginfo-7.3.1+r258313-6.1 libasan4-32bit-7.3.1+r258313-6.1 libasan4-32bit-debuginfo-7.3.1+r258313-6.1 libatomic1-32bit-7.3.1+r258313-6.1 libatomic1-32bit-debuginfo-7.3.1+r258313-6.1 libcilkrts5-32bit-7.3.1+r258313-6.1 libcilkrts5-32bit-debuginfo-7.3.1+r258313-6.1 libgcc_s1-32bit-7.3.1+r258313-6.1 libgcc_s1-32bit-debuginfo-7.3.1+r258313-6.1 libgfortran4-32bit-7.3.1+r258313-6.1 libgfortran4-32bit-debuginfo-7.3.1+r258313-6.1 libgo11-32bit-7.3.1+r258313-6.1 libgo11-32bit-debuginfo-7.3.1+r258313-6.1 libgomp1-32bit-7.3.1+r258313-6.1 libgomp1-32bit-debuginfo-7.3.1+r258313-6.1 libitm1-32bit-7.3.1+r258313-6.1 libitm1-32bit-debuginfo-7.3.1+r258313-6.1 liblsan0-7.3.1+r258313-6.1 liblsan0-debuginfo-7.3.1+r258313-6.1 libmpx2-32bit-7.3.1+r258313-6.1 libmpx2-32bit-debuginfo-7.3.1+r258313-6.1 libmpxwrappers2-32bit-7.3.1+r258313-6.1 libmpxwrappers2-32bit-debuginfo-7.3.1+r258313-6.1 libobjc4-gcc7-32bit-7.3.1+r258313-6.1 libobjc4-gcc7-32bit-debuginfo-7.3.1+r258313-6.1 libquadmath0-32bit-7.3.1+r258313-6.1 libquadmath0-32bit-debuginfo-7.3.1+r258313-6.1 libstdc++6-32bit-7.3.1+r258313-6.1 libstdc++6-32bit-debuginfo-7.3.1+r258313-6.1 libstdc++6-devel-gcc7-32bit-7.3.1+r258313-6.1 libtsan0-7.3.1+r258313-6.1 libtsan0-debuginfo-7.3.1+r258313-6.1 libubsan0-32bit-7.3.1+r258313-6.1 libubsan0-32bit-debuginfo-7.3.1+r258313-6.1 References: https://bugzilla.suse.com/1074621 https://bugzilla.suse.com/1083290 https://bugzilla.suse.com/1083946

1 0

openSUSE-SU-2018:0668-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 13 Mar '18

13 Mar '18

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0668-1 Rating: moderate References: #1081556 Cross-References: CVE-2017-12133 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following issues: - CVE-2017-12133: Avoid use-after-free read access in clntudp_call (bsc#1081556) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-250=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 i686 x86_64): glibc-2.22-16.3 glibc-debuginfo-2.22-16.3 glibc-debugsource-2.22-16.3 glibc-devel-2.22-16.3 glibc-devel-debuginfo-2.22-16.3 glibc-devel-static-2.22-16.3 glibc-locale-2.22-16.3 glibc-locale-debuginfo-2.22-16.3 glibc-profile-2.22-16.3 - openSUSE Leap 42.3 (i586 x86_64): glibc-extra-2.22-16.3 glibc-extra-debuginfo-2.22-16.3 glibc-utils-2.22-16.3 glibc-utils-debuginfo-2.22-16.3 glibc-utils-debugsource-2.22-16.3 nscd-2.22-16.3 nscd-debuginfo-2.22-16.3 - openSUSE Leap 42.3 (x86_64): glibc-32bit-2.22-16.3 glibc-debuginfo-32bit-2.22-16.3 glibc-devel-32bit-2.22-16.3 glibc-devel-debuginfo-32bit-2.22-16.3 glibc-devel-static-32bit-2.22-16.3 glibc-locale-32bit-2.22-16.3 glibc-locale-debuginfo-32bit-2.22-16.3 glibc-profile-32bit-2.22-16.3 glibc-utils-32bit-2.22-16.3 glibc-utils-debuginfo-32bit-2.22-16.3 - openSUSE Leap 42.3 (noarch): glibc-html-2.22-16.3 glibc-i18ndata-2.22-16.3 glibc-info-2.22-16.3 References: https://www.suse.com/security/cve/CVE-2017-12133.html https://bugzilla.suse.com/1081556

