April 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:1053-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1053-1 Rating: moderate References: #1002529 #1004723 #1008933 #1011304 #1011800 #1012398 #1012999 #1017078 #1019386 #1022841 #1025896 #1027044 #1027240 #1027722 #1030009 #1036125 #1038855 #1039370 #1041993 #1050003 #1051948 #1052264 #1053376 #1053955 #1059291 #1060230 #1062462 #1063419 #1064520 #1065792 #1068446 #1068566 #1071322 #1075950 #1079048 #1081592 #967803 #972311 #972490 #975093 #975303 #975733 #975757 #978150 #983512 #985661 #986019 #988506 #989193 #989798 #990439 #991048 #993039 #999852 Cross-References: CVE-2016-9639 CVE-2017-12791 CVE-2017-14695 CVE-2017-14696 CVE-2017-5200 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 49 fixes is now available. Description: This update for salt fixes the following issues: - [Regression] Permission problem: salt-ssh minion boostrap doesn't work anymore. (bsc#1027722) - wrong use of os_family string for Suse in the locale module and others (bsc#1038855) - Cannot bootstrap a host using "Manage system completely via SSH (will not install an agent)" (bsc#1002529) - add user to or replace members of group not working with SLES11 SPx (bsc#978150) - SLES-12-GA client fail to start salt minion (SUSE MANAGER 3.0) (bsc#991048) - salt pkg.latest raises exception if package is not availible (bsc#1012999) - pkg.list_products on "registerrelease" and "productline" returns boolean.False if empty (bsc#989193) - SLES-12-SP1 salt-minion clients has no Base Channel added by default (bsc#986019) - "The system requires a reboot" does not disappear from web-UI despite the reboot (bsc#1017078) - Remove option -f from startproc (bsc#975733) - [PYTHON2] package salt-minion requires /usr/bin/python (bsc#1081592) - Upgrading packages on RHEL6/7 client fails (bsc#1068566) - /var/log/salt has insecure permissions (bsc#1071322) - [Minion-bootstrapping] Invalid char cause server (salt-master ERROR) (bsc#1011304) - CVE-2016-9639: Possible information leak due to revoked keys still being used (bsc#1012398) - Bootstrapping SLES12 minion invalid (bsc#1053376) - Minions not correctly onboarded if Proxy has multiple FQDNs (bsc#1063419) - salt --summary '*' <function> reporting "# of minions that did not return" wrongly (bsc#972311) - RH-L3 SALT - Stacktrace if nscd package is not present when using nscd state (bsc#1027044) - Inspector broken: no module "query" or "inspector" while querying or inspecting (bsc#989798) - [ Regression ]Centos7 Minion remote command execution from gui or cli , minion not responding (bsc#1027240) - SALT, minion_id generation doesn't match the newhostname (bsc#967803) - Salt API server shuts down when SSH call with no matches is issued (bsc#1004723) - /var/log/salt/minion fails logrotate (bsc#1030009) - Salt proxy test.ping crashes (bsc#975303) - salt master flood log with useless messages (bsc#985661) - After bootstrap salt client has deprecation warnings (bsc#1041993) - Head: salt 2017.7.2 starts salt-master as user root (bsc#1064520) - CVE-2017-12791: Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master (bsc#1053955) - salt-2017.7.2 - broken %post script for salt-master (bsc#1079048) - Tearing down deployment with SaltStack Kubernetes module always shows error (bsc#1059291) - lvm.vg_present does not recognize PV with certain LVM filter settings. (bsc#988506) - High state fails: No service execution module loaded: check support for service (bsc#1065792) - When multiple versions of a package are installed on a minion, patch status may vary (bsc#972490) - Salt cp.push does not work on SUMA 3.2 Builds because of python3.4 (bsc#1075950) - timezone modue does not update /etc/sysconfig/clock (bsc#1008933) - Add patches to salt to support SUSE Manager scalability features (bsc#1052264) - salt-minion