March 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0647-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0647-1 Rating: moderate References: #1077003 #1077006 Cross-References: CVE-2018-1000024 CVE-2018-1000027 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for squid fixes the following issues: Security issues fixed: - CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI responses. This affects the default custom esi_parser (bsc#1077003). - CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI responses or downloading intermediate CA certificates (bsc#1077006). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-238=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): squid-3.5.21-12.1 squid-debuginfo-3.5.21-12.1 squid-debugsource-3.5.21-12.1 References: https://www.suse.com/security/cve/CVE-2018-1000024.html https://www.suse.com/security/cve/CVE-2018-1000027.html https://bugzilla.suse.com/1077003 https://bugzilla.suse.com/1077006

1 0

openSUSE-RU-2018:0644-1: Recommended update for libyui-qt
by maintenance＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Recommended Update: Recommended update for libyui-qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0644-1 Rating: low References: #1074596 #1077991 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libyui-qt provides the following fix: - Prevent a segmentation fault if an open dialog is left over. Don't do anything widget related after the QApplication is destroyed, in particular not deleting other widgets, even if indirectly via YDialog::deleteAllDialogs() in YUI. (bsc#1074596, bsc#1077991) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-240=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libyui-qt-debugsource-2.47.1.1-2.3.1 libyui-qt-devel-2.47.1.1-2.3.1 libyui-qt7-2.47.1.1-2.3.1 libyui-qt7-debuginfo-2.47.1.1-2.3.1 - openSUSE Leap 42.3 (noarch): libyui-qt-doc-2.47.1.1-2.3.1 References: https://bugzilla.suse.com/1074596 https://bugzilla.suse.com/1077991

1 0

openSUSE-SU-2018:0643-1: moderate: Security update for rsync
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0643-1 Rating: moderate References: #1076503 Cross-References: CVE-2018-5764 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsync fixes one issues. This security issue was fixed: - CVE-2018-5764: The parse_arguments function in options.c did not prevent multiple --protect-args uses, which allowed remote attackers to bypass an argument-sanitization protection mechanism (bsc#1076503). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-237=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rsync-3.1.0-13.1 rsync-debuginfo-3.1.0-13.1 rsync-debugsource-3.1.0-13.1 References: https://www.suse.com/security/cve/CVE-2018-5764.html https://bugzilla.suse.com/1076503

1 0

openSUSE-SU-2018:0642-1: moderate: Security update for shotwell
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

openSUSE Security Update: Security update for shotwell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0642-1 Rating: moderate References: #1054311 Cross-References: CVE-2017-1000024 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shotwell fixes the following issues: Security issue fixed: - CVE-2017-1000024: Use HTTPS encryption all over the publishing plugins (bsc#1054311). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-239=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): shotwell-0.22.0+git.20160103-16.1 shotwell-debuginfo-0.22.0+git.20160103-16.1 shotwell-debugsource-0.22.0+git.20160103-16.1 - openSUSE Leap 42.3 (noarch): shotwell-lang-0.22.0+git.20160103-16.1 References: https://www.suse.com/security/cve/CVE-2017-1000024.html https://bugzilla.suse.com/1054311

1 0

openSUSE-SU-2018:0632-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0632-1 Rating: moderate References: #1077714 Cross-References: CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-6188 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for python-Django fixes the following issues: Update to version 1.11.10 LTS * Fixes CVE-2018-6188 boo#1077714, CVE-2017-7234, CVE-2017-7233, CVE-2017-12794 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-236=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Django-1.11.10-5.1 References: https://www.suse.com/security/cve/CVE-2017-12794.html https://www.suse.com/security/cve/CVE-2017-7233.html https://www.suse.com/security/cve/CVE-2017-7234.html https://www.suse.com/security/cve/CVE-2018-6188.html https://bugzilla.suse.com/1077714

1 0

openSUSE-SU-2018:0629-1: moderate: Security update for go1.8
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Security Update: Security update for go1.8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0629-1 Rating: moderate References: #1080006 #1082409 Cross-References: CVE-2018-6574 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.8 fixes the following issues: Security issues fixed: - CVE-2018-6574: "go get" allows for remote command execution during source code build (bsc#1080006). Bug fixes: - bsc#1082409: Review dependencies (requires, recommends and supports) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-235=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go1.8-1.8.7-5.1 go1.8-debuginfo-1.8.7-5.1 go1.8-debugsource-1.8.7-5.1 go1.8-doc-1.8.7-5.1 go1.8-race-1.8.7-5.1 References: https://www.suse.com/security/cve/CVE-2018-6574.html https://bugzilla.suse.com/1080006 https://bugzilla.suse.com/1082409

1 0

openSUSE-SU-2018:0628-1: moderate: Security update for go1.8
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Security Update: Security update for go1.8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0628-1 Rating: moderate References: #1080006 #1082409 Cross-References: CVE-2018-6574 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.8 fixes the following issues: Security issues fixed: - CVE-2018-6574: "go get" allows for remote command execution during source code build (bsc#1080006). Bug fixes: - bsc#1082409: Review dependencies (requires, recommends and supports) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-235=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): go1.8-1.8.7-5.1 go1.8-debuginfo-1.8.7-5.1 go1.8-debugsource-1.8.7-5.1 go1.8-doc-1.8.7-5.1 - openSUSE Leap 42.3 (x86_64): go1.8-race-1.8.7-5.1 References: https://www.suse.com/security/cve/CVE-2018-6574.html https://bugzilla.suse.com/1080006 https://bugzilla.suse.com/1082409