1 0

openSUSE-SU-2018:0667-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 13 Mar '18

13 Mar '18

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0667-1 Rating: moderate References: #1081294 Cross-References: CVE-2018-7169 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadow fixes the following issues: - CVE-2018-7169: Fixed an privilege escalation in newgidmap, which allowed an unprivileged user to be placed in a user namespace where setgroups(2) is allowed. (bsc#1081294) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-249=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): shadow-4.2.1-13.1 shadow-debuginfo-4.2.1-13.1 shadow-debugsource-4.2.1-13.1 References: https://www.suse.com/security/cve/CVE-2018-7169.html https://bugzilla.suse.com/1081294

1 0

openSUSE-SU-2018:0666-1: moderate: Security update for mysql-connector-java
by opensuse-security＠opensuse.org 13 Mar '18

13 Mar '18

openSUSE Security Update: Security update for mysql-connector-java ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0666-1 Rating: moderate References: #1035210 #1035211 #1035697 Cross-References: CVE-2017-3523 CVE-2017-3586 CVE-2017-3589 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mysql-connector-java to version to 5.1.42 fixes several issues. These security issues were fixed: - CVE-2017-3589: An unspecified vulnerability in MySQL Connector/J could have resulted in unauthorized update, insert or delete access to some of MySQL Connectors accessible data (bnc#1035210) - CVE-2017-3523: An unspecified vulnerability in MySQL Connector/J could have lead to takeover of MySQL Connectors (bnc#1035697) - CVE-2017-3586: An unspecified vulnerability in MySQL Connectors could have lead to unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data (bnc#1035211) More infos are available at http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-248=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): mysql-connector-java-5.1.42-10.3.1 References: https://www.suse.com/security/cve/CVE-2017-3523.html https://www.suse.com/security/cve/CVE-2017-3586.html https://www.suse.com/security/cve/CVE-2017-3589.html https://bugzilla.suse.com/1035210 https://bugzilla.suse.com/1035211 https://bugzilla.suse.com/1035697

1 0

openSUSE-RU-2018:0659-1: moderate: Recommended update for evolution, evolution-data-server
by maintenance＠opensuse.org 10 Mar '18

