April 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1088-1: moderate: Recommended update for pidgin
by maintenance＠opensuse.org 26 Apr '18

26 Apr '18

openSUSE Recommended Update: Recommended update for pidgin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1088-1 Rating: moderate References: #1086439 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pidgin fixes the following issues: - Enable SNI for gnutls to avoid SSL handshake failure (bsc#1086439) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-398=1 Package List: - openSUSE Leap 42.3 (x86_64): finch-2.12.0-10.3.1 finch-debuginfo-2.12.0-10.3.1 finch-devel-2.12.0-10.3.1 libpurple-2.12.0-10.3.1 libpurple-debuginfo-2.12.0-10.3.1 libpurple-devel-2.12.0-10.3.1 libpurple-plugin-sametime-2.12.0-10.3.1 libpurple-plugin-sametime-debuginfo-2.12.0-10.3.1 libpurple-tcl-2.12.0-10.3.1 libpurple-tcl-debuginfo-2.12.0-10.3.1 pidgin-2.12.0-10.3.1 pidgin-debuginfo-2.12.0-10.3.1 pidgin-debugsource-2.12.0-10.3.1 pidgin-devel-2.12.0-10.3.1 - openSUSE Leap 42.3 (noarch): libpurple-branding-upstream-2.12.0-10.3.1 libpurple-lang-2.12.0-10.3.1 References: https://bugzilla.suse.com/1086439

1 0

openSUSE-SU-2018:1062-1: moderate: Security update for ocaml
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for ocaml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1062-1 Rating: moderate References: #1088591 Cross-References: CVE-2018-9838 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ocaml fixes the following issues: - CVE-2018-9838: Integer overflows when unmarshaling a bigarray data could result in a bigarray with impossibly large dimensions leading to overflow when computing the in-memory size of the bigarray. [bsc#1088591] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-391=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ocaml-4.03.0-4.3.1 ocaml-compiler-libs-4.03.0-4.3.1 ocaml-compiler-libs-devel-4.03.0-4.3.1 ocaml-debuginfo-4.03.0-4.3.1 ocaml-debugsource-4.03.0-4.3.1 ocaml-docs-4.03.0-4.3.1 ocaml-emacs-4.03.0-4.3.1 ocaml-ocamldoc-4.03.0-4.3.1 ocaml-ocamldoc-debuginfo-4.03.0-4.3.1 ocaml-rpm-macros-4.03.0-4.3.1 ocaml-runtime-4.03.0-4.3.1 ocaml-runtime-debuginfo-4.03.0-4.3.1 ocaml-source-4.03.0-4.3.1 ocaml-x11-4.03.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2018-9838.html https://bugzilla.suse.com/1088591

1 0

openSUSE-RU-2018:1061-1: important: Recommended update for kdepim-addons
by maintenance＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Recommended Update: Recommended update for kdepim-addons ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1061-1 Rating: important References: #1084802 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kdepim-addons fixes the following issue: - Prevent Plasma from freezing if an event without start date but with end date is in the calendar (boo#1084802) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-395=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kdepim-addons-16.08.2-5.1 kdepim-addons-16.08.2-8.1 kdepim-addons-debuginfo-16.08.2-5.1 kdepim-addons-debuginfo-16.08.2-8.1 kdepim-addons-debugsource-16.08.2-5.1 kdepim-addons-debugsource-16.08.2-8.1 References: https://bugzilla.suse.com/1084802

1 0

openSUSE-RU-2018:1060-1: important: Recommended update for kdepim-addons
by maintenance＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Recommended Update: Recommended update for kdepim-addons ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1060-1 Rating: important References: #1084802 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kdepim-addons fixes the following issue: - Prevent Plasma from freezing if an event without start date but with end date is in the calendar (boo#1084802) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-395=1 Package List: - openSUSE Leap 42.3 (x86_64): kdepim-addons-17.04.2-6.1 kdepim-addons-debuginfo-17.04.2-6.1 kdepim-addons-debugsource-17.04.2-6.1 - openSUSE Leap 42.3 (noarch): kdepim-addons-lang-17.04.2-6.1 References: https://bugzilla.suse.com/1084802

