March 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0736-1: moderate: Security update for postgresql95
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for postgresql95 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0736-1 Rating: moderate References: #1081925 Cross-References: CVE-2018-1058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql95 fixes the following issues: Security issue fixed in PostgreSQL 9.5.12: - CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications (boo#1081925). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-279=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql95-9.5.12-2.6.1 postgresql95-contrib-9.5.12-2.6.1 postgresql95-contrib-debuginfo-9.5.12-2.6.1 postgresql95-debuginfo-9.5.12-2.6.1 postgresql95-debugsource-9.5.12-2.6.1 postgresql95-devel-9.5.12-2.6.1 postgresql95-devel-debuginfo-9.5.12-2.6.1 postgresql95-libs-debugsource-9.5.12-2.6.1 postgresql95-plperl-9.5.12-2.6.1 postgresql95-plperl-debuginfo-9.5.12-2.6.1 postgresql95-plpython-9.5.12-2.6.1 postgresql95-plpython-debuginfo-9.5.12-2.6.1 postgresql95-pltcl-9.5.12-2.6.1 postgresql95-pltcl-debuginfo-9.5.12-2.6.1 postgresql95-server-9.5.12-2.6.1 postgresql95-server-debuginfo-9.5.12-2.6.1 postgresql95-test-9.5.12-2.6.1 - openSUSE Leap 42.3 (noarch): postgresql95-docs-9.5.12-2.6.1 References: https://www.suse.com/security/cve/CVE-2018-1058.html https://bugzilla.suse.com/1081925

1 0

openSUSE-SU-2018:0735-1: moderate: Security update for libid3tag
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for libid3tag ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0735-1 Rating: moderate References: #1081959 #1081961 #1081962 #387731 Cross-References: CVE-2004-2779 CVE-2008-2109 CVE-2017-11550 CVE-2017-11551 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libid3tag fixes the following issues: - CVE-2004-2779 CVE-2017-11551: Fixed id3_utf16_deserialize() in utf16.c, which previously misparsed ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until OOM leading to DoS. (bsc#1081959 bsc#1081961) - CVE-2017-11550 CVE-2008-2109: Fixed the handling of unknown encodings when parsing ID3 tags. (bsc#1081962 bsc#387731) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-277=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libid3tag-debugsource-0.15.1b-188.3.1 libid3tag-devel-0.15.1b-188.3.1 libid3tag0-0.15.1b-188.3.1 libid3tag0-debuginfo-0.15.1b-188.3.1 - openSUSE Leap 42.3 (x86_64): libid3tag0-32bit-0.15.1b-188.3.1 libid3tag0-debuginfo-32bit-0.15.1b-188.3.1 References: https://www.suse.com/security/cve/CVE-2004-2779.html https://www.suse.com/security/cve/CVE-2008-2109.html https://www.suse.com/security/cve/CVE-2017-11550.html https://www.suse.com/security/cve/CVE-2017-11551.html https://bugzilla.suse.com/1081959 https://bugzilla.suse.com/1081961 https://bugzilla.suse.com/1081962 https://bugzilla.suse.com/387731