10 Mar '18

openSUSE Recommended Update: Recommended update for evolution, evolution-data-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0659-1 Rating: moderate References: #1071124 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for evolution and evolution-data-server provides fixes and enhancements. evolution (update to version 3.22.6): - Selected days drawn with incorrect color. - Don't preserve 'Pre-formatted' format if moving an empty block out of the quoted content. - Possible crash while refreshing spellcheck. - Print the history stack after removing item from it. - History could be saved twice if inserting HTML content. - Print current EEditorWebExtension method if CAMEL_DEBUG is active. - Previous signatures with images not sent properly. - Fix few memory leaks. - Do not override variable name from parent block. - Updated translations. evolution-data-server (update to version 3.22.7): - Ignore errors when getting message for a body-contains search. - Fix a ref/unref imbalance of CamelIMAPXStoreInfo. - Fix a memory leak in camel_imapx_server_append_message_sync(). - Unable to add additional Google calendar. - Avoid unneeded full flags folder update when no changes made. - Correct new module detection when installed by file rename. - Avoid call of g_debug() in the fork process. - Replace deprecated icalproperty_remove_parameter() with icalproperty_remove_parameter_by_kind(). - Replace deprecated icaltime_from_timet() with icaltime_from_timet_with_zone(). - Fix a memory leak. - Local flag changes could be missed and left unsaved on the server. - Notify about new messages early during folder update. - Fix possible use-after-free in CamelVeeFolder with parent_vee_store. - Test for parent_store availability around camel_folder_changed(). - Avoid crash when untagged response doesn't have a token. - Internal Google OAuth2 authentication fails with expired token. - Fix console runtime warnings from vFolder/vStore code on application quit. - Fix build with --disable-google-auth. - Folder summary can be leaked after its folder is freed. - Drop unused 'Deletes' table from folders.db. - Incorrect times provided in e_cal_recur_generate_instances(). - Port to WebKit2. - Junk check fails due to empty cache file. - Always build ESExp structure as a GObject descendant. - Correct version number reference in a developer comment. - Build developer documentation sections and types on the fly. - Default to "Leave messages on server" for new POP3 accounts. - Possible deadlock in camel_imapx_server_stop_idle_sync(). - Possible use-after-free on factory subprocess close. - Add error checks around factory subprocess backend loading. - 'STARTTLS not supported' error ignored. - Instead of query for UID, try to get the object directly. - Backend not initialized when asked to authenticate. - Add default folder names as iCloud provides them. - Release idle_lock before disconnecting the cancellable. - Crash under imapx_server_info_changed_cb(). