May 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1328-1: moderate: Recommended update for seccheck
by maintenance＠opensuse.org 17 May '18

17 May '18

openSUSE Recommended Update: Recommended update for seccheck ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1328-1 Rating: moderate References: #1021036 #1033244 #1084449 #1084758 #985802 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for seccheck fixes the following issues: - boo#985802: security monthly reports - boo#1021036: mute stderr on sysctl -a - boo#1033244: john integration was broken - boo#1084449: email from field control - boo#1084758: clean old temporary files Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-469=1 Package List: - openSUSE Leap 42.3 (noarch): seccheck-3.0-14.3.1 References: https://bugzilla.suse.com/1021036 https://bugzilla.suse.com/1033244 https://bugzilla.suse.com/1084449 https://bugzilla.suse.com/1084758 https://bugzilla.suse.com/985802

1 0

openSUSE-RU-2018:1318-1: Recommended update for timezone, timezone-java
by maintenance＠opensuse.org 16 May '18

16 May '18

openSUSE Recommended Update: Recommended update for timezone, timezone-java ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1318-1 Rating: low References: #1073299 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2018e) for your system, including following changes: - North Korea switches back from +0830 to +09 on 2018-05-05. - Ireland's standard time is in the summer, with negative DST offset to standard time used in Winter (bsc#1073299) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-461=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): timezone-2018e-51.1 timezone-debuginfo-2018e-51.1 timezone-debugsource-2018e-51.1 - openSUSE Leap 42.3 (noarch): timezone-java-2018e-0.51.1 References: https://bugzilla.suse.com/1073299

1 0

openSUSE-SU-2018:1317-1: important: Security update for php5
by opensuse-security＠opensuse.org 16 May '18