1 0

openSUSE-SU-2018:0734-1: important: Security update for SDL2, SDL2_image
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for SDL2, SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0734-1 Rating: important References: #1025413 #1084256 #1084257 #1084282 #1084288 #1084297 #1084303 #1084304 Cross-References: CVE-2017-12122 CVE-2017-14440 CVE-2017-14441 CVE-2017-14442 CVE-2017-14448 CVE-2017-14449 CVE-2017-14450 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for SDL2 and SDL2_image fixes the following issues: - CVE-2017-14441: Code execution in the ICO image rendering (bsc#1084282). - CVE-2017-14440: Potential code execution in the ILBM image rendering functionality (bsc#1084257). - CVE-2017-12122: Potential code execution in the ILBM image rendering fuctionality (bsc#1084256). - CVE-2017-14448: Heap buffer overflow in the XCF image rendering functionality (bsc#1084303). - CVE-2017-14449: Double-Free in the XCF image rendering (bsc#1084297). - CVE-2017-14442: Stack buffer overflow the BMP image rendering functionality (bsc#1084304). - CVE-2017-14450: Buffer overflow in the GIF image parsing (bsc#1084288). Bug fixes: - boo#1025413: Add dbus-ime.diff and build with fcitx. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): SDL2-debugsource-2.0.8-18.1 SDL2_image-debugsource-2.0.3-13.10.1 libSDL2-2_0-0-2.0.8-18.1 libSDL2-2_0-0-debuginfo-2.0.8-18.1 libSDL2-devel-2.0.8-18.1 libSDL2_image-2_0-0-2.0.3-13.10.1 libSDL2_image-2_0-0-debuginfo-2.0.3-13.10.1 libSDL2_image-devel-2.0.3-13.10.1 - openSUSE Leap 42.3 (x86_64): libSDL2-2_0-0-32bit-2.0.8-18.1 libSDL2-2_0-0-debuginfo-32bit-2.0.8-18.1 libSDL2-devel-32bit-2.0.8-18.1 libSDL2_image-2_0-0-32bit-2.0.3-13.10.1 libSDL2_image-2_0-0-debuginfo-32bit-2.0.3-13.10.1 libSDL2_image-devel-32bit-2.0.3-13.10.1 References: https://www.suse.com/security/cve/CVE-2017-12122.html https://www.suse.com/security/cve/CVE-2017-14440.html https://www.suse.com/security/cve/CVE-2017-14441.html https://www.suse.com/security/cve/CVE-2017-14442.html https://www.suse.com/security/cve/CVE-2017-14448.html https://www.suse.com/security/cve/CVE-2017-14449.html https://www.suse.com/security/cve/CVE-2017-14450.html https://bugzilla.suse.com/1025413 https://bugzilla.suse.com/1084256 https://bugzilla.suse.com/1084257 https://bugzilla.suse.com/1084282 https://bugzilla.suse.com/1084288 https://bugzilla.suse.com/1084297 https://bugzilla.suse.com/1084303 https://bugzilla.suse.com/1084304

1 0

openSUSE-SU-2018:0733-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0733-1 Rating: moderate References: #1058630 #1059735 #1066168 #1066170 #1082283 #1082291 #1084060 #1084062 #1085233 Cross-References: CVE-2017-14314 CVE-2017-14505 CVE-2017-15016 CVE-2017-15017 CVE-2017-16352 CVE-2017-16353 CVE-2017-18219 CVE-2017-18220 CVE-2017-18230 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2017-18230: Specially crafted CINEON images may have caused a Null pointer dereference (boo#1085233) - CVE-2017-16353: Specially crafted MIFF images could have allowed for information disclosure (boo#1066170) - CVE-2017-16352: Specially crafted MIFF images may have caused a heap-based buffer overflow (boo#1066168) - CVE-2017-14314: Specially crafted image files may have caused a denial of service (boo#1058630) - CVE-2017-14505: Specially crafted image files may have caused a Null pointer dereference (boo#1059735) - CVE-2017-15016: Specially crafted EMF images may have caused a Null pointer dereference (boo#1082291) - CVE-2017-15017: Specially crafted MSG images may have caused a Null pointer dereference (boo#1082283) - CVE-2017-18219: Specially crafted image files may have been used to cause an application crash (boo#1084060) - CVE-2017-18220: Specially crafted PNG images may have been used to cause a denial of service (boo#1084062) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-79.1 GraphicsMagick-debuginfo-1.3.25-79.1 GraphicsMagick-debugsource-1.3.25-79.1 GraphicsMagick-devel-1.3.25-79.1 libGraphicsMagick++-Q16-12-1.3.25-79.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-79.1 libGraphicsMagick++-devel-1.3.25-79.1 libGraphicsMagick-Q16-3-1.3.25-79.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-79.1 libGraphicsMagick3-config-1.3.25-79.1 libGraphicsMagickWand-Q16-2-1.3.25-79.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-79.1 perl-GraphicsMagick-1.3.25-79.1 perl-GraphicsMagick-debuginfo-1.3.25-79.1 References: https://www.suse.com/security/cve/CVE-2017-14314.html https://www.suse.com/security/cve/CVE-2017-14505.html https://www.suse.com/security/cve/CVE-2017-15016.html https://www.suse.com/security/cve/CVE-2017-15017.html https://www.suse.com/security/cve/CVE-2017-16352.html https://www.suse.com/security/cve/CVE-2017-16353.html https://www.suse.com/security/cve/CVE-2017-18219.html https://www.suse.com/security/cve/CVE-2017-18220.html https://www.suse.com/security/cve/CVE-2017-18230.html https://bugzilla.suse.com/1058630 https://bugzilla.suse.com/1059735 https://bugzilla.suse.com/1066168 https://bugzilla.suse.com/1066170 https://bugzilla.suse.com/1082283 https://bugzilla.suse.com/1082291 https://bugzilla.suse.com/1084060 https://bugzilla.suse.com/1084062 https://bugzilla.suse.com/1085233