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-245=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): evolution-data-server-3.22.7-7.3.1 evolution-data-server-debuginfo-3.22.7-7.3.1 evolution-data-server-debugsource-3.22.7-7.3.1 evolution-data-server-devel-3.22.7-7.3.1 evolution-data-server-doc-3.22.7-7.3.1 gnome-autoar-debugsource-0.2.2-2.1 gnome-autoar-devel-0.2.2-2.1 libcamel-1_2-59-3.22.7-7.3.1 libcamel-1_2-59-debuginfo-3.22.7-7.3.1 libebackend-1_2-10-3.22.7-7.3.1 libebackend-1_2-10-debuginfo-3.22.7-7.3.1 libebook-1_2-16-3.22.7-7.3.1 libebook-1_2-16-debuginfo-3.22.7-7.3.1 libebook-contacts-1_2-2-3.22.7-7.3.1 libebook-contacts-1_2-2-debuginfo-3.22.7-7.3.1 libecal-1_2-19-3.22.7-7.3.1 libecal-1_2-19-debuginfo-3.22.7-7.3.1 libedata-book-1_2-25-3.22.7-7.3.1 libedata-book-1_2-25-debuginfo-3.22.7-7.3.1 libedata-cal-1_2-28-3.22.7-7.3.1 libedata-cal-1_2-28-debuginfo-3.22.7-7.3.1 libedataserver-1_2-22-3.22.7-7.3.1 libedataserver-1_2-22-debuginfo-3.22.7-7.3.1 libedataserverui-1_2-1-3.22.7-7.3.1 libedataserverui-1_2-1-debuginfo-3.22.7-7.3.1 libgnome-autoar-0-0-0.2.2-2.1 libgnome-autoar-0-0-debuginfo-0.2.2-2.1 libgnome-autoar-gtk-0-0-0.2.2-2.1 libgnome-autoar-gtk-0-0-debuginfo-0.2.2-2.1 typelib-1_0-EBook-1_2-3.22.7-7.3.1 typelib-1_0-EBookContacts-1_2-3.22.7-7.3.1 typelib-1_0-EDataServer-1_2-3.22.7-7.3.1 typelib-1_0-GnomeAutoar-0_1-0.2.2-2.1 typelib-1_0-GnomeAutoarGtk-0_1-0.2.2-2.1 - openSUSE Leap 42.3 (x86_64): evolution-3.22.6-5.3.1 evolution-data-server-32bit-3.22.7-7.3.1 evolution-data-server-debuginfo-32bit-3.22.7-7.3.1 evolution-debuginfo-3.22.6-5.3.1 evolution-debugsource-3.22.6-5.3.1 evolution-devel-3.22.6-5.3.1 evolution-plugin-bogofilter-3.22.6-5.3.1 evolution-plugin-bogofilter-debuginfo-3.22.6-5.3.1 evolution-plugin-pst-import-3.22.6-5.3.1 evolution-plugin-pst-import-debuginfo-3.22.6-5.3.1 evolution-plugin-spamassassin-3.22.6-5.3.1 evolution-plugin-spamassassin-debuginfo-3.22.6-5.3.1 glade-catalog-evolution-3.22.6-5.3.1 glade-catalog-evolution-debuginfo-3.22.6-5.3.1 libcamel-1_2-59-32bit-3.22.7-7.3.1 libcamel-1_2-59-debuginfo-32bit-3.22.7-7.3.1 libebackend-1_2-10-32bit-3.22.7-7.3.1 libebackend-1_2-10-debuginfo-32bit-3.22.7-7.3.1 libebook-1_2-16-32bit-3.22.7-7.3.1 libebook-1_2-16-debuginfo-32bit-3.22.7-7.3.1 libebook-contacts-1_2-2-32bit-3.22.7-7.3.1 libebook-contacts-1_2-2-debuginfo-32bit-3.22.7-7.3.1 libecal-1_2-19-32bit-3.22.7-7.3.1 libecal-1_2-19-debuginfo-32bit-3.22.7-7.3.1 libedata-book-1_2-25-32bit-3.22.7-7.3.1 libedata-book-1_2-25-debuginfo-32bit-3.22.7-7.3.1 libedata-cal-1_2-28-32bit-3.22.7-7.3.1 libedata-cal-1_2-28-debuginfo-32bit-3.22.7-7.3.1 libedataserver-1_2-22-32bit-3.22.7-7.3.1 libedataserver-1_2-22-debuginfo-32bit-3.22.7-7.3.1 libedataserverui-1_2-1-32bit-3.22.7-7.3.1 libedataserverui-1_2-1-debuginfo-32bit-3.22.7-7.3.1 - openSUSE Leap 42.3 (noarch): evolution-data-server-lang-3.22.7-7.3.1 evolution-lang-3.22.6-5.3.1 References: https://bugzilla.suse.com/1071124