failed to start on minimal RHEL6 because of DBus exception during load of snapper module (bsc#993039) - Permission denied: '/var/run/salt-master.pid' (bsc#1050003) - Jobs scheduled to run at a future time stay pending for Salt minions (bsc#1036125) - Backport kubernetes-modules to salt (bsc#1051948) - After highstate: The minion function caused an exception (bsc#1068446) - VUL-0: CVE-2017-14695: salt: directory traversal vulnerability in minion id validation (bsc#1062462) - unable to update salt-minion on RHEL (bsc#1022841) - Nodes run out of memory due to salt-minion process (bsc#983512) - [Proxy] "Broken pipe" during bootstrap of salt minion (bsc#1039370) - incorrect return code from /etc/rc.d/salt-minion (bsc#999852) - CVE-2017-5200: Salt-ssh via api let's run arbitrary commands as user salt (bsc#1011800) - beacons.conf on salt-minion not processed (bsc#1060230) - SLES11 SP3 salt-minion Client Cannot Select Base Channel (bsc#975093) - salt-ssh sys.doc gives authentication failure without arguments (bsc#1019386) - minion bootstrapping: error when bootstrap SLE11 clients (bsc#990439) - Certificate Deployment Fails for SLES11 SP3 Clients (bsc#975757) - state.module run() does not translate varargs (bsc#1025896) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-388=1 Package List: - openSUSE Leap 42.3 (x86_64): python2-salt-2018.3.0-17.1 python3-salt-2018.3.0-17.1 salt-2018.3.0-17.1 salt-api-2018.3.0-17.1 salt-cloud-2018.3.0-17.1 salt-doc-2018.3.0-17.1 salt-master-2018.3.0-17.1 salt-minion-2018.3.0-17.1 salt-proxy-2018.3.0-17.1 salt-ssh-2018.3.0-17.1 salt-syndic-2018.3.0-17.1 - openSUSE Leap 42.3 (noarch): salt-bash-completion-2018.3.0-17.1 salt-fish-completion-2018.3.0-17.1 salt-zsh-completion-2018.3.0-17.1 References: https://www.suse.com/security/cve/CVE-2016-9639.html https://www.suse.com/security/cve/CVE-2017-12791.html https://www.suse.com/security/cve/CVE-2017-14695.html https://www.suse.com/security/cve/CVE-2017-14696.html https://www.suse.com/security/cve/CVE-2017-5200.html https://bugzilla.suse.com/1002529 https://bugzilla.suse.com/1004723 https://bugzilla.suse.com/1008933 https://bugzilla.suse.com/1011304 https://bugzilla.suse.com/1011800 https://bugzilla.suse.com/1012398 https://bugzilla.suse.com/1012999 https://bugzilla.suse.com/1017078 https://bugzilla.suse.com/1019386 https://bugzilla.suse.com/1022841 https://bugzilla.suse.com/1025896 https://bugzilla.suse.com/1027044 https://bugzilla.suse.com/1027240 https://bugzilla.suse.com/1027722 https://bugzilla.suse.com/1030009 https://bugzilla.suse.com/1036125 https://bugzilla.suse.com/1038855 https://bugzilla.suse.com/1039370 https://bugzilla.suse.com/1041993 https://bugzilla.suse.com/1050003 https://bugzilla.suse.com/1051948 https://bugzilla.suse.com/1052264 https://bugzilla.suse.com/1053376 https://bugzilla.suse.com/1053955 https://bugzilla.suse.com/1059291 https://bugzilla.suse.com/1060230 https://bugzilla.suse.com/1062462 https://bugzilla.suse.com/1063419 https://bugzilla.suse.com/1064520 https://bugzilla.suse.com/1065792 https://bugzilla.suse.com/1068446 https://bugzilla.suse.com/1068566 https://bugzilla.suse.com/1071322 https://bugzilla.suse.com/1075950 https://bugzilla.suse.com/1079048 https://bugzilla.suse.com/1081592 https://bugzilla.suse.com/967803 https://bugzilla.suse.com/972311 https://bugzilla.suse.com/972490 https://bugzilla.suse.com/975093 https://bugzilla.suse.com/975303 https://bugzilla.suse.com/975733 https://bugzilla.suse.com/975757 https://bugzilla.suse.com/978150 https://bugzilla.suse.com/983512 https://bugzilla.suse.com/985661 https://bugzilla.suse.com/986019 https://bugzilla.suse.com/988506 https://bugzilla.suse.com/989193 https://bugzilla.suse.com/989798 https://bugzilla.suse.com/990439 https://bugzilla.suse.com/991048 https://bugzilla.suse.com/993039 https://bugzilla.suse.com/999852

