April 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0940-1: Security update for zziplib
by opensuse-security＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Security Update: Security update for zziplib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0940-1 Rating: low References: #1084517 #1084519 Cross-References: CVE-2018-7725 CVE-2018-7726 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for zziplib fixes the following issues: Security issues fixed: - CVE-2018-7726: There is a bus error caused by the__zzip_parse_root_directory function of zip.c. Attackers could leverage thisvulnerability to cause a denial of service (bsc#1084517). - CVE-2018-7725: An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service (bsc#1084519). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-359=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libzzip-0-13-0.13.67-13.6.1 libzzip-0-13-debuginfo-0.13.67-13.6.1 zziplib-debugsource-0.13.67-13.6.1 zziplib-devel-0.13.67-13.6.1 zziplib-devel-debuginfo-0.13.67-13.6.1 - openSUSE Leap 42.3 (x86_64): libzzip-0-13-32bit-0.13.67-13.6.1 libzzip-0-13-debuginfo-32bit-0.13.67-13.6.1 zziplib-devel-32bit-0.13.67-13.6.1 zziplib-devel-debuginfo-32bit-0.13.67-13.6.1 References: https://www.suse.com/security/cve/CVE-2018-7725.html https://www.suse.com/security/cve/CVE-2018-7726.html https://bugzilla.suse.com/1084517 https://bugzilla.suse.com/1084519

1 0

openSUSE-SU-2018:0939-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0939-1 Rating: important References: #1054986 #1067018 #1070615 #1079869 #1080042 #1082041 #1082161 #1083625 #1085757 #1086038 Cross-References: CVE-2017-5715 CVE-2018-1064 CVE-2018-6764 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 7 fixes is now available. Description: This update for libvirt and virt-manager fixes the following issues: Security issues fixed: - CVE-2017-5715: Fixes for speculative side channel attacks aka "SpectreAttack" (var2) (bsc#1079869). - CVE-2018-6764: Fixed guest executable code injection via libnss_dns.so loaded by libvirt_lxc before init (bsc#1080042). - CVE-2018-1064: Fixed denial of service when reading from guest agent (bsc#1083625). Non-security issues fixed in libvirt: - bsc#1070615: Fixed TPM device passthrough failure on kernels >= 4.0. - bsc#1082041: SUSE Linux Enterprise 11 SP4 hvm converted to pvhvm. Unless vm memory is on gig boundary, vm won't boot. - bsc#1082161: Unable to change RTC basis or adjustment for Xen HVM guests using libvirt. Non-security issues fixed in virt-manager: - bsc#1086038: VM guests cannot be properly installed with virt-install - bsc#1067018: KVM Guest creation failed - Property .cmt not found - bsc#1054986: Fix openSUSE 15.0 detection. It has no content file or .treeinfo file - bsc#1085757: Fallback to latest version of openSUSE when opensuse-unknown is detected for the ISO This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-358=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-15.1 libvirt-admin-3.3.0-15.1 libvirt-admin-debuginfo-3.3.0-15.1 libvirt-client-3.3.0-15.1 libvirt-client-debuginfo-3.3.0-15.1 libvirt-daemon-3.3.0-15.1 libvirt-daemon-config-network-3.3.0-15.1 libvirt-daemon-config-nwfilter-3.3.0-15.1 libvirt-daemon-debuginfo-3.3.0-15.1 libvirt-daemon-driver-interface-3.3.0-15.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-15.1 libvirt-daemon-driver-lxc-3.3.0-15.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-15.1 libvirt-daemon-driver-network-3.3.0-15.1 libvirt-daemon-driver-network-debuginfo-3.3.0-15.1 libvirt-daemon-driver-nodedev-3.3.0-15.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-15.1 libvirt-daemon-driver-nwfilter-3.3.0-15.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-15.1 libvirt-daemon-driver-qemu-3.3.0-15.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-15.1 libvirt-daemon-driver-secret-3.3.0-15.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-3.3.0-15.1 libvirt-daemon-driver-storage-core-3.3.0-15.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-disk-3.3.0-15.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-iscsi-3.3.0-15.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-logical-3.3.0-15.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-mpath-3.3.0-15.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-scsi-3.3.0-15.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-15.1 libvirt-daemon-driver-uml-3.3.0-15.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-15.1 libvirt-daemon-driver-vbox-3.3.0-15.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-15.1 libvirt-daemon-hooks-3.3.0-15.1 libvirt-daemon-lxc-3.3.0-15.1 libvirt-daemon-qemu-3.3.0-15.1 libvirt-daemon-uml-3.3.0-15.1 libvirt-daemon-vbox-3.3.0-15.1 libvirt-debugsource-3.3.0-15.1 libvirt-devel-3.3.0-15.1 libvirt-doc-3.3.0-15.1 libvirt-libs-3.3.0-15.1 libvirt-libs-debuginfo-3.3.0-15.1 libvirt-lock-sanlock-3.3.0-15.1 libvirt-lock-sanlock-debuginfo-3.3.0-15.1 libvirt-nss-3.3.0-15.1 libvirt-nss-debuginfo-3.3.0-15.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-15.1 libvirt-daemon-driver-libxl-3.3.0-15.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-15.1 libvirt-daemon-driver-storage-rbd-3.3.0-15.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-15.1 libvirt-daemon-xen-3.3.0-15.1 libvirt-devel-32bit-3.3.0-15.1 - openSUSE Leap 42.3 (noarch): virt-install-1.4.1-9.1 virt-manager-1.4.1-9.1 virt-manager-common-1.4.1-9.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-1064.html https://www.suse.com/security/cve/CVE-2018-6764.html https://bugzilla.suse.com/1054986 https://bugzilla.suse.com/1067018 https://bugzilla.suse.com/1070615 https://bugzilla.suse.com/1079869 https://bugzilla.suse.com/1080042 https://bugzilla.suse.com/1082041 https://bugzilla.suse.com/1082161 https://bugzilla.suse.com/1083625 https://bugzilla.suse.com/1085757 https://bugzilla.suse.com/1086038