1 0

openSUSE-RU-2018:0658-1: Recommended update for yast2-drbd
by maintenance＠opensuse.org 10 Mar '18

10 Mar '18

openSUSE Recommended Update: Recommended update for yast2-drbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0658-1 Rating: low References: #1069131 #1069132 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-drbd fixes the following issues: - Fix error message when writing resource conf to disk (bsc#1069131, bsc#1069132) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-246=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): yast2-drbd-3.3.0-4.3.1 References: https://bugzilla.suse.com/1069131 https://bugzilla.suse.com/1069132

1 0

openSUSE-SU-2018:0657-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 10 Mar '18

10 Mar '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0657-1 Rating: moderate References: #1076970 #1083639 Cross-References: CVE-2018-7584 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for php7 provides the following fix: Security issues fixed: - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex (bsc#1083639). Bug fixes: - Fix a memory leak in the pg_escape_bytea function of the pgsql extension. (bsc#1076970) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-244=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-31.1 apache2-mod_php7-debuginfo-7.0.7-31.1 php7-7.0.7-31.1 php7-bcmath-7.0.7-31.1 php7-bcmath-debuginfo-7.0.7-31.1 php7-bz2-7.0.7-31.1 php7-bz2-debuginfo-7.0.7-31.1 php7-calendar-7.0.7-31.1 php7-calendar-debuginfo-7.0.7-31.1 php7-ctype-7.0.7-31.1 php7-ctype-debuginfo-7.0.7-31.1 php7-curl-7.0.7-31.1 php7-curl-debuginfo-7.0.7-31.1 php7-dba-7.0.7-31.1 php7-dba-debuginfo-7.0.7-31.1 php7-debuginfo-7.0.7-31.1 php7-debugsource-7.0.7-31.1 php7-devel-7.0.7-31.1 php7-dom-7.0.7-31.1 php7-dom-debuginfo-7.0.7-31.1 php7-enchant-7.0.7-31.1 php7-enchant-debuginfo-7.0.7-31.1 php7-exif-7.0.7-31.1 php7-exif-debuginfo-7.0.7-31.1 php7-fastcgi-7.0.7-31.1 php7-fastcgi-debuginfo-7.0.7-31.1 php7-fileinfo-7.0.7-31.1 php7-fileinfo-debuginfo-7.0.7-31.1 php7-firebird-7.0.7-31.1 php7-firebird-debuginfo-7.0.7-31.1 php7-fpm-7.0.7-31.1 php7-fpm-debuginfo-7.0.7-31.1 php7-ftp-7.0.7-31.1 php7-ftp-debuginfo-7.0.7-31.1 php7-gd-7.0.7-31.1 php7-gd-debuginfo-7.0.7-31.1 php7-gettext-7.0.7-31.1 php7-gettext-debuginfo-7.0.7-31.1 php7-gmp-7.0.7-31.1 php7-gmp-debuginfo-7.0.7-31.1 php7-iconv-7.0.7-31.1 php7-iconv-debuginfo-7.0.7-31.1 php7-imap-7.0.7-31.1 php7-imap-debuginfo-7.0.7-31.1 php7-intl-7.0.7-31.1 php7-intl-debuginfo-7.0.7-31.1 php7-json-7.0.7-31.1 php7-json-debuginfo-7.0.7-31.1 php7-ldap-7.0.7-31.1 php7-ldap-debuginfo-7.0.7-31.1 php7-mbstring-7.0.7-31.1 php7-mbstring-debuginfo-7.0.7-31.1 php7-mcrypt-7.0.7-31.1 php7-mcrypt-debuginfo-7.0.7-31.1 php7-mysql-7.0.7-31.1 php7-mysql-debuginfo-7.0.7-31.1 php7-odbc-7.0.7-31.1 php7-odbc-debuginfo-7.0.7-31.1 php7-opcache-7.0.7-31.1 php7-opcache-debuginfo-7.0.7-31.1 php7-openssl-7.0.7-31.1 php7-openssl-debuginfo-7.0.7-31.1 php7-pcntl-7.0.7-31.1 php7-pcntl-debuginfo-7.0.7-31.1 php7-pdo-7.0.7-31.1 php7-pdo-debuginfo-7.0.7-31.1 php7-pgsql-7.0.7-31.1 php7-pgsql-debuginfo-7.0.7-31.1 php7-phar-7.0.7-31.1 php7-phar-debuginfo-7.0.7-31.1 php7-posix-7.0.7-31.1 php7-posix-debuginfo-7.0.7-31.1 php7-pspell-7.0.7-31.1 php7-pspell-debuginfo-7.0.7-31.1 php7-readline-7.0.7-31.1 php7-readline-debuginfo-7.0.7-31.1 php7-shmop-7.0.7-31.1 php7-shmop-debuginfo-7.0.7-31.1 php7-snmp-7.0.7-31.1 php7-snmp-debuginfo-7.0.7-31.1 php7-soap-7.0.7-31.1 php7-soap-debuginfo-7.0.7-31.1 php7-sockets-7.0.7-31.1 php7-sockets-debuginfo-7.0.7-31.1 php7-sqlite-7.0.7-31.1 php7-sqlite-debuginfo-7.0.7-31.1 php7-sysvmsg-7.0.7-31.1 php7-sysvmsg-debuginfo-7.0.7-31.1 php7-sysvsem-7.0.7-31.1 php7-sysvsem-debuginfo-7.0.7-31.1 php7-sysvshm-7.0.7-31.1 php7-sysvshm-debuginfo-7.0.7-31.1 php7-tidy-7.0.7-31.1 php7-tidy-debuginfo-7.0.7-31.1 php7-tokenizer-7.0.7-31.1 php7-tokenizer-debuginfo-7.0.7-31.1 php7-wddx-7.0.7-31.1 php7-wddx-debuginfo-7.0.7-31.1 php7-xmlreader-7.0.7-31.1 php7-xmlreader-debuginfo-7.0.7-31.1 php7-xmlrpc-7.0.7-31.1 php7-xmlrpc-debuginfo-7.0.7-31.1 php7-xmlwriter-7.0.7-31.1 php7-xmlwriter-debuginfo-7.0.7-31.1 php7-xsl-7.0.7-31.1 php7-xsl-debuginfo-7.0.7-31.1 php7-zip-7.0.7-31.1 php7-zip-debuginfo-7.0.7-31.1 php7-zlib-7.0.7-31.1 php7-zlib-debuginfo-7.0.7-31.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-31.1 php7-pear-Archive_Tar-7.0.7-31.1 References: https://www.suse.com/security/cve/CVE-2018-7584.html https://bugzilla.suse.com/1076970 https://bugzilla.suse.com/1083639

1 0

openSUSE-SU-2018:0651-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0651-1 Rating: moderate References: Cross-References: CVE-2018-7536 CVE-2018-7537 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-Django fixes the following issues: Update to 1.11.11 * Fixes CVE-2018-7536, CVE-2018-7537 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-243=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Django-1.11.11-8.1 References: https://www.suse.com/security/cve/CVE-2018-7536.html https://www.suse.com/security/cve/CVE-2018-7537.html