16 May '18

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1317-1 Rating: important References: #1091355 #1091362 #1091363 #1091367 Cross-References: CVE-2018-10545 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php5 fixes the following issues: Security issues fixed: - CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367). - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362). - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363). - CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-465=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-100.1 apache2-mod_php5-debuginfo-5.5.14-100.1 php5-5.5.14-100.1 php5-bcmath-5.5.14-100.1 php5-bcmath-debuginfo-5.5.14-100.1 php5-bz2-5.5.14-100.1 php5-bz2-debuginfo-5.5.14-100.1 php5-calendar-5.5.14-100.1 php5-calendar-debuginfo-5.5.14-100.1 php5-ctype-5.5.14-100.1 php5-ctype-debuginfo-5.5.14-100.1 php5-curl-5.5.14-100.1 php5-curl-debuginfo-5.5.14-100.1 php5-dba-5.5.14-100.1 php5-dba-debuginfo-5.5.14-100.1 php5-debuginfo-5.5.14-100.1 php5-debugsource-5.5.14-100.1 php5-devel-5.5.14-100.1 php5-dom-5.5.14-100.1 php5-dom-debuginfo-5.5.14-100.1 php5-enchant-5.5.14-100.1 php5-enchant-debuginfo-5.5.14-100.1 php5-exif-5.5.14-100.1 php5-exif-debuginfo-5.5.14-100.1 php5-fastcgi-5.5.14-100.1 php5-fastcgi-debuginfo-5.5.14-100.1 php5-fileinfo-5.5.14-100.1 php5-fileinfo-debuginfo-5.5.14-100.1 php5-firebird-5.5.14-100.1 php5-firebird-debuginfo-5.5.14-100.1 php5-fpm-5.5.14-100.1 php5-fpm-debuginfo-5.5.14-100.1 php5-ftp-5.5.14-100.1 php5-ftp-debuginfo-5.5.14-100.1 php5-gd-5.5.14-100.1 php5-gd-debuginfo-5.5.14-100.1 php5-gettext-5.5.14-100.1 php5-gettext-debuginfo-5.5.14-100.1 php5-gmp-5.5.14-100.1 php5-gmp-debuginfo-5.5.14-100.1 php5-iconv-5.5.14-100.1 php5-iconv-debuginfo-5.5.14-100.1 php5-imap-5.5.14-100.1 php5-imap-debuginfo-5.5.14-100.1 php5-intl-5.5.14-100.1 php5-intl-debuginfo-5.5.14-100.1 php5-json-5.5.14-100.1 php5-json-debuginfo-5.5.14-100.1 php5-ldap-5.5.14-100.1 php5-ldap-debuginfo-5.5.14-100.1 php5-mbstring-5.5.14-100.1 php5-mbstring-debuginfo-5.5.14-100.1 php5-mcrypt-5.5.14-100.1 php5-mcrypt-debuginfo-5.5.14-100.1 php5-mssql-5.5.14-100.1 php5-mssql-debuginfo-5.5.14-100.1 php5-mysql-5.5.14-100.1 php5-mysql-debuginfo-5.5.14-100.1 php5-odbc-5.5.14-100.1 php5-odbc-debuginfo-5.5.14-100.1 php5-opcache-5.5.14-100.1 php5-opcache-debuginfo-5.5.14-100.1 php5-openssl-5.5.14-100.1 php5-openssl-debuginfo-5.5.14-100.1 php5-pcntl-5.5.14-100.1 php5-pcntl-debuginfo-5.5.14-100.1 php5-pdo-5.5.14-100.1 php5-pdo-debuginfo-5.5.14-100.1 php5-pgsql-5.5.14-100.1 php5-pgsql-debuginfo-5.5.14-100.1 php5-phar-5.5.14-100.1 php5-phar-debuginfo-5.5.14-100.1 php5-posix-5.5.14-100.1 php5-posix-debuginfo-5.5.14-100.1 php5-pspell-5.5.14-100.1 php5-pspell-debuginfo-5.5.14-100.1 php5-readline-5.5.14-100.1 php5-readline-debuginfo-5.5.14-100.1 php5-shmop-5.5.14-100.1 php5-shmop-debuginfo-5.5.14-100.1 php5-snmp-5.5.14-100.1 php5-snmp-debuginfo-5.5.14-100.1 php5-soap-5.5.14-100.1 php5-soap-debuginfo-5.5.14-100.1 php5-sockets-5.5.14-100.1 php5-sockets-debuginfo-5.5.14-100.1 php5-sqlite-5.5.14-100.1 php5-sqlite-debuginfo-5.5.14-100.1 php5-suhosin-5.5.14-100.1 php5-suhosin-debuginfo-5.5.14-100.1 php5-sysvmsg-5.5.14-100.1 php5-sysvmsg-debuginfo-5.5.14-100.1 php5-sysvsem-5.5.14-100.1 php5-sysvsem-debuginfo-5.5.14-100.1 php5-sysvshm-5.5.14-100.1 php5-sysvshm-debuginfo-5.5.14-100.1 php5-tidy-5.5.14-100.1 php5-tidy-debuginfo-5.5.14-100.1 php5-tokenizer-5.5.14-100.1 php5-tokenizer-debuginfo-5.5.14-100.1 php5-wddx-5.5.14-100.1 php5-wddx-debuginfo-5.5.14-100.1 php5-xmlreader-5.5.14-100.1 php5-xmlreader-debuginfo-5.5.14-100.1 php5-xmlrpc-5.5.14-100.1 php5-xmlrpc-debuginfo-5.5.14-100.1 php5-xmlwriter-5.5.14-100.1 php5-xmlwriter-debuginfo-5.5.14-100.1 php5-xsl-5.5.14-100.1 php5-xsl-debuginfo-5.5.14-100.1 php5-zip-5.5.14-100.1 php5-zip-debuginfo-5.5.14-100.1 php5-zlib-5.5.14-100.1 php5-zlib-debuginfo-5.5.14-100.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-100.1 References: https://www.suse.com/security/cve/CVE-2018-10545.html https://www.suse.com/security/cve/CVE-2018-10546.html https://www.suse.com/security/cve/CVE-2018-10547.html https://www.suse.com/security/cve/CVE-2018-10548.html https://bugzilla.suse.com/1091355 https://bugzilla.suse.com/1091362 https://bugzilla.suse.com/1091363 https://bugzilla.suse.com/1091367

1 0

openSUSE-RU-2018:1316-1: important: Recommended update for clamav
by maintenance＠opensuse.org 16 May '18