1 0

openSUSE-OU-2018:0938-1: Optional update for spec-cleaner
by maintenance＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Optional Update: Optional update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0938-1 Rating: low References: #1089297 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for spec-cleaner fixes the following issues: - Version update to 1.0.7 boo#1089297: * Fix haskell macro bracketing * Fix firewalld macros bracketing * Fixes license conversions to spdx3.0 * Allows better parsing of pattern packages * Various manpage suffixing fixes * Added more things to exclude bracketing * Fix issue with the %doc -> %license conversion in some complex cases, multiple licenses at once, prefixed licenses * Fix various lint issues * Switch to SPDX-3.0 license format * Add %doc -> %license conversion script * Fix crash bugs found when scanning whole Tumbleweed repo Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-360=1 Package List: - openSUSE Leap 42.3 (noarch): spec-cleaner-1.0.7-43.1 spec-cleaner-format_spec_file-1.0.7-43.1 References: https://bugzilla.suse.com/1089297

1 0

openSUSE-SU-2018:0937-1: moderate: Security update for policycoreutils
by opensuse-security＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Security Update: Security update for policycoreutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0937-1 Rating: moderate References: #1083624 Cross-References: CVE-2018-1063 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for policycoreutils fixes the following issues: - CVE-2018-1063: Fixed problem to prevent chcon from following symlinks in /tmp, /var/tmp, /var/run and /var/lib/debug (bsc#1083624). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-362=1 Package List: - openSUSE Leap 42.3 (x86_64): policycoreutils-2.5-6.4.1 policycoreutils-debuginfo-2.5-6.4.1 policycoreutils-debugsource-2.5-6.4.1 policycoreutils-gui-2.5-6.4.1 policycoreutils-newrole-2.5-6.4.1 policycoreutils-newrole-debuginfo-2.5-6.4.1 policycoreutils-python-2.5-6.4.1 policycoreutils-python-debuginfo-2.5-6.4.1 policycoreutils-sandbox-2.5-6.4.1 policycoreutils-sandbox-debuginfo-2.5-6.4.1 - openSUSE Leap 42.3 (noarch): policycoreutils-lang-2.5-6.4.1 References: https://www.suse.com/security/cve/CVE-2018-1063.html https://bugzilla.suse.com/1083624

1 0

openSUSE-SU-2018:0936-1: moderate: Security update for openssl
by opensuse-security＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0936-1 Rating: moderate References: #1087102 Cross-References: CVE-2018-0739 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl fixes the following issues: - CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. (bsc#1087102). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-361=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenssl-devel-1.0.2j-19.1 libopenssl1_0_0-1.0.2j-19.1 libopenssl1_0_0-debuginfo-1.0.2j-19.1 libopenssl1_0_0-hmac-1.0.2j-19.1 openssl-1.0.2j-19.1 openssl-cavs-1.0.2j-19.1 openssl-cavs-debuginfo-1.0.2j-19.1 openssl-debuginfo-1.0.2j-19.1 openssl-debugsource-1.0.2j-19.1 - openSUSE Leap 42.3 (x86_64): libopenssl-devel-32bit-1.0.2j-19.1 libopenssl1_0_0-32bit-1.0.2j-19.1 libopenssl1_0_0-debuginfo-32bit-1.0.2j-19.1 libopenssl1_0_0-hmac-32bit-1.0.2j-19.1 - openSUSE Leap 42.3 (noarch): openssl-doc-1.0.2j-19.1 References: https://www.suse.com/security/cve/CVE-2018-0739.html https://bugzilla.suse.com/1087102