1 0

openSUSE-SU-2018:1059-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1059-1 Rating: moderate References: #1090309 Cross-References: CVE-2018-10188 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.0.1 fixes the following issues: - CVE-2018-10188: Possible execution of arbitrary SQL statements via manipulated URLs (boo#1090309) This version also contains a number of upstream changes, improvements, new functions and bug fixes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-387=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.0.1-20.1 References: https://www.suse.com/security/cve/CVE-2018-10188.html https://bugzilla.suse.com/1090309

1 0

openSUSE-SU-2018:1058-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1058-1 Rating: moderate References: #1090309 Cross-References: CVE-2018-10188 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.0.1 fixes the following issues: - CVE-2018-10188: Possible execution of arbitrary SQL statements via manipulated URLs (boo#1090309) This version also contains a number of upstream changes, improvements, new functions and bug fixes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-387=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.8.0.1-12.1 References: https://www.suse.com/security/cve/CVE-2018-10188.html https://bugzilla.suse.com/1090309

1 0

openSUSE-SU-2018:1057-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1057-1 Rating: important References: #1089997 Cross-References: CVE-2017-3737 CVE-2017-9798 CVE-2018-0739 CVE-2018-2830 CVE-2018-2831 CVE-2018-2835 CVE-2018-2836 CVE-2018-2837 CVE-2018-2842 CVE-2018-2843 CVE-2018-2844 CVE-2018-2845 CVE-2018-2860 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for VirtualBox to version 5.1.36 fixes multiple issues: Security issues fixed: - CVE-2018-0739: Unauthorized remote attacker may have caused a hang or frequently repeatable crash (complete DOS) - CVE-2018-2830: Attacker with host login may have compromised Virtualbox or further system services after interaction with a third user - CVE-2018-2831: Attacker with host login may have compromised VirtualBox or further system services, allowing read access to some data - CVE-2018-2835: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2836: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2837: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2842: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2843: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2844: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2845: Attacker with host login may have caused a hang or frequently repeatable crash (complete DOS), and perform unauthorized read and write operation to some VirtualBox accessible data - CVE-2018-2860: Privileged attacker may have gained control over VirtualBox and possibly further system services http://www.oracle.com/technetwork/security-advisory/cpuapr2018verbose-36781 08.html http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html #AppendixOVIR This update also contains all upstream fixes and improvements in the stable 5.1.36 release. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-389=1 Package List: - openSUSE Leap 42.3 (noarch): virtualbox-guest-desktop-icons-5.1.36-50.1 virtualbox-guest-source-5.1.36-50.1 virtualbox-host-source-5.1.36-50.1 - openSUSE Leap 42.3 (x86_64): python-virtualbox-5.1.36-50.1 python-virtualbox-debuginfo-5.1.36-50.1 virtualbox-5.1.36-50.1 virtualbox-debuginfo-5.1.36-50.1 virtualbox-debugsource-5.1.36-50.1 virtualbox-devel-5.1.36-50.1 virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 virtualbox-guest-kmp-default-debuginfo-5.1.36_k4.4.126_48-50.1 virtualbox-guest-tools-5.1.36-50.1 virtualbox-guest-tools-debuginfo-5.1.36-50.1 virtualbox-guest-x11-5.1.36-50.1 virtualbox-guest-x11-debuginfo-5.1.36-50.1 virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 virtualbox-host-kmp-default-debuginfo-5.1.36_k4.4.126_48-50.1 virtualbox-qt-5.1.36-50.1 virtualbox-qt-debuginfo-5.1.36-50.1 virtualbox-vnc-5.1.36-50.1 virtualbox-websrv-5.1.36-50.1 virtualbox-websrv-debuginfo-5.1.36-50.1 References: https://www.suse.com/security/cve/CVE-2017-3737.html https://www.suse.com/security/cve/CVE-2017-9798.html https://www.suse.com/security/cve/CVE-2018-0739.html https://www.suse.com/security/cve/CVE-2018-2830.html https://www.suse.com/security/cve/CVE-2018-2831.html https://www.suse.com/security/cve/CVE-2018-2835.html https://www.suse.com/security/cve/CVE-2018-2836.html https://www.suse.com/security/cve/CVE-2018-2837.html https://www.suse.com/security/cve/CVE-2018-2842.html https://www.suse.com/security/cve/CVE-2018-2843.html https://www.suse.com/security/cve/CVE-2018-2844.html https://www.suse.com/security/cve/CVE-2018-2845.html https://www.suse.com/security/cve/CVE-2018-2860.html https://bugzilla.suse.com/1089997