1 0

openSUSE-SU-2018:0732-1: moderate: Security update for exempi
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for exempi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0732-1 Rating: moderate References: #1085295 #1085297 Cross-References: CVE-2018-7728 CVE-2018-7730 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for exempi fixes the following issues: - CVE-2018-7728: Specially crafted TIFF images could have been used to cause a denial of service via a heap-based buffer overflow (boo#1085297) - CVE-2018-7730: Specially crafted Excel files could have been used cause a denial of service via a heap-based buffer overflow (boo#1085295) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): exempi-debugsource-2.2.2-6.3.1 exempi-tools-2.2.2-6.3.1 exempi-tools-debuginfo-2.2.2-6.3.1 libexempi-devel-2.2.2-6.3.1 libexempi3-2.2.2-6.3.1 libexempi3-debuginfo-2.2.2-6.3.1 - openSUSE Leap 42.3 (x86_64): libexempi3-32bit-2.2.2-6.3.1 libexempi3-debuginfo-32bit-2.2.2-6.3.1 References: https://www.suse.com/security/cve/CVE-2018-7728.html https://www.suse.com/security/cve/CVE-2018-7730.html https://bugzilla.suse.com/1085295 https://bugzilla.suse.com/1085297

1 0

openSUSE-SU-2018:0731-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 18 Mar '18

18 Mar '18

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0731-1 Rating: moderate References: #1084688 #1084690 #1084691 Cross-References: CVE-2018-5800 CVE-2018-5801 CVE-2018-5802 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libraw fixes the following issues: - CVE-2018-5800: Specially crafted RAW files may have caused an application crash via a heap-based buffer overflow (boo#1084690) - CVE-2018-5801: Specially crafted RAW files may have been used to trigger a NULL pointer de-reference (boo#1084691) - CVE-2018-5802: Specially crafted RAW files may have caused an application crash via a heap-based buffer overflow (boo#1084688) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-281=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-17.1 libraw-devel-0.17.1-17.1 libraw-devel-static-0.17.1-17.1 libraw-tools-0.17.1-17.1 libraw-tools-debuginfo-0.17.1-17.1 libraw15-0.17.1-17.1 libraw15-debuginfo-0.17.1-17.1 References: https://www.suse.com/security/cve/CVE-2018-5800.html https://www.suse.com/security/cve/CVE-2018-5801.html https://www.suse.com/security/cve/CVE-2018-5802.html https://bugzilla.suse.com/1084688 https://bugzilla.suse.com/1084690 https://bugzilla.suse.com/1084691