1 0

openSUSE-RU-2018:0935-1: Recommended update for xfsprogs
by maintenance＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0935-1 Rating: low References: #1019938 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xfsprogs fixes the following issues: - Fix segfaults in initramfs with many AGs. (bsc#1019938) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-357=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): xfsprogs-4.3.0-6.3.1 xfsprogs-debuginfo-4.3.0-6.3.1 xfsprogs-debugsource-4.3.0-6.3.1 xfsprogs-devel-4.3.0-6.3.1 References: https://bugzilla.suse.com/1019938

1 0

openSUSE-RU-2018:0932-1: moderate: Recommended update for pesign
by maintenance＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Recommended Update: Recommended update for pesign ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0932-1 Rating: moderate References: #1088820 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pesign fixes the following issues: - Enable and ship it on the Arm Arch64. (bsc#1088820) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-356=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): pesign-0.109-12.3.1 pesign-debuginfo-0.109-12.3.1 pesign-debugsource-0.109-12.3.1 References: https://bugzilla.suse.com/1088820

1 0

openSUSE-RU-2018:0930-1: Recommended update for python-kiwi
by maintenance＠opensuse.org 12 Apr '18

12 Apr '18

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0930-1 Rating: low References: #1077619 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-kiwi provides the following fixes: - Make sure toplevel target directory keeps its permissions. (bsc#1077619) - Fixed use of stat result in os.chmod. The oct method returns a string representation which was mistakenly used in a subsequent os.chmod call. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-355=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dracut-kiwi-live-8.33.5-14.1 dracut-kiwi-overlay-8.33.5-14.1 kiwi-boot-requires-8.33.5-14.1 kiwi-man-pages-8.33.5-14.1 kiwi-pxeboot-8.33.5-14.1 kiwi-tools-8.33.5-14.1 kiwi-tools-debuginfo-8.33.5-14.1 python-kiwi-debugsource-8.33.5-14.1 python2-kiwi-8.33.5-14.1 python3-kiwi-8.33.5-14.1 References: https://bugzilla.suse.com/1077619

1 0

openSUSE-OU-2018:0922-1: moderate: Optional update to add NetworkManager-openconnect to the SUSE PackageHub
by maintenance＠opensuse.org 11 Apr '18

11 Apr '18

openSUSE Optional Update: Optional update to add NetworkManager-openconnect to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0922-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds NetworkManager-openconnect to the SUSE PackageHub. This package adds NetworkManager VPN support for OpenConnect. For the GNOME Desktop environment, install NetworkManager-openconnect-gnome. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-354=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): NetworkManager-openconnect-lang-1.0.2-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): NetworkManager-openconnect-1.0.2-2.1 NetworkManager-openconnect-gnome-1.0.2-2.1 References:

1 0

openSUSE-RU-2018:0918-1: important: Recommended update for yast2-users
by maintenance＠opensuse.org 10 Apr '18

10 Apr '18

openSUSE Recommended Update: Recommended update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0918-1 Rating: important References: #1088183 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-users fixes the following issues: - Remedy a regression that would cause yast2-users to crash when the root user is undefined in the configuration. [bsc#1088183] This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-351=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-users-3.2.15-2.6.1 yast2-users-debuginfo-3.2.15-2.6.1 yast2-users-debugsource-3.2.15-2.6.1 References: https://bugzilla.suse.com/1088183

1 0

openSUSE-SU-2018:0917-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 10 Apr '18

10 Apr '18

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0917-1 Rating: moderate References: #1085211 Cross-References: CVE-2018-1000132 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mercurial fixes the following issue: - CVE-2018-1000132: Remote attackers may bypass HTTP server permissions via batch wire protocol commands (bsc#1085211) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-349=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): mercurial-4.2.3-12.1 mercurial-debuginfo-4.2.3-12.1 mercurial-debugsource-4.2.3-12.1 - openSUSE Leap 42.3 (noarch): mercurial-lang-4.2.3-12.1 References: https://www.suse.com/security/cve/CVE-2018-1000132.html https://bugzilla.suse.com/1085211

1 0

openSUSE-RU-2018:0916-1: Recommended update for pasystray
by maintenance＠opensuse.org 10 Apr '18