16 May '18

openSUSE Recommended Update: Recommended update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1316-1 Rating: important References: #1089502 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for clamav fixes the following issues: Clamav was updated to version 0.100.0 (bsc#1089502): * Add interfaces to the Prelude SIEM open source package for collecting ClamAV virus events. * Support libmspack internal code or as a shared object library. The internal library is the default and includes modifications to enable parsing of CAB files that do not entirely adhere to the CAB file format. * Link with OpenSSL 1.1.0. * Deprecate of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default. * Deprecate internal LLVM code support. * Compute and check PE import table hash (a.k.a. "imphash") signatures. * Support file property collection and analysis for MHTML files. * Raw scanning of PostScript files. * Fix clamsubmit to use the new virus and false positive submission web interface. * Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded. * Improved decoders for PDF files. * Reduced number of compile time warnings. * Improved support for C++11. * Improved detection of system installed libraries. * Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures. * Improvements to clamd's On-Access scanning capabilities for Linux. Re-introduce removed options as deprecated, so that clamd and freshclam don't exit on startup with an old config file This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-462=1 Package List: - openSUSE Leap 42.3 (x86_64): clamav-0.100.0-26.1 clamav-debuginfo-0.100.0-26.1 clamav-debugsource-0.100.0-26.1 References: https://bugzilla.suse.com/1089502

1 0

openSUSE-RU-2018:1315-1: moderate: Recommended update for binutils
by maintenance＠opensuse.org 16 May '18

16 May '18

openSUSE Recommended Update: Recommended update for binutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1315-1 Rating: moderate References: #1075418 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for binutils fixes the following issues: - Fix pacemaker libqb problem with section start/stop symbols. (bsc#1075418) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-464=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): binutils-2.29.1-16.1 binutils-debuginfo-2.29.1-16.1 binutils-debugsource-2.29.1-16.1 binutils-devel-2.29.1-16.1 binutils-gold-2.29.1-16.1 binutils-gold-debuginfo-2.29.1-16.1 cross-aarch64-binutils-2.29.1-16.1 cross-aarch64-binutils-debuginfo-2.29.1-16.1 cross-aarch64-binutils-debugsource-2.29.1-16.1 cross-arm-binutils-2.29.1-16.1 cross-arm-binutils-debuginfo-2.29.1-16.1 cross-arm-binutils-debugsource-2.29.1-16.1 cross-avr-binutils-2.29.1-16.1 cross-avr-binutils-debuginfo-2.29.1-16.1 cross-avr-binutils-debugsource-2.29.1-16.1 cross-hppa-binutils-2.29.1-16.1 cross-hppa-binutils-debuginfo-2.29.1-16.1 cross-hppa-binutils-debugsource-2.29.1-16.1 cross-hppa64-binutils-2.29.1-16.1 cross-hppa64-binutils-debuginfo-2.29.1-16.1 cross-hppa64-binutils-debugsource-2.29.1-16.1 cross-ia64-binutils-2.29.1-16.1 cross-ia64-binutils-debuginfo-2.29.1-16.1 cross-ia64-binutils-debugsource-2.29.1-16.1 cross-m68k-binutils-2.29.1-16.1 cross-m68k-binutils-debuginfo-2.29.1-16.1 cross-m68k-binutils-debugsource-2.29.1-16.1 cross-mips-binutils-2.29.1-16.1 cross-mips-binutils-debuginfo-2.29.1-16.1 cross-mips-binutils-debugsource-2.29.1-16.1 cross-ppc-binutils-2.29.1-16.1 cross-ppc-binutils-debuginfo-2.29.1-16.1 cross-ppc-binutils-debugsource-2.29.1-16.1 cross-ppc64-binutils-2.29.1-16.1 cross-ppc64-binutils-debuginfo-2.29.1-16.1 cross-ppc64-binutils-debugsource-2.29.1-16.1 cross-ppc64le-binutils-2.29.1-16.1 cross-ppc64le-binutils-debuginfo-2.29.1-16.1 cross-ppc64le-binutils-debugsource-2.29.1-16.1 cross-s390-binutils-2.29.1-16.1 cross-s390-binutils-debuginfo-2.29.1-16.1 cross-s390-binutils-debugsource-2.29.1-16.1 cross-s390x-binutils-2.29.1-16.1 cross-s390x-binutils-debuginfo-2.29.1-16.1 cross-s390x-binutils-debugsource-2.29.1-16.1 cross-sparc-binutils-2.29.1-16.1 cross-sparc-binutils-debuginfo-2.29.1-16.1 cross-sparc-binutils-debugsource-2.29.1-16.1 cross-sparc64-binutils-2.29.1-16.1 cross-sparc64-binutils-debuginfo-2.29.1-16.1 cross-sparc64-binutils-debugsource-2.29.1-16.1 cross-spu-binutils-2.29.1-16.1 cross-spu-binutils-debuginfo-2.29.1-16.1 cross-spu-binutils-debugsource-2.29.1-16.1 - openSUSE Leap 42.3 (x86_64): binutils-devel-32bit-2.29.1-16.1 cross-i386-binutils-2.29.1-16.1 cross-i386-binutils-debuginfo-2.29.1-16.1 cross-i386-binutils-debugsource-2.29.1-16.1 - openSUSE Leap 42.3 (i586): cross-x86_64-binutils-2.29.1-16.1 cross-x86_64-binutils-debuginfo-2.29.1-16.1 cross-x86_64-binutils-debugsource-2.29.1-16.1 References: https://bugzilla.suse.com/1075418

