April 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0892-1: moderate: Security update for spice-gtk
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0892-1 Rating: moderate References: #1085415 Cross-References: CVE-2017-12194 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice-gtk fixes the following issues: - CVE-2017-12194: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable. (bsc#1085415) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-342=1 Package List: - openSUSE Leap 42.3 (x86_64): libspice-client-glib-2_0-8-0.33-2.3.1 libspice-client-glib-2_0-8-debuginfo-0.33-2.3.1 libspice-client-glib-helper-0.33-2.3.1 libspice-client-glib-helper-debuginfo-0.33-2.3.1 libspice-client-gtk-3_0-5-0.33-2.3.1 libspice-client-gtk-3_0-5-debuginfo-0.33-2.3.1 libspice-controller0-0.33-2.3.1 libspice-controller0-debuginfo-0.33-2.3.1 spice-gtk-0.33-2.3.1 spice-gtk-debuginfo-0.33-2.3.1 spice-gtk-debugsource-0.33-2.3.1 spice-gtk-devel-0.33-2.3.1 typelib-1_0-SpiceClientGlib-2_0-0.33-2.3.1 typelib-1_0-SpiceClientGtk-3_0-0.33-2.3.1 - openSUSE Leap 42.3 (noarch): spice-gtk-lang-0.33-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-12194.html https://bugzilla.suse.com/1085415

1 0

openSUSE-SU-2018:0891-1: moderate: Security update for libidn
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for libidn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0891-1 Rating: moderate References: #1056450 Cross-References: CVE-2017-14062 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libidn fixes the following issue: - CVE-2017-14062: Prevent integer overflow in the decode_digit function that allowed remote attackers to cause a denial of service or possibly have unspecified other impact (bsc#1056450). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-341=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libidn-debugsource-1.28-9.3.1 libidn-devel-1.28-9.3.1 libidn-tools-1.28-9.3.1 libidn-tools-debuginfo-1.28-9.3.1 libidn11-1.28-9.3.1 libidn11-debuginfo-1.28-9.3.1 - openSUSE Leap 42.3 (x86_64): libidn11-32bit-1.28-9.3.1 libidn11-debuginfo-32bit-1.28-9.3.1 References: https://www.suse.com/security/cve/CVE-2017-14062.html https://bugzilla.suse.com/1056450

1 0

openSUSE-SU-2018:0890-1: moderate: Security update for postgresql94
by opensuse-security＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0890-1 Rating: moderate References: #1081925 Cross-References: CVE-2018-1058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql94 fixes the following issues: Security issues fixed: - CVE-2018-1058: Fixed uncontrolled search path element in pg_dump and other client applications (bsc#1081925). Bug fixes: - See release notes for details: * https://www.postgresql.org/docs/9.4/static/release-9-4-17.html * https://www.postgresql.org/docs/9.4/static/release-9-4-16.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-340=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql94-9.4.17-21.1 postgresql94-contrib-9.4.17-21.1 postgresql94-contrib-debuginfo-9.4.17-21.1 postgresql94-debuginfo-9.4.17-21.1 postgresql94-debugsource-9.4.17-21.1 postgresql94-devel-9.4.17-21.1 postgresql94-devel-debuginfo-9.4.17-21.1 postgresql94-libs-debugsource-9.4.17-21.1 postgresql94-plperl-9.4.17-21.1 postgresql94-plperl-debuginfo-9.4.17-21.1 postgresql94-plpython-9.4.17-21.1 postgresql94-plpython-debuginfo-9.4.17-21.1 postgresql94-pltcl-9.4.17-21.1 postgresql94-pltcl-debuginfo-9.4.17-21.1 postgresql94-server-9.4.17-21.1 postgresql94-server-debuginfo-9.4.17-21.1 postgresql94-test-9.4.17-21.1 - openSUSE Leap 42.3 (noarch): postgresql94-docs-9.4.17-21.1 References: https://www.suse.com/security/cve/CVE-2018-1058.html https://bugzilla.suse.com/1081925

1 0

openSUSE-RU-2018:0889-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0889-1 Rating: moderate References: #1082022 #1085512 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for suse-build-key fixes the following issues: - The lifetime of the SUSE Linux Enterprise 11 signing key was extended (bsc#1085512) - A new security(a)suse.de E-Mail key was added (bsc#1082022) pub rsa4096/0x21FE92322BA9E067 2018-03-15 [SC] [expires: 2020-03-14] Key fingerprint = EC7C 5EAB 2C34 09A6 4F3B BE6E 21FE 9232 2BA9 E067 uid SUSE Security Team <security(a)suse.com> uid SUSE Security Team <security(a)suse.de> sub rsa4096/0xFF97314EC1E11A0E 2018-03-15 [E] [expires: 2020-03-14] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-338=1 Package List: - openSUSE Leap 42.3 (noarch): suse-build-key-12.0-14.3.1 References: https://bugzilla.suse.com/1082022 https://bugzilla.suse.com/1085512

1 0

openSUSE-RU-2018:0888-1: moderate: Recommended update for openSUSE-build-key
by maintenance＠opensuse.org 06 Apr '18