10 Apr '18

openSUSE Recommended Update: Recommended update for pasystray ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0916-1 Rating: low References: #1084813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pasystray fixes the following issues: - boo#1084813: Avoid crashes of pasystray due to missing dependendy on PulseAudio Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-353=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): pasystray-0.6.0-8.1 pasystray-debuginfo-0.6.0-8.1 pasystray-debugsource-0.6.0-8.1 References: https://bugzilla.suse.com/1084813

1 0

openSUSE-SU-2018:0914-1: moderate: Security update for git
by opensuse-security＠opensuse.org 10 Apr '18

10 Apr '18

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0914-1 Rating: moderate References: #1063412 Cross-References: CVE-2017-15298 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issue: - CVE-2017-15298: Specially crafted repositories could have caused a denial of service (boo#1063412) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-352=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): git-2.13.6-10.1 git-arch-2.13.6-10.1 git-core-2.13.6-10.1 git-core-debuginfo-2.13.6-10.1 git-credential-gnome-keyring-2.13.6-10.1 git-credential-gnome-keyring-debuginfo-2.13.6-10.1 git-cvs-2.13.6-10.1 git-daemon-2.13.6-10.1 git-daemon-debuginfo-2.13.6-10.1 git-debugsource-2.13.6-10.1 git-email-2.13.6-10.1 git-gui-2.13.6-10.1 git-svn-2.13.6-10.1 git-svn-debuginfo-2.13.6-10.1 git-web-2.13.6-10.1 gitk-2.13.6-10.1 - openSUSE Leap 42.3 (noarch): git-doc-2.13.6-10.1 References: https://www.suse.com/security/cve/CVE-2017-15298.html https://bugzilla.suse.com/1063412

1 0

openSUSE-RU-2018:0913-1: moderate: Recommended update for glslang, spirv-headers, spirv-tools, vulkan
by maintenance＠opensuse.org 10 Apr '18

10 Apr '18

openSUSE Recommended Update: Recommended update for glslang, spirv-headers, spirv-tools, vulkan ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0913-1 Rating: moderate References: #1086440 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for glslang, spirv-headers, spirv-tools, vulkan fixes the following issues: It provides x86 32bit library variants of the Vulkan stack for use by WINE and WINE development. (boo#1086440) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-350=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): glslang-debugsource-2.3.g537-4.3.1 glslang-devel-2.3.g537-4.3.1 glslang-devel-debuginfo-2.3.g537-4.3.1 libSPIRV-Tools-1_1-1.1.g41-4.3.1 libSPIRV-Tools-1_1-debuginfo-1.1.g41-4.3.1 libvulkan1-1.0.3.g5493-4.3.1 libvulkan1-debuginfo-1.0.3.g5493-4.3.1 spirv-tools-1.1.g41-4.3.1 spirv-tools-debuginfo-1.1.g41-4.3.1 spirv-tools-debugsource-1.1.g41-4.3.1 spirv-tools-devel-1.1.g41-4.3.1 vulkan-1.0.3.g5493-4.3.1 vulkan-debuginfo-1.0.3.g5493-4.3.1 vulkan-debugsource-1.0.3.g5493-4.3.1 vulkan-devel-1.0.3.g5493-4.3.1 - openSUSE Leap 42.3 (x86_64): libSPIRV-Tools-1_1-32bit-1.1.g41-4.3.1 libSPIRV-Tools-1_1-debuginfo-32bit-1.1.g41-4.3.1 libvulkan1-32bit-1.0.3.g5493-4.3.1 libvulkan1-debuginfo-32bit-1.0.3.g5493-4.3.1 vulkan-devel-32bit-1.0.3.g5493-4.3.1 - openSUSE Leap 42.3 (noarch): spirv-headers-1.1.g15-4.3.1 References: https://bugzilla.suse.com/1086440

1 0

openSUSE-RU-2018:0908-1: moderate: Recommended update for openconnect
by maintenance＠opensuse.org 10 Apr '18

10 Apr '18

openSUSE Recommended Update: Recommended update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0908-1 Rating: moderate References: #1056389 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openconnect fixes the following issues: - openconnect would fail to connect to a Junos Pulse gateway (bsc#1056389) This update to version 7.08 also contains the following improvements and fixes: - Various cryptography related improvements and fixed - Improved support for Cisco DTLS, Pulse Secure 8.2R5, OpenVPN, Juniper VPN Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-348=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): openconnect-7.08-6.1 openconnect-devel-7.08-6.1 openconnect-doc-7.08-6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): openconnect-lang-7.08-6.1 References: https://bugzilla.suse.com/1056389

1 0

openSUSE-RU-2018:0900-1: Recommended update for nvme-cli
by maintenance＠opensuse.org 07 Apr '18