1 0

openSUSE-RU-2018:0649-1: moderate: Recommended update for yast2, yast2-nfs-client, yast2-services-manager
by maintenance＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Recommended Update: Recommended update for yast2, yast2-nfs-client, yast2-services-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0649-1 Rating: moderate References: #1037214 #1037891 #1045658 #1049138 #1058376 #1061306 #1064437 #1075535 #1077310 #956755 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for yast2, yast2-nfs-client and yast2-services-manager provides fixes and enhancements: - Use fewer calls to systemctl to speed up startup. (bsc#1045658) - Implement performance enhancements for handling systemd services. (bsc#1045658) - Add YaST2 logs to the default list of files for System Log browser. (bsc#1049138) - Fix the name and icon displayed for the application window. (bsc#1037891) - Improve the logic to report if SuSEfirewall2 is selected or installed when installing OES using integrated media to make sure it gets properly activated. The problem would happen once the product is registered and manual network configuration is selected. (bsc#1037214) - Fix storing device information to avoid incorrect "not found" states when querying network interfaces subsequently. (bsc#956755, bsc#1061306) - Add infrastructure to preserve existing comments in configuration files. (bsc#1064437) - Preserve comments when editing /etc/fstab. (bsc#1064437) - Fix starting Gnome Control Center. (bsc#1058376, bsc#1075535) - Fixed list of the URL schemes without host and fix processing URLs with the "hd:/" scheme. (bsc#1077310) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-241=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-3.2.43-2.3.1 - openSUSE Leap 42.3 (noarch): yast2-nfs-client-3.1.18-4.3.1 yast2-services-manager-3.2.2-2.3.1 References: https://bugzilla.suse.com/1037214 https://bugzilla.suse.com/1037891 https://bugzilla.suse.com/1045658 https://bugzilla.suse.com/1049138 https://bugzilla.suse.com/1058376 https://bugzilla.suse.com/1061306 https://bugzilla.suse.com/1064437 https://bugzilla.suse.com/1075535 https://bugzilla.suse.com/1077310 https://bugzilla.suse.com/956755

1 0

openSUSE-RU-2018:0648-1: moderate: Recommended update for monitoring-plugins-zypper
by maintenance＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Recommended Update: Recommended update for monitoring-plugins-zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0648-1 Rating: moderate References: #1006387 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monitoring-plugins-zypper fixes the following issues: - boo#1006387: The package removed AppArmor protection from running processes during installation/upgrade This update also updates the list of openSUSE distribution releases considered as maintained. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-242=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): monitoring-plugins-zypper-1.95-8.1 References: https://bugzilla.suse.com/1006387

1 0

openSUSE-SU-2018:0647-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0647-1 Rating: moderate References: #1077003 #1077006 Cross-References: CVE-2018-1000024 CVE-2018-1000027 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for squid fixes the following issues: Security issues fixed: - CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI responses. This affects the default custom esi_parser (bsc#1077003). - CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI responses or downloading intermediate CA certificates (bsc#1077006). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-238=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): squid-3.5.21-12.1 squid-debuginfo-3.5.21-12.1 squid-debugsource-3.5.21-12.1 References: https://www.suse.com/security/cve/CVE-2018-1000024.html https://www.suse.com/security/cve/CVE-2018-1000027.html https://bugzilla.suse.com/1077003 https://bugzilla.suse.com/1077006

1 0

openSUSE-RU-2018:0644-1: Recommended update for libyui-qt
by maintenance＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Recommended Update: Recommended update for libyui-qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0644-1 Rating: low References: #1074596 #1077991 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libyui-qt provides the following fix: - Prevent a segmentation fault if an open dialog is left over. Don't do anything widget related after the QApplication is destroyed, in particular not deleting other widgets, even if indirectly via YDialog::deleteAllDialogs() in YUI. (bsc#1074596, bsc#1077991) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-240=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libyui-qt-debugsource-2.47.1.1-2.3.1 libyui-qt-devel-2.47.1.1-2.3.1 libyui-qt7-2.47.1.1-2.3.1 libyui-qt7-debuginfo-2.47.1.1-2.3.1 - openSUSE Leap 42.3 (noarch): libyui-qt-doc-2.47.1.1-2.3.1 References: https://bugzilla.suse.com/1074596 https://bugzilla.suse.com/1077991

1 0

openSUSE-SU-2018:0643-1: moderate: Security update for rsync
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0643-1 Rating: moderate References: #1076503 Cross-References: CVE-2018-5764 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsync fixes one issues. This security issue was fixed: - CVE-2018-5764: The parse_arguments function in options.c did not prevent multiple --protect-args uses, which allowed remote attackers to bypass an argument-sanitization protection mechanism (bsc#1076503). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-237=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rsync-3.1.0-13.1 rsync-debuginfo-3.1.0-13.1 rsync-debugsource-3.1.0-13.1 References: https://www.suse.com/security/cve/CVE-2018-5764.html https://bugzilla.suse.com/1076503