06 Apr '18

openSUSE Recommended Update: Recommended update for openSUSE-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0888-1 Rating: moderate References: #1082022 #1085512 #1087276 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for openSUSE-build-key fixes the following issues: - Refreshed the SUSE Linux Enterprise 11 build(a)suse.de key (boo#1085512) - Added the SUSE Linux Enterprise 12 and 15 build(a)suse.de key (boo#1087276) pub rsa2048/0x70AF9E8139DB7C82 2013-01-31 [SC] [expires: 2020-12-06] Key fingerprint = FEAB 5025 39D8 46DB 2C09 61CA 70AF 9E81 39DB 7C82 uid SuSE Package Signing Key <build(a)suse.de> - A new security(a)suse.de key has been established. (boo#1082022) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-339=1 Package List: - openSUSE Leap 42.3 (noarch): openSUSE-build-key-1.0-36.3.1 References: https://bugzilla.suse.com/1082022 https://bugzilla.suse.com/1085512 https://bugzilla.suse.com/1087276

1 0

openSUSE-RU-2018:0887-1: Recommended update for pesign-obs-integration
by maintenance＠opensuse.org 05 Apr '18

05 Apr '18

openSUSE Recommended Update: Recommended update for pesign-obs-integration ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0887-1 Rating: low References: #1012422 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pesign-obs-integration fixes the following issues: - Copy over any *.log files from the first build. (bsc#1012422) - Add aarch64 support. - Fall back to project's certificate in the follow-up spec if it exists. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-335=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): pesign-obs-integration-10.0-31.3.1 References: https://bugzilla.suse.com/1012422

1 0

openSUSE-RU-2018:0886-1: Recommended update for aaa_base
by maintenance＠opensuse.org 05 Apr '18

05 Apr '18

openSUSE Recommended Update: Recommended update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0886-1 Rating: low References: #1025743 #1036895 #1038549 #1049577 #1052182 #1079674 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for aaa_base provides the following fixes: - Support changing PS1 even for mksh and user root. (bsc#1036895) - Unset unused variables on profile files. (bsc#1049577) - Unset id in csh.cshrc instead of profile.csh. (bsc#1049577) - Allow that personal ~/.bashrc is read again. (bsc#1052182) - Avoid that IFS becomes global in _ls ksh shell function. (bsc#1079674, bsc#1025743) - Replace "cat > file" by "mv -f ... file" in pre/post to fix issues with clients having these files mmapped. (bsc#1038549) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-331=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aaa_base-13.2+git20140911.61c1681-28.3.1 aaa_base-debuginfo-13.2+git20140911.61c1681-28.3.1 aaa_base-debugsource-13.2+git20140911.61c1681-28.3.1 aaa_base-extras-13.2+git20140911.61c1681-28.3.1 aaa_base-malloccheck-13.2+git20140911.61c1681-28.3.1 References: https://bugzilla.suse.com/1025743 https://bugzilla.suse.com/1036895 https://bugzilla.suse.com/1038549 https://bugzilla.suse.com/1049577 https://bugzilla.suse.com/1052182 https://bugzilla.suse.com/1079674

1 0

openSUSE-RU-2018:0885-1: Recommended update for growpart
by maintenance＠opensuse.org 05 Apr '18

05 Apr '18

openSUSE Recommended Update: Recommended update for growpart ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0885-1 Rating: low References: #1064755 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for growpart fixes the following issues: - Add rootgrow script and service wrapper - Ignore sfdisk failure in 2.28.1 when due to reread failing. - Add service file to start growpart via systemd. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-334=1 Package List: - openSUSE Leap 42.3 (noarch): growpart-0.30-11.3.1 growpart-rootgrow-1.0.0-11.3.1 References: https://bugzilla.suse.com/1064755

1 0

openSUSE-RU-2018:0884-1: Recommended update for autoyast2
by maintenance＠opensuse.org 05 Apr '18

05 Apr '18

openSUSE Recommended Update: Recommended update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0884-1 Rating: low References: #1054400 #1057597 #1059617 #1077292 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for autoyast2 provides the following fixes: - When using Btrfs but without subvolumes, export an empty list instead of removing them from the profile. (bsc#1059617) - Shrink needed disks size automatically in order to handle rounding inaccuracies in LVM installations. (bsc#1057597) - Add default subvolumes to the root partition only if the user has not defined any root partition in the autoyast configuration file. (bsc#1059617) - Add the network_before_proposal flag that will be enable if the network is configured during the first stage. (bsc#1054400) - Report packages which cannot be selected for installation, except those packages not included in the AutoYaST profile. (bnc#1077292) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-332=1 Package List: - openSUSE Leap 42.3 (noarch): autoyast2-3.2.29-6.1 autoyast2-installation-3.2.29-6.1 References: https://bugzilla.suse.com/1054400 https://bugzilla.suse.com/1057597 https://bugzilla.suse.com/1059617 https://bugzilla.suse.com/1077292

1 0

openSUSE-SU-2018:0883-1: moderate: Security update for graphite2
by opensuse-security＠opensuse.org 05 Apr '18

05 Apr '18

openSUSE Security Update: Security update for graphite2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0883-1 Rating: moderate References: #1084850 Cross-References: CVE-2018-7999 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for graphite2 fixes the following issues: - CVE-2018-7999: Fixed a NULL pointer dereference vulnerability in Segment.cpp that may cause a denial of serivce (bsc#1084850). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-337=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): graphite2-1.3.1-7.3.1 graphite2-debuginfo-1.3.1-7.3.1 graphite2-debugsource-1.3.1-7.3.1 graphite2-devel-1.3.1-7.3.1 libgraphite2-3-1.3.1-7.3.1 libgraphite2-3-debuginfo-1.3.1-7.3.1 - openSUSE Leap 42.3 (x86_64): libgraphite2-3-32bit-1.3.1-7.3.1 libgraphite2-3-debuginfo-32bit-1.3.1-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-7999.html https://bugzilla.suse.com/1084850

1 0