07 Apr '18

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0900-1 Rating: low References: #1058538 #1076113 #1076127 #1076417 #1078032 #1080672 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for nvme-cli provides the following fix: - Make it possible to pass the full device path when requesting the disconnection. (bsc#1058538) - Return 0 if the disconnect command is successful. (bsc#1076417) - Add ability to specify controller loss timeout when connecting. (bsc#1078032) - Fix identifying active or allocated namespaces list. (bsc#1076113) - Fix the "nvme ns-desc" command by making it request a CNS of 0x03 (Namespace descriptors) instead of a CNS of 0x13 (Controller list). (bsc#1076127) - Add NetApp vendor plugin. (bsc#1080672) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-346=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nvme-cli-1.2-10.1 nvme-cli-debuginfo-1.2-10.1 nvme-cli-debugsource-1.2-10.1 References: https://bugzilla.suse.com/1058538 https://bugzilla.suse.com/1076113 https://bugzilla.suse.com/1076127 https://bugzilla.suse.com/1076417 https://bugzilla.suse.com/1078032 https://bugzilla.suse.com/1080672

1 0

openSUSE-SU-2018:0899-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 07 Apr '18

07 Apr '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0899-1 Rating: moderate References: #1088200 Cross-References: CVE-2018-9256 CVE-2018-9259 CVE-2018-9260 CVE-2018-9261 CVE-2018-9262 CVE-2018-9263 CVE-2018-9264 CVE-2018-9265 CVE-2018-9266 CVE-2018-9267 CVE-2018-9268 CVE-2018-9269 CVE-2018-9270 CVE-2018-9271 CVE-2018-9272 CVE-2018-9273 CVE-2018-9274 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Minor vulnerabilities that could be used to trigger dissector crashes or cause dissectors to go into large infinite loops by making Wireshark read specially crafted packages from the network or capture files (boo#1088200): - CVE-2018-9264: ADB dissector crash - CVE-2018-9260: IEEE 802.15.4 dissector crash - CVE-2018-9261: NBAP dissector crash - CVE-2018-9262: VLAN dissector crash - CVE-2018-9256: LWAPP dissector crash - CVE-2018-9263: Kerberos dissector crash - CVE-2018-9259: MP4 dissector crash - Memory leaks in multiple dissectors: CVE-2018-9265, CVE-2018-9266, CVE-2018-9267, CVE-2018-9268, CVE-2018-9269, CVE-2018-9270, CVE-2018-9271, CVE-2018-9272, CVE-2018-9273, CVE-2018-9274 This update also contains all upstream bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.14.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-347=1 Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.14-38.1 wireshark-debuginfo-2.2.14-38.1 wireshark-debugsource-2.2.14-38.1 wireshark-devel-2.2.14-38.1 wireshark-ui-gtk-2.2.14-38.1 wireshark-ui-gtk-debuginfo-2.2.14-38.1 wireshark-ui-qt-2.2.14-38.1 wireshark-ui-qt-debuginfo-2.2.14-38.1 References: https://www.suse.com/security/cve/CVE-2018-9256.html https://www.suse.com/security/cve/CVE-2018-9259.html https://www.suse.com/security/cve/CVE-2018-9260.html https://www.suse.com/security/cve/CVE-2018-9261.html https://www.suse.com/security/cve/CVE-2018-9262.html https://www.suse.com/security/cve/CVE-2018-9263.html https://www.suse.com/security/cve/CVE-2018-9264.html https://www.suse.com/security/cve/CVE-2018-9265.html https://www.suse.com/security/cve/CVE-2018-9266.html https://www.suse.com/security/cve/CVE-2018-9267.html https://www.suse.com/security/cve/CVE-2018-9268.html https://www.suse.com/security/cve/CVE-2018-9269.html https://www.suse.com/security/cve/CVE-2018-9270.html https://www.suse.com/security/cve/CVE-2018-9271.html https://www.suse.com/security/cve/CVE-2018-9272.html https://www.suse.com/security/cve/CVE-2018-9273.html https://www.suse.com/security/cve/CVE-2018-9274.html https://bugzilla.suse.com/1088200

1 0

openSUSE-RU-2018:0898-1: Recommended update for kdump
by maintenance＠opensuse.org 07 Apr '18