1 0

openSUSE-RU-2018:1314-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 16 May '18

16 May '18

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1314-1 Rating: moderate References: #1092933 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner fixes the following issues: - Version update to 1.0.8 (boo#1092933): * Be case insensitive on license detection * Exclude limit_build from bracketing * Replace _libexecdir as we now do not really bother about SLE11 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-463=1 Package List: - openSUSE Leap 42.3 (noarch): spec-cleaner-1.0.8-46.1 spec-cleaner-format_spec_file-1.0.8-46.1 References: https://bugzilla.suse.com/1092933

1 0

openSUSE-RU-2018:1313-1: important: Recommended update for SUSEConnect
by maintenance＠opensuse.org 16 May '18

16 May '18

openSUSE Recommended Update: Recommended update for SUSEConnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1313-1 Rating: important References: #1064264 #1086420 #1089320 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for SUSEConnect provides the following fixes: - Enable access to package search via gem - Don't try to delete the directory of nonexistent service files. (bsc#1086420) - Fix list-extensions to show the full SLE 15 tree. (bsc#1064264) - Enable automatic activation of recommended extensions/modules. - Automatically deregister all installed extensions/modules when deregistering a system. - Fix rollback mechanism on SLE15 systems (bsc#1089320) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-460=1 Package List: - openSUSE Leap 42.3 (x86_64): SUSEConnect-0.3.10-2.6.1 References: https://bugzilla.suse.com/1064264 https://bugzilla.suse.com/1086420 https://bugzilla.suse.com/1089320

1 0

openSUSE-RU-2018:1312-1: moderate: Recommended update for Mozilla Firefox
by maintenance＠opensuse.org 16 May '18

16 May '18

openSUSE Recommended Update: Recommended update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1312-1 Rating: moderate References: #1092548 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides Mozilla Firefox 60.0 ESR, with the following improvements: - New browser engine with speed improvements - Redesigned graphical user interface elements - Unified address and search bar for new installations - New tab page listing top visited, recently visited and recommended pages - Support for configuration policies in enterprise deployments via JSON files - Support for Web Authentication, allowing the use of USB tokens for authentication to web sites The following changes affect compatibility: - now exclusively supports extensions built using the WebExtension API - Unsupported legacy extensions will no longer work in Firefox 60 ESR - TLS certificates issued by Symantec before June 1st, 2016 are no longer trusted The "security.pki.distrust_ca_policy" preference can be set to 0 to reinstate trust in those certificates The following issues affect performance: - new format for storing private keys, certificates and certificate trust If the user home or data directory is on a network file system, it is recommended that users set the following environment variable to avoid slowdowns: NSS_SDB_USE_CACHE=yes This setting is not recommended for local, fast file systems. The following item is specific to the ESR channel of releases: - Service workers and push notifications remain disabled in Firefox ESR - The Mozilla Firefox packages in openSUSE Leap 42.3 will continue to follow the upstream ESR releases. This update does not contain vulnerability fixes relative to 52.8.0, but is recommended for all users. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-468=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.0-95.1 MozillaFirefox-branding-upstream-60.0-95.1 MozillaFirefox-buildsymbols-60.0-95.1 MozillaFirefox-debuginfo-60.0-95.1 MozillaFirefox-debugsource-60.0-95.1 MozillaFirefox-devel-60.0-95.1 MozillaFirefox-translations-common-60.0-95.1 MozillaFirefox-translations-other-60.0-95.1 References: https://bugzilla.suse.com/1092548