1 0

openSUSE-SU-2018:1056-1: important: Security update for hdf5
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for hdf5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1056-1 Rating: important References: #1011198 #1011201 #1011204 #1011205 Cross-References: CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for hdf5 fixes the following issues: - fix security issues (arbitary code execution): CVE-2016-4330: H5T_ARRAY Code Execution (boo#1011201) CVE-2016-4331: H5Z_NBIT Code Execution (boo#1011204) CVE-2016-4332: Shareable Message Type Code Execution (boo#1011205) CVE-2016-4333: Array index bounds issue (boo#1011198) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-392=1 Package List: - openSUSE Leap 42.3 (x86_64): hdf5-1.8.15-7.3.1 hdf5-debuginfo-1.8.15-7.3.1 hdf5-debugsource-1.8.15-7.3.1 hdf5-devel-1.8.15-7.3.1 hdf5-devel-data-1.8.15-7.3.1 hdf5-devel-static-1.8.15-7.3.1 hdf5-examples-1.8.15-7.3.1 hdf5-openmpi-1.8.15-7.3.1 hdf5-openmpi-debuginfo-1.8.15-7.3.1 hdf5-openmpi-devel-1.8.15-7.3.1 hdf5-openmpi-devel-static-1.8.15-7.3.1 libhdf5-10-1.8.15-7.3.1 libhdf5-10-debuginfo-1.8.15-7.3.1 libhdf5-10-openmpi-1.8.15-7.3.1 libhdf5-10-openmpi-debuginfo-1.8.15-7.3.1 libhdf5_hl10-1.8.15-7.3.1 libhdf5_hl10-debuginfo-1.8.15-7.3.1 libhdf5_hl10-openmpi-1.8.15-7.3.1 libhdf5_hl10-openmpi-debuginfo-1.8.15-7.3.1 References: https://www.suse.com/security/cve/CVE-2016-4330.html https://www.suse.com/security/cve/CVE-2016-4331.html https://www.suse.com/security/cve/CVE-2016-4332.html https://www.suse.com/security/cve/CVE-2016-4333.html https://bugzilla.suse.com/1011198 https://bugzilla.suse.com/1011201 https://bugzilla.suse.com/1011204 https://bugzilla.suse.com/1011205

1 0

openSUSE-RU-2018:1055-1: moderate: Recommende update for rust and cargo
by maintenance＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Recommended Update: Recommende update for rust and cargo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1055-1 Rating: moderate References: #1030232 #1075883 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update updates rust to version 1.23.0 and cargo to version 0.24.0. These versions are a build dependency for an upcoming update to Mozilla Firefox to version 60 ESR (bsc#1030232). These sources were imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-394=1 Package List: - openSUSE Leap 42.3 (noarch): rust-src-1.23.0-2.3.1 - openSUSE Leap 42.3 (x86_64): cargo-0.24.0-2.3.1 cargo-debuginfo-0.24.0-2.3.1 rust-1.23.0-2.3.1 rust-debuginfo-1.23.0-2.3.1 rust-debugsource-1.23.0-2.3.1 rust-doc-1.23.0-2.3.1 rust-gdb-1.23.0-2.3.1 rust-std-1.23.0-2.3.1 rust-std-debuginfo-1.23.0-2.3.1 References: https://bugzilla.suse.com/1030232 https://bugzilla.suse.com/1075883

1 0

openSUSE-RU-2018:1054-1: Recommended update for python-py2pack
by maintenance＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Recommended Update: Recommended update for python-py2pack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1054-1 Rating: low References: #1089613 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-py2pack fixes the following issues: Fix an issue with the XMLRPC API, since functionality that used to work was deprecated. (boo#1089613) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-390=1 Package List: - openSUSE Leap 42.3 (noarch): python-py2pack-0.6.3-8.1 References: https://bugzilla.suse.com/1089613

1 0