1 0

openSUSE-SU-2018:0642-1: moderate: Security update for shotwell
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for shotwell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0642-1 Rating: moderate References: #1054311 Cross-References: CVE-2017-1000024 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shotwell fixes the following issues: Security issue fixed: - CVE-2017-1000024: Use HTTPS encryption all over the publishing plugins (bsc#1054311). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-239=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): shotwell-0.22.0+git.20160103-16.1 shotwell-debuginfo-0.22.0+git.20160103-16.1 shotwell-debugsource-0.22.0+git.20160103-16.1 - openSUSE Leap 42.3 (noarch): shotwell-lang-0.22.0+git.20160103-16.1 References: https://www.suse.com/security/cve/CVE-2017-1000024.html https://bugzilla.suse.com/1054311

1 0

openSUSE-SU-2018:0632-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0632-1 Rating: moderate References: #1077714 Cross-References: CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-6188 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for python-Django fixes the following issues: Update to version 1.11.10 LTS * Fixes CVE-2018-6188 boo#1077714, CVE-2017-7234, CVE-2017-7233, CVE-2017-12794 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-236=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Django-1.11.10-5.1 References: https://www.suse.com/security/cve/CVE-2017-12794.html https://www.suse.com/security/cve/CVE-2017-7233.html https://www.suse.com/security/cve/CVE-2017-7234.html https://www.suse.com/security/cve/CVE-2018-6188.html https://bugzilla.suse.com/1077714

1 0

openSUSE-SU-2018:0629-1: moderate: Security update for go1.8
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Security Update: Security update for go1.8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0629-1 Rating: moderate References: #1080006 #1082409 Cross-References: CVE-2018-6574 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.8 fixes the following issues: Security issues fixed: - CVE-2018-6574: "go get" allows for remote command execution during source code build (bsc#1080006). Bug fixes: - bsc#1082409: Review dependencies (requires, recommends and supports) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-235=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go1.8-1.8.7-5.1 go1.8-debuginfo-1.8.7-5.1 go1.8-debugsource-1.8.7-5.1 go1.8-doc-1.8.7-5.1 go1.8-race-1.8.7-5.1 References: https://www.suse.com/security/cve/CVE-2018-6574.html https://bugzilla.suse.com/1080006 https://bugzilla.suse.com/1082409

1 0

openSUSE-SU-2018:0628-1: moderate: Security update for go1.8
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Security Update: Security update for go1.8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0628-1 Rating: moderate References: #1080006 #1082409 Cross-References: CVE-2018-6574 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.8 fixes the following issues: Security issues fixed: - CVE-2018-6574: "go get" allows for remote command execution during source code build (bsc#1080006). Bug fixes: - bsc#1082409: Review dependencies (requires, recommends and supports) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-235=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): go1.8-1.8.7-5.1 go1.8-debuginfo-1.8.7-5.1 go1.8-debugsource-1.8.7-5.1 go1.8-doc-1.8.7-5.1 - openSUSE Leap 42.3 (x86_64): go1.8-race-1.8.7-5.1 References: https://www.suse.com/security/cve/CVE-2018-6574.html https://bugzilla.suse.com/1080006 https://bugzilla.suse.com/1082409

1 0

openSUSE-RU-2018:0627-1: Recommended update for grub2
by maintenance＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0627-1 Rating: low References: #1065349 #1071239 #1079330 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for grub2 provides the following fixes: - Check if the default entry needs to be corrected for updated distributor version and/or use fallback entry if the default kernel entry was removed. (bsc#1065349) - Fix grub2-mkconfig warning when disk is a LVM PV. (bsc#1071239) - Fix unquoted string errors and add some more checks. (bsc#1079330) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): grub2-2.02-7.1 grub2-branding-upstream-2.02-7.1 grub2-debuginfo-2.02-7.1 grub2-debugsource-2.02-7.1 grub2-i386-pc-2.02-7.1 - openSUSE Leap 42.3 (noarch): grub2-snapper-plugin-2.02-7.1 grub2-systemd-sleep-plugin-2.02-7.1 - openSUSE Leap 42.3 (x86_64): grub2-x86_64-efi-2.02-7.1 grub2-x86_64-xen-2.02-7.1 - openSUSE Leap 42.3 (i586): grub2-i386-efi-2.02-7.1 References: https://bugzilla.suse.com/1065349 https://bugzilla.suse.com/1071239 https://bugzilla.suse.com/1079330