1 0

openSUSE-RU-2018:1052-1: Recommended update for qupzilla
by maintenance＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Recommended Update: Recommended update for qupzilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1052-1 Rating: low References: #1067547 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for qupzilla fixes the following issue: - boo#1067547: QupZilla did not start without libQt5Sql5-sqlite installed Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-393=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qupzilla-2.0.1-4.3.1 qupzilla-debuginfo-2.0.1-4.3.1 qupzilla-debugsource-2.0.1-4.3.1 qupzilla-gnome-keyring-2.0.1-4.3.1 qupzilla-gnome-keyring-debuginfo-2.0.1-4.3.1 qupzilla-kwallet-2.0.1-4.3.1 qupzilla-kwallet-debuginfo-2.0.1-4.3.1 References: https://bugzilla.suse.com/1067547

1 0

openSUSE-SU-2018:1051-1: important: Security update for hdf5
by opensuse-security＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Security Update: Security update for hdf5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1051-1 Rating: important References: #1011198 #1011201 #1011204 #1011205 Cross-References: CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for hdf5 fixes the following issues: - fix security issues (arbitary code execution): CVE-2016-4330: H5T_ARRAY Code Execution (boo#1011201) CVE-2016-4331: H5Z_NBIT Code Execution (boo#1011204) CVE-2016-4332: Shareable Message Type Code Execution (boo#1011205) CVE-2016-4333: Array index bounds issue (boo#1011198) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-392=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): hdf5-1.8.17-5.1 hdf5-devel-1.8.17-5.1 hdf5-devel-data-1.8.17-5.1 hdf5-devel-static-1.8.17-5.1 hdf5-examples-1.8.17-5.1 hdf5-openmpi-1.8.17-5.1 hdf5-openmpi-devel-1.8.17-5.1 hdf5-openmpi-devel-static-1.8.17-5.1 libhdf5-10-1.8.17-5.1 libhdf5-10-openmpi-1.8.17-5.1 libhdf5_cpp12-1.8.17-5.1 libhdf5_fortran10-1.8.17-5.1 libhdf5_fortran10-openmpi-1.8.17-5.1 libhdf5_hl10-1.8.17-5.1 libhdf5_hl10-openmpi-1.8.17-5.1 libhdf5_hl_cpp11-1.8.17-5.1 libhdf5hl_fortran10-1.8.17-5.1 libhdf5hl_fortran10-openmpi-1.8.17-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): hdf5-debuginfo-1.8.17-5.1 hdf5-debugsource-1.8.17-5.1 hdf5-openmpi-debuginfo-1.8.17-5.1 libhdf5-10-debuginfo-1.8.17-5.1 libhdf5-10-openmpi-debuginfo-1.8.17-5.1 libhdf5_cpp12-debuginfo-1.8.17-5.1 libhdf5_fortran10-debuginfo-1.8.17-5.1 libhdf5_fortran10-openmpi-debuginfo-1.8.17-5.1 libhdf5_hl10-debuginfo-1.8.17-5.1 libhdf5_hl10-openmpi-debuginfo-1.8.17-5.1 libhdf5_hl_cpp11-debuginfo-1.8.17-5.1 libhdf5hl_fortran10-debuginfo-1.8.17-5.1 libhdf5hl_fortran10-openmpi-debuginfo-1.8.17-5.1 References: https://www.suse.com/security/cve/CVE-2016-4330.html https://www.suse.com/security/cve/CVE-2016-4331.html https://www.suse.com/security/cve/CVE-2016-4332.html https://www.suse.com/security/cve/CVE-2016-4333.html https://bugzilla.suse.com/1011198 https://bugzilla.suse.com/1011201 https://bugzilla.suse.com/1011204 https://bugzilla.suse.com/1011205

1 0

openSUSE-RU-2018:1050-1: moderate: Recommended update for dehydrated
by maintenance＠opensuse.org 24 Apr '18

24 Apr '18

openSUSE Recommended Update: Recommended update for dehydrated ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1050-1 Rating: moderate References: #1084854 #1085305 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dehydrated to version 0.6.1 fixes the following issues: - The ACME v2 protocol is now supported and used by default (bsc#1084854) - documentation fixes (bsc#1085305) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-396=1 Package List: - openSUSE Leap 42.3 (noarch): dehydrated-0.6.1-2.3.1 dehydrated-apache2-0.6.1-2.3.1 dehydrated-lighttpd-0.6.1-2.3.1 dehydrated-nginx-0.6.1-2.3.1 References: https://bugzilla.suse.com/1084854 https://bugzilla.suse.com/1085305

1 0

openSUSE-SU-2018:1049-1: important: Security update for PackageKit
by opensuse-security＠opensuse.org 23 Apr '18