1 0

openSUSE-SU-2018:1311-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 16 May '18

16 May '18

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1311-1 Rating: moderate References: #1089705 #1089706 #1090737 #1091772 #915996 Cross-References: CVE-2018-10119 CVE-2018-10120 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues: Security issues fixed: - CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record. (bsc#1089706) - CVE-2018-10119: sot/source/sdstor/stgstrms.cxx used an incorrect integer data type in the StgSmallStrm class, which allowed remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format. (bsc#1089705) Other issues fixed: - DOCX import: missing table background color - Bring back offline help per popular demand as lto saves space we could use with it bsc#915996 This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-467=1 Package List: - openSUSE Leap 42.3 (x86_64): libreoffice-6.0.4.2-21.1 libreoffice-base-6.0.4.2-21.1 libreoffice-base-debuginfo-6.0.4.2-21.1 libreoffice-base-drivers-mysql-6.0.4.2-21.1 libreoffice-base-drivers-mysql-debuginfo-6.0.4.2-21.1 libreoffice-base-drivers-postgresql-6.0.4.2-21.1 libreoffice-base-drivers-postgresql-debuginfo-6.0.4.2-21.1 libreoffice-calc-6.0.4.2-21.1 libreoffice-calc-debuginfo-6.0.4.2-21.1 libreoffice-calc-extensions-6.0.4.2-21.1 libreoffice-debuginfo-6.0.4.2-21.1 libreoffice-debugsource-6.0.4.2-21.1 libreoffice-draw-6.0.4.2-21.1 libreoffice-draw-debuginfo-6.0.4.2-21.1 libreoffice-filters-optional-6.0.4.2-21.1 libreoffice-gnome-6.0.4.2-21.1 libreoffice-gnome-debuginfo-6.0.4.2-21.1 libreoffice-gtk2-6.0.4.2-21.1 libreoffice-gtk2-debuginfo-6.0.4.2-21.1 libreoffice-gtk3-6.0.4.2-21.1 libreoffice-gtk3-debuginfo-6.0.4.2-21.1 libreoffice-impress-6.0.4.2-21.1 libreoffice-impress-debuginfo-6.0.4.2-21.1 libreoffice-kde4-6.0.4.2-21.1 libreoffice-kde4-debuginfo-6.0.4.2-21.1 libreoffice-mailmerge-6.0.4.2-21.1 libreoffice-math-6.0.4.2-21.1 libreoffice-math-debuginfo-6.0.4.2-21.1 libreoffice-officebean-6.0.4.2-21.1 libreoffice-officebean-debuginfo-6.0.4.2-21.1 libreoffice-pyuno-6.0.4.2-21.1 libreoffice-pyuno-debuginfo-6.0.4.2-21.1 libreoffice-sdk-6.0.4.2-21.1 libreoffice-sdk-debuginfo-6.0.4.2-21.1 libreoffice-sdk-doc-6.0.4.2-21.1 libreoffice-writer-6.0.4.2-21.1 libreoffice-writer-debuginfo-6.0.4.2-21.1 libreoffice-writer-extensions-6.0.4.2-21.1 libreofficekit-6.0.4.2-21.1 libreofficekit-devel-6.0.4.2-21.1 - openSUSE Leap 42.3 (noarch): libreoffice-branding-upstream-6.0.4.2-21.1 libreoffice-gdb-pretty-printers-6.0.4.2-21.1 libreoffice-glade-6.0.4.2-21.1 libreoffice-icon-themes-6.0.4.2-21.1 