1 0

openSUSE-RU-2018:0627-1: Recommended update for grub2
by maintenance＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0627-1 Rating: low References: #1065349 #1071239 #1079330 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for grub2 provides the following fixes: - Check if the default entry needs to be corrected for updated distributor version and/or use fallback entry if the default kernel entry was removed. (bsc#1065349) - Fix grub2-mkconfig warning when disk is a LVM PV. (bsc#1071239) - Fix unquoted string errors and add some more checks. (bsc#1079330) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): grub2-2.02-7.1 grub2-branding-upstream-2.02-7.1 grub2-debuginfo-2.02-7.1 grub2-debugsource-2.02-7.1 grub2-i386-pc-2.02-7.1 - openSUSE Leap 42.3 (noarch): grub2-snapper-plugin-2.02-7.1 grub2-systemd-sleep-plugin-2.02-7.1 - openSUSE Leap 42.3 (x86_64): grub2-x86_64-efi-2.02-7.1 grub2-x86_64-xen-2.02-7.1 - openSUSE Leap 42.3 (i586): grub2-i386-efi-2.02-7.1 References: https://bugzilla.suse.com/1065349 https://bugzilla.suse.com/1071239 https://bugzilla.suse.com/1079330

1 0

openSUSE-RU-2018:0626-1: moderate: Recommended update for mpg123
by maintenance＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Recommended Update: Recommended update for mpg123 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0626-1 Rating: moderate References: #1083992 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mpg123 to version 1.25.10 fixes the following issues: - The library may have crashed on broken or specially crafted files (boo#1083992) The 1.25.10 release also contains a number of upstream bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-232=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmpg123-0-1.25.10-13.1 libmpg123-0-debuginfo-1.25.10-13.1 libout123-0-1.25.10-13.1 libout123-0-debuginfo-1.25.10-13.1 mpg123-1.25.10-13.1 mpg123-debuginfo-1.25.10-13.1 mpg123-debugsource-1.25.10-13.1 mpg123-devel-1.25.10-13.1 mpg123-esound-1.25.10-13.1 mpg123-esound-debuginfo-1.25.10-13.1 mpg123-jack-1.25.10-13.1 mpg123-jack-debuginfo-1.25.10-13.1 mpg123-openal-1.25.10-13.1 mpg123-openal-debuginfo-1.25.10-13.1 mpg123-portaudio-1.25.10-13.1 mpg123-portaudio-debuginfo-1.25.10-13.1 mpg123-pulse-1.25.10-13.1 mpg123-pulse-debuginfo-1.25.10-13.1 mpg123-sdl-1.25.10-13.1 mpg123-sdl-debuginfo-1.25.10-13.1 - openSUSE Leap 42.3 (x86_64): libmpg123-0-32bit-1.25.10-13.1 libmpg123-0-debuginfo-32bit-1.25.10-13.1 libout123-0-32bit-1.25.10-13.1 libout123-0-debuginfo-32bit-1.25.10-13.1 mpg123-devel-32bit-1.25.10-13.1 mpg123-esound-32bit-1.25.10-13.1 mpg123-esound-debuginfo-32bit-1.25.10-13.1 mpg123-jack-32bit-1.25.10-13.1 mpg123-jack-debuginfo-32bit-1.25.10-13.1 mpg123-openal-32bit-1.25.10-13.1 mpg123-openal-debuginfo-32bit-1.25.10-13.1 mpg123-portaudio-32bit-1.25.10-13.1 mpg123-portaudio-debuginfo-32bit-1.25.10-13.1 mpg123-pulse-32bit-1.25.10-13.1 mpg123-pulse-debuginfo-32bit-1.25.10-13.1 mpg123-sdl-32bit-1.25.10-13.1 mpg123-sdl-debuginfo-32bit-1.25.10-13.1 References: https://bugzilla.suse.com/1083992

1 0

openSUSE-RU-2018:0625-1: moderate: Recommended update for mpg123
by maintenance＠opensuse.org 07 Mar '18

07 Mar '18

openSUSE Recommended Update: Recommended update for mpg123 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0625-1 Rating: moderate References: #1083992 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mpg123 to version 1.25.10 fixes the following issues: - The library may have crashed on broken or specially crafted files (boo#1083992) The 1.25.10 release also contains a number of upstream bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-232=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libmpg123-0-1.25.10-5.1 libmpg123-0-debuginfo-1.25.10-5.1 libout123-0-1.25.10-5.1 libout123-0-debuginfo-1.25.10-5.1 mpg123-1.25.10-5.1 mpg123-debuginfo-1.25.10-5.1 mpg123-debugsource-1.25.10-5.1 mpg123-devel-1.25.10-5.1 mpg123-esound-1.25.10-5.1 mpg123-esound-debuginfo-1.25.10-5.1 mpg123-jack-1.25.10-5.1 mpg123-jack-debuginfo-1.25.10-5.1 mpg123-openal-1.25.10-5.1 mpg123-openal-debuginfo-1.25.10-5.1 mpg123-portaudio-1.25.10-5.1 mpg123-portaudio-debuginfo-1.25.10-5.1 mpg123-pulse-1.25.10-5.1 mpg123-pulse-debuginfo-1.25.10-5.1 mpg123-sdl-1.25.10-5.1 mpg123-sdl-debuginfo-1.25.10-5.1 References: https://bugzilla.suse.com/1083992

1 0