March 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0614-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 06 Mar '18

06 Mar '18

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0614-1 Rating: moderate References: #1083845 #1083846 Cross-References: CVE-2018-0490 CVE-2018-0491 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tor to version 0.3.2.10 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2018-0490: remote crash vulnerability against directory authorities (boo#1083845, TROVE-2018-001) - CVE-2018-0491: remote relay crash (boo#1083846, TROVE-2018-002) This new upstream stable version also contains a new system for improved resistance to DoS attacks against relays and various other bug fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-223=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): tor-0.3.2.10-15.1 tor-debuginfo-0.3.2.10-15.1 tor-debugsource-0.3.2.10-15.1 References: https://www.suse.com/security/cve/CVE-2018-0490.html https://www.suse.com/security/cve/CVE-2018-0491.html https://bugzilla.suse.com/1083845 https://bugzilla.suse.com/1083846

1 0

openSUSE-RU-2018:0606-1: moderate: Recommended update for itk
by maintenance＠opensuse.org 05 Mar '18

05 Mar '18

openSUSE Recommended Update: Recommended update for itk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0606-1 Rating: moderate References: #903017 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for itk fixes the following issues: - avoid a segmentation fault with Tcl/Tk 8.6.7 (boo#903017) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-222=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): itk-4.1.0-11.3.1 itk-debuginfo-4.1.0-11.3.1 itk-debugsource-4.1.0-11.3.1 References: https://bugzilla.suse.com/903017

1 0

openSUSE-RU-2018:0603-1: moderate: Recommended update for mozjs38
by maintenance＠opensuse.org 05 Mar '18

05 Mar '18

openSUSE Recommended Update: Recommended update for mozjs38 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0603-1 Rating: moderate References: #1082720 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mozjs38 fixes the following issues: - The package shipped a bundled zlib and header. Use system zlib and avoid conflicts when exposing a private header. boo#1082720 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-221=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmozjs-38-38.2.1-12.3.1 libmozjs-38-debuginfo-38.2.1-12.3.1 mozjs38-38.2.1-12.3.1 mozjs38-debuginfo-38.2.1-12.3.1 mozjs38-debugsource-38.2.1-12.3.1 mozjs38-devel-38.2.1-12.3.1 - openSUSE Leap 42.3 (x86_64): libmozjs-38-32bit-38.2.1-12.3.1 libmozjs-38-debuginfo-32bit-38.2.1-12.3.1 References: https://bugzilla.suse.com/1082720

1 0

openSUSE-RU-2018:0599-1: Recommended update for mvapich2
by maintenance＠opensuse.org 03 Mar '18

03 Mar '18

openSUSE Recommended Update: Recommended update for mvapich2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0599-1 Rating: low References: #1004628 #1045955 #934090 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for mvapich2 fixes the following issues: - Fix mvapich2-psm package to use libpsm to support TrueScale hardware. (bsc#1045955) - Make mvapich2-psm conflict with mvapich2 as they both install to the same location. (bsc#934090) - Add missing module files required for mpi-selector to work properly. (bsc#1004628) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-220=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): mvapich2-2.2-4.3.1 mvapich2-debuginfo-2.2-4.3.1 mvapich2-debugsource-2.2-4.3.1 mvapich2-devel-2.2-4.3.1 mvapich2-devel-static-2.2-4.3.1 mvapich2-psm-2.2-4.3.1 mvapich2-psm-debuginfo-2.2-4.3.1 mvapich2-psm-debugsource-2.2-4.3.1 mvapich2-psm-devel-2.2-4.3.1 mvapich2-psm-devel-static-2.2-4.3.1 - openSUSE Leap 42.3 (x86_64): mvapich2-psm2-2.2-4.3.1 mvapich2-psm2-debuginfo-2.2-4.3.1 mvapich2-psm2-debugsource-2.2-4.3.1 mvapich2-psm2-devel-2.2-4.3.1 mvapich2-psm2-devel-static-2.2-4.3.1 References: https://bugzilla.suse.com/1004628 https://bugzilla.suse.com/1045955 https://bugzilla.suse.com/934090

1 0

openSUSE-OU-2018:0598-1: Optional update adding selinux-policy
by maintenance＠opensuse.org 03 Mar '18

03 Mar '18

openSUSE Optional Update: Optional update adding selinux-policy ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0598-1 Rating: low References: #1017272 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds selinux-policy to the distribution. These are the same selinux policies shipped in SLES 12. They may not be complete for enforcing mode. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-219=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): selinux-policy-20140730-2.1 selinux-policy-devel-20140730-2.1 selinux-policy-doc-20140730-2.1 selinux-policy-minimum-20140730-2.1 selinux-policy-mls-20140730-2.1 selinux-policy-targeted-20140730-2.1 References: https://bugzilla.suse.com/1017272

1 0

openSUSE-SU-2018:0589-1: moderate: Security update for go
by opensuse-security＠opensuse.org 02 Mar '18