07 Apr '18

openSUSE Recommended Update: Recommended update for kdump ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0898-1 Rating: low References: #1002617 #1021484 #1036223 #1047606 #1047781 #1048178 #1056497 #1068234 #951144 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update for kdump provides the following fixes: - Fix a ssh login issue. Only field hosts in /etc/nsswitch is needed for /etc/hosts. (bsc#1048178, bsc#1002617) - Don't exit even if the initrd is not built. (bsc#1047781) - Limit kdump CPUs to the number provided in the configuration. (bsc#1036223, bsc#1068234) - Don't split vmcore by default. (bsc#1036223, bsc#1068234) - Ensure added kdump-early.service is enabled properly after update. (bsc#1021484, bsc#1047606) - Change the logic in load.sh to use kexec_load first. If it fails or if it is blocked by the kernel, then try kexec_load_file on x86_64. (bsc#951144, bsc#1056497) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-345=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kdump-0.8.16-5.3.1 kdump-debuginfo-0.8.16-5.3.1 kdump-debugsource-0.8.16-5.3.1 References: https://bugzilla.suse.com/1002617 https://bugzilla.suse.com/1021484 https://bugzilla.suse.com/1036223 https://bugzilla.suse.com/1047606 https://bugzilla.suse.com/1047781 https://bugzilla.suse.com/1048178 https://bugzilla.suse.com/1056497 https://bugzilla.suse.com/1068234 https://bugzilla.suse.com/951144

1 0

openSUSE-SU-2018:0894-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0894-1 Rating: moderate References: #1050087 Cross-References: CVE-2017-11524 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issue: - CVE-2017-11524: An attacker could have used a crafted file to cause a denial of service (assertion failure and application exit) (bsc#1050087) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-344=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-82.1 GraphicsMagick-debuginfo-1.3.25-82.1 GraphicsMagick-debugsource-1.3.25-82.1 GraphicsMagick-devel-1.3.25-82.1 libGraphicsMagick++-Q16-12-1.3.25-82.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-82.1 libGraphicsMagick++-devel-1.3.25-82.1 libGraphicsMagick-Q16-3-1.3.25-82.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-82.1 libGraphicsMagick3-config-1.3.25-82.1 libGraphicsMagickWand-Q16-2-1.3.25-82.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-82.1 perl-GraphicsMagick-1.3.25-82.1 perl-GraphicsMagick-debuginfo-1.3.25-82.1 References: https://www.suse.com/security/cve/CVE-2017-11524.html https://bugzilla.suse.com/1050087