libreoffice-l10n-af-6.0.4.2-21.1 libreoffice-l10n-ar-6.0.4.2-21.1 libreoffice-l10n-as-6.0.4.2-21.1 libreoffice-l10n-bg-6.0.4.2-21.1 libreoffice-l10n-bn-6.0.4.2-21.1 libreoffice-l10n-br-6.0.4.2-21.1 libreoffice-l10n-ca-6.0.4.2-21.1 libreoffice-l10n-cs-6.0.4.2-21.1 libreoffice-l10n-cy-6.0.4.2-21.1 libreoffice-l10n-da-6.0.4.2-21.1 libreoffice-l10n-de-6.0.4.2-21.1 libreoffice-l10n-dz-6.0.4.2-21.1 libreoffice-l10n-el-6.0.4.2-21.1 libreoffice-l10n-en-6.0.4.2-21.1 libreoffice-l10n-eo-6.0.4.2-21.1 libreoffice-l10n-es-6.0.4.2-21.1 libreoffice-l10n-et-6.0.4.2-21.1 libreoffice-l10n-eu-6.0.4.2-21.1 libreoffice-l10n-fa-6.0.4.2-21.1 libreoffice-l10n-fi-6.0.4.2-21.1 libreoffice-l10n-fr-6.0.4.2-21.1 libreoffice-l10n-ga-6.0.4.2-21.1 libreoffice-l10n-gl-6.0.4.2-21.1 libreoffice-l10n-gu-6.0.4.2-21.1 libreoffice-l10n-he-6.0.4.2-21.1 libreoffice-l10n-hi-6.0.4.2-21.1 libreoffice-l10n-hr-6.0.4.2-21.1 libreoffice-l10n-hu-6.0.4.2-21.1 libreoffice-l10n-it-6.0.4.2-21.1 libreoffice-l10n-ja-6.0.4.2-21.1 libreoffice-l10n-kk-6.0.4.2-21.1 libreoffice-l10n-kn-6.0.4.2-21.1 libreoffice-l10n-ko-6.0.4.2-21.1 libreoffice-l10n-lt-6.0.4.2-21.1 libreoffice-l10n-lv-6.0.4.2-21.1 libreoffice-l10n-mai-6.0.4.2-21.1 libreoffice-l10n-ml-6.0.4.2-21.1 libreoffice-l10n-mr-6.0.4.2-21.1 libreoffice-l10n-nb-6.0.4.2-21.1 libreoffice-l10n-nl-6.0.4.2-21.1 libreoffice-l10n-nn-6.0.4.2-21.1 libreoffice-l10n-nr-6.0.4.2-21.1 libreoffice-l10n-nso-6.0.4.2-21.1 libreoffice-l10n-or-6.0.4.2-21.1 libreoffice-l10n-pa-6.0.4.2-21.1 libreoffice-l10n-pl-6.0.4.2-21.1 libreoffice-l10n-pt_BR-6.0.4.2-21.1 libreoffice-l10n-pt_PT-6.0.4.2-21.1 libreoffice-l10n-ro-6.0.4.2-21.1 libreoffice-l10n-ru-6.0.4.2-21.1 libreoffice-l10n-si-6.0.4.2-21.1 libreoffice-l10n-sk-6.0.4.2-21.1 libreoffice-l10n-sl-6.0.4.2-21.1 libreoffice-l10n-sr-6.0.4.2-21.1 libreoffice-l10n-ss-6.0.4.2-21.1 libreoffice-l10n-st-6.0.4.2-21.1 libreoffice-l10n-sv-6.0.4.2-21.1 libreoffice-l10n-ta-6.0.4.2-21.1 libreoffice-l10n-te-6.0.4.2-21.1 libreoffice-l10n-th-6.0.4.2-21.1 libreoffice-l10n-tn-6.0.4.2-21.1 libreoffice-l10n-tr-6.0.4.2-21.1 libreoffice-l10n-ts-6.0.4.2-21.1 libreoffice-l10n-uk-6.0.4.2-21.1 libreoffice-l10n-ve-6.0.4.2-21.1 libreoffice-l10n-xh-6.0.4.2-21.1 libreoffice-l10n-zh_CN-6.0.4.2-21.1 libreoffice-l10n-zh_TW-6.0.4.2-21.1 libreoffice-l10n-zu-6.0.4.2-21.1 References: https://www.suse.com/security/cve/CVE-2018-10119.html https://www.suse.com/security/cve/CVE-2018-10120.html https://bugzilla.suse.com/1089705 https://bugzilla.suse.com/1089706 https://bugzilla.suse.com/1090737 https://bugzilla.suse.com/1091772 https://bugzilla.suse.com/915996