02 Mar '18

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0589-1 Rating: moderate References: #1080006 #1082409 Cross-References: CVE-2018-6574 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go fixes the following issues: Security issues fix in version 1.9.4: - CVE-2018-6574: "go get" remote command execution during source code build (bsc#1080006). Bug fixes: - bsc#1082409: Review dependencies (requires, recommends and supports). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-218=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): go-1.9.4-33.1 go-doc-1.9.4-33.1 go1.9-1.9.4-5.1 go1.9-debuginfo-1.9.4-5.1 go1.9-debugsource-1.9.4-5.1 go1.9-doc-1.9.4-5.1 - openSUSE Leap 42.3 (x86_64): go-race-1.9.4-33.1 go1.9-race-1.9.4-5.1 References: https://www.suse.com/security/cve/CVE-2018-6574.html https://bugzilla.suse.com/1080006 https://bugzilla.suse.com/1082409

1 0

openSUSE-SU-2018:0588-1: moderate: Security update for go
by opensuse-security＠opensuse.org 02 Mar '18

02 Mar '18

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0588-1 Rating: moderate References: #1080006 #1082409 Cross-References: CVE-2018-6574 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go fixes the following issues: Security issues fix in version 1.9.4: - CVE-2018-6574: "go get" remote command execution during source code build (bsc#1080006). Bug fixes: - bsc#1082409: Review dependencies (requires, recommends and supports). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-218=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): go-1.9.4-15.1 go-doc-1.9.4-15.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go-race-1.9.4-15.1 go1.9-1.9.4-5.1 go1.9-debuginfo-1.9.4-5.1 go1.9-debugsource-1.9.4-5.1 go1.9-doc-1.9.4-5.1 go1.9-race-1.9.4-5.1 References: https://www.suse.com/security/cve/CVE-2018-6574.html https://bugzilla.suse.com/1080006 https://bugzilla.suse.com/1082409

1 0

openSUSE-SU-2018:0570-1: important: Security update for freexl
by opensuse-security＠opensuse.org 01 Mar '18

01 Mar '18

openSUSE Security Update: Security update for freexl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0570-1 Rating: important References: #1082774 #1082775 #1082776 #1082777 #1082778 Cross-References: CVE-2018-7435 CVE-2018-7436 CVE-2018-7437 CVE-2018-7438 CVE-2018-7439 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for freexl fixes the following issues: freexl was updated to version 1.0.5: * No changelog provided by upstream * Various heapoverflows in 1.0.4 have been fixed: * CVE-2018-7439: heap-buffer-overflow in freexl.c:3912 read_mini_biff_next_record (boo#1082774) * CVE-2018-7438: heap-buffer-overflow in freexl.c:383 parse_unicode_string (boo#1082775) * CVE-2018-7437: heap-buffer-overflow in freexl.c:1866 parse_SST(boo#1082776) * CVE-2018-7436: heap-buffer-overflow in freexl.c:1805 parse_SST parse_SST (boo#1082777) * CVE-2018-7435: heap-buffer-overflow in freexl::destroy_cell (boo#1082778) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-217=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): freexl-debugsource-1.0.5-8.1 freexl-devel-1.0.5-8.1 libfreexl1-1.0.5-8.1 libfreexl1-debuginfo-1.0.5-8.1 References: https://www.suse.com/security/cve/CVE-2018-7435.html https://www.suse.com/security/cve/CVE-2018-7436.html https://www.suse.com/security/cve/CVE-2018-7437.html https://www.suse.com/security/cve/CVE-2018-7438.html https://www.suse.com/security/cve/CVE-2018-7439.html https://bugzilla.suse.com/1082774 https://bugzilla.suse.com/1082775 https://bugzilla.suse.com/1082776 https://bugzilla.suse.com/1082777 https://bugzilla.suse.com/1082778

1 0

openSUSE-SU-2018:0569-1: important: Security update for freexl
by opensuse-security＠opensuse.org 01 Mar '18

01 Mar '18

openSUSE Security Update: Security update for freexl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0569-1 Rating: important References: #1082774 #1082775 #1082776 #1082777 #1082778 Cross-References: CVE-2018-7435 CVE-2018-7436 CVE-2018-7437 CVE-2018-7438 CVE-2018-7439 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for freexl fixes the following issues: freexl was updated to version 1.0.5: * No changelog provided by upstream * Various heapoverflows in 1.0.4 have been fixed: * CVE-2018-7439: heap-buffer-overflow in freexl.c:3912 read_mini_biff_next_record (boo#1082774) * CVE-2018-7438: heap-buffer-overflow in freexl.c:383 parse_unicode_string (boo#1082775) * CVE-2018-7437: heap-buffer-overflow in freexl.c:1866 parse_SST(boo#1082776) * CVE-2018-7436: heap-buffer-overflow in freexl.c:1805 parse_SST parse_SST (boo#1082777) * CVE-2018-7435: heap-buffer-overflow in freexl::destroy_cell (boo#1082778) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-217=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): freexl-debugsource-1.0.5-8.1 freexl-devel-1.0.5-8.1 libfreexl1-1.0.5-8.1 libfreexl1-debuginfo-1.0.5-8.1 References: https://www.suse.com/security/cve/CVE-2018-7435.html https://www.suse.com/security/cve/CVE-2018-7436.html https://www.suse.com/security/cve/CVE-2018-7437.html https://www.suse.com/security/cve/CVE-2018-7438.html https://www.suse.com/security/cve/CVE-2018-7439.html https://bugzilla.suse.com/1082774 https://bugzilla.suse.com/1082775 https://bugzilla.suse.com/1082776 https://bugzilla.suse.com/1082777 https://bugzilla.suse.com/1082778

1 0