23 Apr '18

openSUSE Security Update: Security update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1049-1 Rating: important References: #1086936 Cross-References: CVE-2018-1106 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for PackageKit fixes the following security issue: - CVE-2018-1106: Drop the polkit rule which could allow users in wheel group to install packages without root password (bsc#1086936). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-386=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): PackageKit-1.1.3-5.3.1 PackageKit-backend-zypp-1.1.3-5.3.1 PackageKit-backend-zypp-debuginfo-1.1.3-5.3.1 PackageKit-debuginfo-1.1.3-5.3.1 PackageKit-debugsource-1.1.3-5.3.1 PackageKit-devel-1.1.3-5.3.1 PackageKit-devel-debuginfo-1.1.3-5.3.1 PackageKit-gstreamer-plugin-1.1.3-5.3.1 PackageKit-gstreamer-plugin-debuginfo-1.1.3-5.3.1 PackageKit-gtk3-module-1.1.3-5.3.1 PackageKit-gtk3-module-debuginfo-1.1.3-5.3.1 libpackagekit-glib2-18-1.1.3-5.3.1 libpackagekit-glib2-18-debuginfo-1.1.3-5.3.1 libpackagekit-glib2-devel-1.1.3-5.3.1 typelib-1_0-PackageKitGlib-1_0-1.1.3-5.3.1 - openSUSE Leap 42.3 (x86_64): libpackagekit-glib2-18-32bit-1.1.3-5.3.1 libpackagekit-glib2-18-debuginfo-32bit-1.1.3-5.3.1 libpackagekit-glib2-devel-32bit-1.1.3-5.3.1 - openSUSE Leap 42.3 (noarch): PackageKit-branding-upstream-1.1.3-5.3.1 PackageKit-lang-1.1.3-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1106.html https://bugzilla.suse.com/1086936

1 0

openSUSE-OU-2018:1045-1: moderate: Optional update to add dehydrated to the SUSE PackageHub
by maintenance＠opensuse.org 23 Apr '18

23 Apr '18

openSUSE Optional Update: Optional update to add dehydrated to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:1045-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This updates adds dehydrated to the SUSE PackageHub. Dehydrated is an implementation of the ACMEv2 protocol as used by Let's Encrypt. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-385=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): dehydrated-0.6.1-2.1 dehydrated-apache2-0.6.1-2.1 References:

1 0

openSUSE-RU-2018:1043-1: Recommended update for timezone, timezone-java
by maintenance＠opensuse.org 20 Apr '18

20 Apr '18

openSUSE Recommended Update: Recommended update for timezone, timezone-java ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1043-1 Rating: low References: #1086729 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2018d) for your system, including following changes: - In 2018, Palestine starts DST on March 24, not March 31. - Casey Station in Antarctica changed from +11 to +08 on 2018-03-11 at 04:00 (bsc#1086729). - corrections for historical transitions. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-380=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): timezone-2018d-48.1 timezone-debuginfo-2018d-48.1 timezone-debugsource-2018d-48.1 - openSUSE Leap 42.3 (noarch): timezone-java-2018d-0.48.1 References: https://bugzilla.suse.com/1086729