1 0

openSUSE-SU-2018:0893-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0893-1 Rating: moderate References: #1043290 #1050087 #1056434 #1058630 #1059735 #1060382 #1066168 #1066170 #1082283 #1082291 #1082348 #1082362 #1082792 #1082837 #1083628 #1083634 #1086011 Cross-References: CVE-2017-11524 CVE-2017-12692 CVE-2017-12693 CVE-2017-13768 CVE-2017-14314 CVE-2017-14505 CVE-2017-14739 CVE-2017-15016 CVE-2017-15017 CVE-2017-16352 CVE-2017-16353 CVE-2017-18209 CVE-2017-18211 CVE-2017-9500 CVE-2018-7443 CVE-2018-7470 CVE-2018-8804 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2018-8804: The WriteEPTImage function allowed remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file (bsc#1086011). - CVE-2017-11524: The WriteBlob function allowed remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file (bsc#1050087). - CVE-2017-18209: Prevent NULL pointer dereference in the GetOpenCLCachedFilesDirectory function caused by a memory allocation result that was not checked, related to GetOpenCLCacheDirectory (bsc#1083628). - CVE-2017-18211: Prevent NULL pointer dereference in the function saveBinaryCLProgram caused by a program-lookup result not being checked, related to CacheOpenCLKernel (bsc#1083634). - CVE-2017-9500: Prevent assertion failure in the function ResetImageProfileIterator, which allowed attackers to cause a denial of service via a crafted file (bsc#1043290). - CVE-2017-14739: The AcquireResampleFilterThreadSet function mishandled failed memory allocation, which allowed remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors (bsc#1060382). - CVE-2017-16353: Prevent memory information disclosure in the DescribeImage function caused by a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments were never checked (bsc#1066170). - CVE-2017-16352: Prevent a heap-based buffer overflow in the "Display visual image directory" feature of the DescribeImage() function. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag (bsc#1066168). - CVE-2017-14314: Prevent off-by-one error in the DrawImage function that allowed remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file (bsc#1058630). - CVE-2017-13768: Prevent NULL pointer dereference in the IdentifyImage function that allowed an attacker to perform denial of service by sending a crafted image file (bsc#1056434). - CVE-2017-14505: Fixed handling of NULL arrays, which allowed attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input (bsc#1059735). - CVE-2018-7470: The IsWEBPImageLossless function allowed attackers to cause a denial of service (segmentation violation) via a crafted file (bsc#1082837). - CVE-2018-7443: The ReadTIFFImage function did not properly validate the amount of image data in a file, which allowed remote attackers to cause a denial of service (memory allocation failure in the AcquireMagickMemory function in MagickCore/memory.c) (bsc#1082792). - CVE-2017-15016: Prevent NULL pointer dereference vulnerability in ReadEnhMetaFile allowing for denial of service (bsc#1082291). - CVE-2017-15017: Prevent NULL pointer dereference vulnerability in ReadOneMNGImage allowing for denial of service (bsc#1082283). - CVE-2017-12692: The ReadVIFFImage function allowed remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file (bsc#1082362). - CVE-2017-12693: The ReadBMPImage function allowed remote attackers to cause a denial of service (memory consumption) via a crafted BMP file (bsc#1082348). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-343=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-58.1 ImageMagick-debuginfo-6.8.8.1-58.1 ImageMagick-debugsource-6.8.8.1-58.1 ImageMagick-devel-6.8.8.1-58.1 ImageMagick-extra-6.8.8.1-58.1 ImageMagick-extra-debuginfo-6.8.8.1-58.1 libMagick++-6_Q16-3-6.8.8.1-58.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-58.1 libMagick++-devel-6.8.8.1-58.1 libMagickCore-6_Q16-1-6.8.8.1-58.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-58.1 libMagickWand-6_Q16-1-6.8.8.1-58.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-58.1 perl-PerlMagick-6.8.8.1-58.1 perl-PerlMagick-debuginfo-6.8.8.1-58.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-58.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-58.1 libMagick++-6_Q16-3-32bit-6.8.8.1-58.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-58.1 libMagick++-devel-32bit-6.8.8.1-58.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-58.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-58.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-58.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-58.1 References: https://www.suse.com/security/cve/CVE-2017-11524.html https://www.suse.com/security/cve/CVE-2017-12692.html https://www.suse.com/security/cve/CVE-2017-12693.html https://www.suse.com/security/cve/CVE-2017-13768.html https://www.suse.com/security/cve/CVE-2017-14314.html https://www.suse.com/security/cve/CVE-2017-14505.html https://www.suse.com/security/cve/CVE-2017-14739.html https://www.suse.com/security/cve/CVE-2017-15016.html https://www.suse.com/security/cve/CVE-2017-15017.html https://www.suse.com/security/cve/CVE-2017-16352.html https://www.suse.com/security/cve/CVE-2017-16353.html https://www.suse.com/security/cve/CVE-2017-18209.html https://www.suse.com/security/cve/CVE-2017-18211.html https://www.suse.com/security/cve/CVE-2017-9500.html https://www.suse.com/security/cve/CVE-2018-7443.html https://www.suse.com/security/cve/CVE-2018-7470.html https://www.suse.com/security/cve/CVE-2018-8804.html https://bugzilla.suse.com/1043290 https://bugzilla.suse.com/1050087 https://bugzilla.suse.com/1056434 https://bugzilla.suse.com/1058630 https://bugzilla.suse.com/1059735 https://bugzilla.suse.com/1060382 https://bugzilla.suse.com/1066168 https://bugzilla.suse.com/1066170 https://bugzilla.suse.com/1082283 https://bugzilla.suse.com/1082291 https://bugzilla.suse.com/1082348 https://bugzilla.suse.com/1082362 https://bugzilla.suse.com/1082792 https://bugzilla.suse.com/1082837 https://bugzilla.suse.com/1083628 https://bugzilla.suse.com/1083634 https://bugzilla.suse.com/1086011

1 0

openSUSE-SU-2018:0892-1: moderate: Security update for spice-gtk
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0892-1 Rating: moderate References: #1085415 Cross-References: CVE-2017-12194 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice-gtk fixes the following issues: - CVE-2017-12194: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable. (bsc#1085415) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-342=1 Package List: - openSUSE Leap 42.3 (x86_64): libspice-client-glib-2_0-8-0.33-2.3.1 libspice-client-glib-2_0-8-debuginfo-0.33-2.3.1 libspice-client-glib-helper-0.33-2.3.1 libspice-client-glib-helper-debuginfo-0.33-2.3.1 libspice-client-gtk-3_0-5-0.33-2.3.1 libspice-client-gtk-3_0-5-debuginfo-0.33-2.3.1 libspice-controller0-0.33-2.3.1 libspice-controller0-debuginfo-0.33-2.3.1 spice-gtk-0.33-2.3.1 spice-gtk-debuginfo-0.33-2.3.1 spice-gtk-debugsource-0.33-2.3.1 spice-gtk-devel-0.33-2.3.1 typelib-1_0-SpiceClientGlib-2_0-0.33-2.3.1 typelib-1_0-SpiceClientGtk-3_0-0.33-2.3.1 - openSUSE Leap 42.3 (noarch): spice-gtk-lang-0.33-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-12194.html https://bugzilla.suse.com/1085415