1 0

openSUSE-RU-2018:0626-1: moderate: Recommended update for mpg123
by maintenance＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Recommended Update: Recommended update for mpg123 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0626-1 Rating: moderate References: #1083992 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mpg123 to version 1.25.10 fixes the following issues: - The library may have crashed on broken or specially crafted files (boo#1083992) The 1.25.10 release also contains a number of upstream bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-232=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmpg123-0-1.25.10-13.1 libmpg123-0-debuginfo-1.25.10-13.1 libout123-0-1.25.10-13.1 libout123-0-debuginfo-1.25.10-13.1 mpg123-1.25.10-13.1 mpg123-debuginfo-1.25.10-13.1 mpg123-debugsource-1.25.10-13.1 mpg123-devel-1.25.10-13.1 mpg123-esound-1.25.10-13.1 mpg123-esound-debuginfo-1.25.10-13.1 mpg123-jack-1.25.10-13.1 mpg123-jack-debuginfo-1.25.10-13.1 mpg123-openal-1.25.10-13.1 mpg123-openal-debuginfo-1.25.10-13.1 mpg123-portaudio-1.25.10-13.1 mpg123-portaudio-debuginfo-1.25.10-13.1 mpg123-pulse-1.25.10-13.1 mpg123-pulse-debuginfo-1.25.10-13.1 mpg123-sdl-1.25.10-13.1 mpg123-sdl-debuginfo-1.25.10-13.1 - openSUSE Leap 42.3 (x86_64): libmpg123-0-32bit-1.25.10-13.1 libmpg123-0-debuginfo-32bit-1.25.10-13.1 libout123-0-32bit-1.25.10-13.1 libout123-0-debuginfo-32bit-1.25.10-13.1 mpg123-devel-32bit-1.25.10-13.1 mpg123-esound-32bit-1.25.10-13.1 mpg123-esound-debuginfo-32bit-1.25.10-13.1 mpg123-jack-32bit-1.25.10-13.1 mpg123-jack-debuginfo-32bit-1.25.10-13.1 mpg123-openal-32bit-1.25.10-13.1 mpg123-openal-debuginfo-32bit-1.25.10-13.1 mpg123-portaudio-32bit-1.25.10-13.1 mpg123-portaudio-debuginfo-32bit-1.25.10-13.1 mpg123-pulse-32bit-1.25.10-13.1 mpg123-pulse-debuginfo-32bit-1.25.10-13.1 mpg123-sdl-32bit-1.25.10-13.1 mpg123-sdl-debuginfo-32bit-1.25.10-13.1 References: https://bugzilla.suse.com/1083992

1 0

openSUSE-RU-2018:0625-1: moderate: Recommended update for mpg123
by maintenance＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Recommended Update: Recommended update for mpg123 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0625-1 Rating: moderate References: #1083992 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mpg123 to version 1.25.10 fixes the following issues: - The library may have crashed on broken or specially crafted files (boo#1083992) The 1.25.10 release also contains a number of upstream bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-232=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libmpg123-0-1.25.10-5.1 libmpg123-0-debuginfo-1.25.10-5.1 libout123-0-1.25.10-5.1 libout123-0-debuginfo-1.25.10-5.1 mpg123-1.25.10-5.1 mpg123-debuginfo-1.25.10-5.1 mpg123-debugsource-1.25.10-5.1 mpg123-devel-1.25.10-5.1 mpg123-esound-1.25.10-5.1 mpg123-esound-debuginfo-1.25.10-5.1 mpg123-jack-1.25.10-5.1 mpg123-jack-debuginfo-1.25.10-5.1 mpg123-openal-1.25.10-5.1 mpg123-openal-debuginfo-1.25.10-5.1 mpg123-portaudio-1.25.10-5.1 mpg123-portaudio-debuginfo-1.25.10-5.1 mpg123-pulse-1.25.10-5.1 mpg123-pulse-debuginfo-1.25.10-5.1 mpg123-sdl-1.25.10-5.1 mpg123-sdl-debuginfo-1.25.10-5.1 References: https://bugzilla.suse.com/1083992

1 0