1 0

openSUSE-SU-2018:1042-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1042-1 Rating: important References: #1086199 #1090000 Cross-References: CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102 CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106 CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114 CVE-2018-6115 CVE-2018-6116 CVE-2018-6117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for Chromium to version 66.0.3359.117 fixes the following issues: Security issues fixed (boo#1090000): - CVE-2018-6085: Use after free in Disk Cache - CVE-2018-6086: Use after free in Disk Cache - CVE-2018-6087: Use after free in WebAssembly - CVE-2018-6088: Use after free in PDFium - CVE-2018-6089: Same origin policy bypass in Service Worker - CVE-2018-6090: Heap buffer overflow in Skia - CVE-2018-6091: Incorrect handling of plug-ins by Service Worker - CVE-2018-6092: Integer overflow in WebAssembly - CVE-2018-6093: Same origin bypass in Service Worker - CVE-2018-6094: Exploit hardening regression in Oilpan - CVE-2018-6095: Lack of meaningful user interaction requirement before file upload - CVE-2018-6096: Fullscreen UI spoof - CVE-2018-6097: Fullscreen UI spoof - CVE-2018-6098: URL spoof in Omnibox - CVE-2018-6099: CORS bypass in ServiceWorker - CVE-2018-6100: URL spoof in Omnibox - CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools - CVE-2018-6102: URL spoof in Omnibox - CVE-2018-6103: UI spoof in Permissions - CVE-2018-6104: URL spoof in Omnibox - CVE-2018-6105: URL spoof in Omnibox - CVE-2018-6106: Incorrect handling of promises in V8 - CVE-2018-6107: URL spoof in Omnibox - CVE-2018-6108: URL spoof in Omnibox - CVE-2018-6109: Incorrect handling of files by FileAPI - CVE-2018-6110: Incorrect handling of plaintext files via file:// - CVE-2018-6111: Heap-use-after-free in DevTools - CVE-2018-6112: Incorrect URL handling in DevTools - CVE-2018-6113: URL spoof in Navigation - CVE-2018-6114: CSP bypass - CVE-2018-6115: SmartScreen bypass in downloads - CVE-2018-6116: Incorrect low memory handling in WebAssembly - CVE-2018-6117: Confusing autofill settings - Various fixes from internal audits, fuzzing and other initiatives This update also supports mitigation against the Spectre vulnerabilities: "Strict site isolation" is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out The following other changes are included: - distrust certificates issued by Symantec before 2016-06-01 - add option to export saved passwords - Reduce videos that auto-play with sound - boo#1086199: Fix UI freezing when loading/scaling down large images This update also contains a number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-381=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-66.0.3359.117-152.1 chromedriver-debuginfo-66.0.3359.117-152.1 chromium-66.0.3359.117-152.1 chromium-debuginfo-66.0.3359.117-152.1 chromium-debugsource-66.0.3359.117-152.1 References: https://www.suse.com/security/cve/CVE-2018-6085.html https://www.suse.com/security/cve/CVE-2018-6086.html https://www.suse.com/security/cve/CVE-2018-6087.html https://www.suse.com/security/cve/CVE-2018-6088.html https://www.suse.com/security/cve/CVE-2018-6089.html https://www.suse.com/security/cve/CVE-2018-6090.html https://www.suse.com/security/cve/CVE-2018-6091.html https://www.suse.com/security/cve/CVE-2018-6092.html https://www.suse.com/security/cve/CVE-2018-6093.html https://www.suse.com/security/cve/CVE-2018-6094.html https://www.suse.com/security/cve/CVE-2018-6095.html https://www.suse.com/security/cve/CVE-2018-6096.html https://www.suse.com/security/cve/CVE-2018-6097.html https://www.suse.com/security/cve/CVE-2018-6098.html https://www.suse.com/security/cve/CVE-2018-6099.html https://www.suse.com/security/cve/CVE-2018-6100.html https://www.suse.com/security/cve/CVE-2018-6101.html https://www.suse.com/security/cve/CVE-2018-6102.html https://www.suse.com/security/cve/CVE-2018-6103.html https://www.suse.com/security/cve/CVE-2018-6104.html https://www.suse.com/security/cve/CVE-2018-6105.html https://www.suse.com/security/cve/CVE-2018-6106.html https://www.suse.com/security/cve/CVE-2018-6107.html https://www.suse.com/security/cve/CVE-2018-6108.html https://www.suse.com/security/cve/CVE-2018-6109.html https://www.suse.com/security/cve/CVE-2018-6110.html https://www.suse.com/security/cve/CVE-2018-6111.html https://www.suse.com/security/cve/CVE-2018-6112.html https://www.suse.com/security/cve/CVE-2018-6113.html https://www.suse.com/security/cve/CVE-2018-6114.html https://www.suse.com/security/cve/CVE-2018-6115.html https://www.suse.com/security/cve/CVE-2018-6116.html https://www.suse.com/security/cve/CVE-2018-6117.html https://bugzilla.suse.com/1086199 https://bugzilla.suse.com/1090000

1 0

openSUSE-SU-2018:1041-1: moderate: Security update for mbedtls
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

openSUSE Security Update: Security update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1041-1 Rating: moderate References: #1089021 #1089022 Cross-References: CVE-2018-9988 CVE-2018-9989 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mbedtls fixes the following issues: Security issues fixed: - CVE-2018-9988: Fixed buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input (boo#1089022). - CVE-2018-9989: Fixed buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input (boo#1089021). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-382=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libmbedtls9-1.3.19-14.1 libmbedtls9-debuginfo-1.3.19-14.1 mbedtls-debugsource-1.3.19-14.1 mbedtls-devel-1.3.19-14.1 References: https://www.suse.com/security/cve/CVE-2018-9988.html https://www.suse.com/security/cve/CVE-2018-9989.html https://bugzilla.suse.com/1089021 https://bugzilla.suse.com/1089022

1 0

openSUSE-SU-2018:1040-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 20 Apr '18

20 Apr '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1040-1 Rating: moderate References: #1087402 Cross-References: CVE-2017-0936 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud fixes the following issues: Security issue fixed: - CVE-2017-0936: Nextcloud Server before 11.0.7 suffers from an Authorization Bypass Through User-Controlled Key vulnerability (boo#1087402). Bug fixes: - See online release notes for all relevant changes. https://nextcloud.com/changelog/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-384=1 Package List: - openSUSE Leap 42.3 (noarch): nextcloud-13.0.1-6.1 References: https://www.suse.com/security/cve/CVE-2017-0936.html https://bugzilla.suse.com/1087402

1 0