1 0

openSUSE-SU-2018:0730-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0730-1 Rating: important References: #1078431 Cross-References: CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: MariaDB was updated to 10.0.34 (bsc#1078431) The following security vulnerabilities are fixed: - CVE-2018-2562: Vulnerability in the MySQL Server subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. - CVE-2018-2622: Vulnerability in the MySQL Server subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2640: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2665: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2668: Vulnerability in the MySQL Server subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. - CVE-2018-2612: Vulnerability in the MySQL Server subcomponent: InnoDB. Easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. The MariaDB external release notes and changelog for this release: * https://kb.askmonty.org/en/mariadb-10034-release-notes * https://kb.askmonty.org/en/mariadb-10034-changelog This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysqlclient-devel-10.0.34-32.2 libmysqlclient18-10.0.34-32.2 libmysqlclient18-debuginfo-10.0.34-32.2 libmysqlclient_r18-10.0.34-32.2 libmysqld-devel-10.0.34-32.2 libmysqld18-10.0.34-32.2 libmysqld18-debuginfo-10.0.34-32.2 mariadb-10.0.34-32.2 mariadb-bench-10.0.34-32.2 mariadb-bench-debuginfo-10.0.34-32.2 mariadb-client-10.0.34-32.2 mariadb-client-debuginfo-10.0.34-32.2 mariadb-debuginfo-10.0.34-32.2 mariadb-debugsource-10.0.34-32.2 mariadb-errormessages-10.0.34-32.2 mariadb-test-10.0.34-32.2 mariadb-test-debuginfo-10.0.34-32.2 mariadb-tools-10.0.34-32.2 mariadb-tools-debuginfo-10.0.34-32.2 - openSUSE Leap 42.3 (x86_64): libmysqlclient18-32bit-10.0.34-32.2 libmysqlclient18-debuginfo-32bit-10.0.34-32.2 libmysqlclient_r18-32bit-10.0.34-32.2 References: https://www.suse.com/security/cve/CVE-2018-2562.html https://www.suse.com/security/cve/CVE-2018-2612.html https://www.suse.com/security/cve/CVE-2018-2622.html https://www.suse.com/security/cve/CVE-2018-2640.html https://www.suse.com/security/cve/CVE-2018-2665.html https://www.suse.com/security/cve/CVE-2018-2668.html https://bugzilla.suse.com/1078431

1 0

openSUSE-RU-2018:0729-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0729-1 Rating: moderate References: #1051350 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - boo#1051350: The active cell may not have been shown in LibreOffice Calc running on graphics hardware supporting GLAMOR, including Intel Gen4/5 and Radeio G300-G400 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-275=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): xorg-x11-server-7.6_1.18.3-31.1 xorg-x11-server-debuginfo-7.6_1.18.3-31.1 xorg-x11-server-debugsource-7.6_1.18.3-31.1 xorg-x11-server-extra-7.6_1.18.3-31.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-31.1 xorg-x11-server-sdk-7.6_1.18.3-31.1 xorg-x11-server-source-7.6_1.18.3-31.1 References: https://bugzilla.suse.com/1051350

1 0

openSUSE-RU-2018:0728-1: Recommended update for python3-six
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for python3-six ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0728-1 Rating: low References: #1011342 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-six to version 1.10.0 updates the package to the one used in SLE. It contains the following improvements: - Improve the performance of `six.int2byte` on Python 3 - Various other bug fixes - split out -doc package This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-274=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-six-1.10.0-5.3.1 python3-six-doc-1.10.0-5.3.1 References: https://bugzilla.suse.com/1011342

1 0

openSUSE-RU-2018:0727-1: moderate: Recommended update for python-CherryPy
by maintenance＠opensuse.org 17 Mar '18

17 Mar '18

openSUSE Recommended Update: Recommended update for python-CherryPy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0727-1 Rating: moderate References: #1043589 #1046667 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-CherryPy fixes an SSL compatibility issue with CPython 2.7 and its built-in version of pyOpenSSL. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-273=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-CherryPy-3.6.0-7.3.1 References: https://bugzilla.suse.com/1043589 https://bugzilla.suse.com/1046667

1 0