1 0

openSUSE-SU-2018:0891-1: moderate: Security update for libidn
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for libidn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0891-1 Rating: moderate References: #1056450 Cross-References: CVE-2017-14062 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libidn fixes the following issue: - CVE-2017-14062: Prevent integer overflow in the decode_digit function that allowed remote attackers to cause a denial of service or possibly have unspecified other impact (bsc#1056450). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-341=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libidn-debugsource-1.28-9.3.1 libidn-devel-1.28-9.3.1 libidn-tools-1.28-9.3.1 libidn-tools-debuginfo-1.28-9.3.1 libidn11-1.28-9.3.1 libidn11-debuginfo-1.28-9.3.1 - openSUSE Leap 42.3 (x86_64): libidn11-32bit-1.28-9.3.1 libidn11-debuginfo-32bit-1.28-9.3.1 References: https://www.suse.com/security/cve/CVE-2017-14062.html https://bugzilla.suse.com/1056450

1 0

openSUSE-SU-2018:0890-1: moderate: Security update for postgresql94
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0890-1 Rating: moderate References: #1081925 Cross-References: CVE-2018-1058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql94 fixes the following issues: Security issues fixed: - CVE-2018-1058: Fixed uncontrolled search path element in pg_dump and other client applications (bsc#1081925). Bug fixes: - See release notes for details: * https://www.postgresql.org/docs/9.4/static/release-9-4-17.html * https://www.postgresql.org/docs/9.4/static/release-9-4-16.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-340=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.17-21.1 postgresql94-contrib-9.4.17-21.1 postgresql94-contrib-debuginfo-9.4.17-21.1 postgresql94-debuginfo-9.4.17-21.1 postgresql94-debugsource-9.4.17-21.1 postgresql94-devel-9.4.17-21.1 postgresql94-devel-debuginfo-9.4.17-21.1 postgresql94-libs-debugsource-9.4.17-21.1 postgresql94-plperl-9.4.17-21.1 postgresql94-plperl-debuginfo-9.4.17-21.1 postgresql94-plpython-9.4.17-21.1 postgresql94-plpython-debuginfo-9.4.17-21.1 postgresql94-pltcl-9.4.17-21.1 postgresql94-pltcl-debuginfo-9.4.17-21.1 postgresql94-server-9.4.17-21.1 postgresql94-server-debuginfo-9.4.17-21.1 postgresql94-test-9.4.17-21.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.17-21.1 References: https://www.suse.com/security/cve/CVE-2018-1058.html https://bugzilla.suse.com/1081925

1 0

openSUSE-RU-2018:0889-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0889-1 Rating: moderate References: #1082022 #1085512 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for suse-build-key fixes the following issues: - The lifetime of the SUSE Linux Enterprise 11 signing key was extended (bsc#1085512) - A new security(a)suse.de E-Mail key was added (bsc#1082022) pub rsa4096/0x21FE92322BA9E067 2018-03-15 [SC] [expires: 2020-03-14] Key fingerprint = EC7C 5EAB 2C34 09A6 4F3B BE6E 21FE 9232 2BA9 E067 uid SUSE Security Team <security(a)suse.com> uid SUSE Security Team <security(a)suse.de> sub rsa4096/0xFF97314EC1E11A0E 2018-03-15 [E] [expires: 2020-03-14] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-338=1 Package List: - openSUSE Leap 42.3 (noarch): suse-build-key-12.0-14.3.1 References: https://bugzilla.suse.com/1082022 https://bugzilla.suse.com/1085512

1 0

openSUSE-RU-2018:0888-1: moderate: Recommended update for openSUSE-build-key
by maintenance＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Recommended Update: Recommended update for openSUSE-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0888-1 Rating: moderate References: #1082022 #1085512 #1087276 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for openSUSE-build-key fixes the following issues: - Refreshed the SUSE Linux Enterprise 11 build(a)suse.de key (boo#1085512) - Added the SUSE Linux Enterprise 12 and 15 build(a)suse.de key (boo#1087276) pub rsa2048/0x70AF9E8139DB7C82 2013-01-31 [SC] [expires: 2020-12-06] Key fingerprint = FEAB 5025 39D8 46DB 2C09 61CA 70AF 9E81 39DB 7C82 uid SuSE Package Signing Key <build(a)suse.de> - A new security(a)suse.de key has been established. (boo#1082022) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-339=1 Package List: - openSUSE Leap 42.3 (noarch): openSUSE-build-key-1.0-36.3.1 References: https://bugzilla.suse.com/1082022 https://bugzilla.suse.com/1085512 https://bugzilla.suse.com/1087276

1 0