1 0

openSUSE-SU-2018:1310-1: moderate: Security update for librsvg
by opensuse-security＠opensuse.org 16 May '18

16 May '18

openSUSE Security Update: Security update for librsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1310-1 Rating: moderate References: #1083232 Cross-References: CVE-2018-1000041 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librsvg fixes the following issues: - CVE-2018-1000041: Input validation issue could lead to credentials leak. (bsc#1083232) Update to version 2.40.20: + Except for emergencies, this will be the LAST RELEASE of the librsvg-2.40.x series. We are moving to 2.41, which is vastly improved over the 2.40 series. The API/ABI there remain unchaged, so we strongly encourage you to upgrade your sources and binaries to librsvg-2.41.x. + bgo#761175 - Allow masks and clips to reuse a node being drawn. + Don't access the file system when deciding whether to load a remote file with a UNC path for a paint server (i.e. don't try to load it at all). + Vistual Studio: fixed and integrated introspection builds, so introspection data is built directly from the Visual Studio project (Chun-wei Fan). + Visual Studio: We now use HIGHENTROPYVA linker option on x64 builds, to enhance the security of built binaries (Chun-wei Fan). + Fix generation of Vala bindings when compiling in read-only source directories (Emmanuele Bassi). Update to version 2.40.19: + bgo#621088: Using text objects as clipping paths is now supported. + bgo#587721: Fix rendering of text elements with transformations (Massimo). + bgo#777833 - Fix memory leaks when an RsvgHandle is disposed before being closed (Philip Withnall). + bgo#782098 - Don't pass deprecated options to gtk-doc (Ting-Wei Lan). + bgo#786372 - Fix the default for the "type" attribute of the <style> element. + bgo#785276 - Don't crash on single-byte files. + bgo#634514: Don't render unknown elements and their sub-elements. + bgo#777155 - Ignore patterns that have close-to-zero dimensions. + bgo#634324 - Fix Gaussian blurs with negative scaling. + Fix the <switch> element; it wasn't working at all. + Fix loading when rsvg_handle_write() is called one byte at a time. + bgo#787895 - Fix incorrect usage of libxml2. Thanks to Nick Wellnhofer for advice on this. + Backported the test suite machinery from the master branch (Chun-wei Fan, Federico Mena). + We now require Pango 1.38.0 or later (released in 2015). + We now require libxml2 2.9.0 or later (released in 2012). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-466=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.40.20-15.1 gdk-pixbuf-loader-rsvg-debuginfo-2.40.20-15.1 librsvg-2-2-2.40.20-15.1 librsvg-2-2-debuginfo-2.40.20-15.1 librsvg-debugsource-2.40.20-15.1 librsvg-devel-2.40.20-15.1 rsvg-view-2.40.20-15.1 rsvg-view-debuginfo-2.40.20-15.1 typelib-1_0-Rsvg-2_0-2.40.20-15.1 - openSUSE Leap 42.3 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.40.20-15.1 gdk-pixbuf-loader-rsvg-debuginfo-32bit-2.40.20-15.1 librsvg-2-2-32bit-2.40.20-15.1 librsvg-2-2-debuginfo-32bit-2.40.20-15.1 - openSUSE Leap 42.3 (noarch): rsvg-thumbnailer-2.40.20-15.1 References: https://www.suse.com/security/cve/CVE-2018-1000041.html https://bugzilla.suse.com/1083232

1 0