May 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1290-1: moderate: Recommended update for mkdud
by maintenance＠opensuse.org 15 May '18

15 May '18

openSUSE Recommended Update: Recommended update for mkdud ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1290-1 Rating: moderate References: #1006175 #1012241 #1085261 #1087901 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for mkdud fixes the following issues: - adjust mkdud to work around a problem when updating coreutils (boo#1087901) - adjust CaaSP support (boo#1085261) - support creating a dud in rpm format (boo#1006175) - allow to skip distribution check using --force (boo#1012241) - support openSUSE Kubic - support CASP and extend documentation for --dist option - fix service pack condition check - follow casp -> caasp renaming - use latest git2log script from linuxrc-devtools package - more readable variable names - be more specific about dists that support DUDs as rpm - squash dashes ('-') to match more dist name spellings - adjust documentation to include rpm format - accept driver updates packed as rpm - even more verbose error message - fix Makefile and update git2log script - improve documentation Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-459=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): mkdud-1.34-9.1 References: https://bugzilla.suse.com/1006175 https://bugzilla.suse.com/1012241 https://bugzilla.suse.com/1085261 https://bugzilla.suse.com/1087901

1 0

openSUSE-RU-2018:1289-1: moderate: Recommended update for prosody
by maintenance＠opensuse.org 15 May '18

15 May '18

openSUSE Recommended Update: Recommended update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1289-1 Rating: moderate References: #1093088 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for prosody fixes the following issues: - Update to 0.9.13 (boo#1093088): Security: * Fix for compatibility with LuaSocket 3.0rc1 (fixes denial of service from remote) * mod_register: Require encryption before registration if c2s_require_encryption is set (fixes #595[1]) * MUC: Ensure that elements which match our from are stripped (fixes #1055[2]) Fixes and improvements: * Compatibility fix with newer LuaSec 0.6 (fixes #781[3]) * mod_presence: Send probe once subscribed (fixes #794[4]) * mod_net_multiplex: Enable SSL on the SSL port (fixes #803[5]) Minor changes: * core.rostermanager: Add method for checking if the user is subscribed to a contact * mod_saslauth: Log SASL failure reason * mod_disco: Correctly set the 'node' attr (fixes #449) * mod_bosh: Update session.conn to point to the current connection (fixes #890) * net.dns: Simplify expiry calculation (fixes #919) * mod_watchregistrations: Return the pointer to the root of the stanza, fixes #922. * mod_disco: Add an account/registered identity on subscribed accounts, fixes #826. * mod_welcome: Return the pointer to the root of the stanza, fixes a bug similar to #922. * net.dns: Prevent answers from immediately expiring even if TTL=0 (see #919) * mod_saslauth: Use correct varible name (thanks Roi) * mod_c2s: Iterate over child tags instead of child nodes in stream error (fixes traceback from #987) * mod_component, mod_s2s: Iterate over child tags instead of child nodes (can include text) in stream error (same as 176b7f4e4ac9) * MUC: Always send subject message, even if it is empty (fixes #1053) * MUC: fix the @from on in history replay (fixes #1054) * MUC: Rename variable to make it clearer that it is the room JID and not the MUC host Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-458=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): prosody-0.9.13-2.3.1 prosody-debuginfo-0.9.13-2.3.1 prosody-debugsource-0.9.13-2.3.1 References: https://bugzilla.suse.com/1093088

1 0

openSUSE-OU-2018:1283-1: Add pagemon to the SUSE PackageHub
by maintenance＠opensuse.org 14 May '18

14 May '18

openSUSE Optional Update: Add pagemon to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:1283-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds pagemon to the SUSE PackageHub. Pagemon is an interactive memory/page monitoring tool. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-457=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pagemon-0.01.12-2.1 References:

1 0

openSUSE-SU-2018:1275-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 12 May '18

12 May '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1275-1 Rating: important References: #1092272 #1092923 Cross-References: CVE-2018-6120 CVE-2018-6121 CVE-2018-6122 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for Chromium to version 66.0.3359.170 fixes the following issues: Security issues fixed (boo#1092923): - CVE-2018-6121: Privilege Escalation in extensions - CVE-2018-6122: Type confusion in V8 - CVE-2018-6120: Heap buffer overflow in PDFium - Various fixes from internal audits, fuzzing and other initiatives The following bugs are fixed: - boo#1092272: Improved support for subpixel rending Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-456=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-66.0.3359.170-158.1 chromedriver-debuginfo-66.0.3359.170-158.1 chromium-66.0.3359.170-158.1 chromium-debuginfo-66.0.3359.170-158.1 chromium-debugsource-66.0.3359.170-158.1 References: https://www.suse.com/security/cve/CVE-2018-6120.html https://www.suse.com/security/cve/CVE-2018-6121.html https://www.suse.com/security/cve/CVE-2018-6122.html https://bugzilla.suse.com/1092272 https://bugzilla.suse.com/1092923

1 0

openSUSE-SU-2018:1274-1: important: Security update for xen
by opensuse-security＠opensuse.org 11 May '18

11 May '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1274-1 Rating: important References: #1027519 #1072834 #1080634 #1080635 #1080662 #1087251 #1087252 #1089152 #1089635 #1090820 #1090822 #1090823 Cross-References: CVE-2018-10471 CVE-2018-10472 CVE-2018-7540 CVE-2018-7541 CVE-2018-7542 CVE-2018-8897 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 6 fixes is now available. Description: This update for xen to version 4.9.2 fixes several issues. This feature was added: - Added script, udev rule and systemd service to watch for vcpu online/offline events in a HVM domU. They are triggered via 'xl vcpu-set domU N' These security issues were fixed: - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 (XSA-260, bsc#1090820) - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially privilege escalation/information leaks (XSA-261, bsc#1090822) - Prevent unbounded loop, induced by qemu allowing an attacker to permanently keep a physical CPU core busy (XSA-262, bsc#1090823) - CVE-2018-10472: x86 HVM guest OS users (in certain configurations) were able to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot (bsc#1089152). - CVE-2018-10471: x86 PV guest OS users were able to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754 (bsc#1089635). - CVE-2018-7540: x86 PV guest OS users were able to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing (bsc#1080635). - CVE-2018-7541: Guest OS users were able to cause a denial of service (hypervisor crash) or gain privileges by triggering a grant-table transition from v2 to v1 (bsc#1080662). - CVE-2018-7542: x86 PVH guest OS users were able to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC (bsc#1080634). These non-security issues were fixed: - bsc#1087252: Update built-in defaults for xenstored in stubdom, keep default to run xenstored as daemon in dom0 - bsc#1087251: Preserve xen-syms from xen-dbg.gz to allow processing vmcores with crash(1) - bsc#1072834: Prevent unchecked MSR access error This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-454=1 Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.2_04-19.2 xen-debugsource-4.9.2_04-19.2 xen-devel-4.9.2_04-19.2 xen-doc-html-4.9.2_04-19.2 xen-libs-4.9.2_04-19.2 xen-libs-debuginfo-4.9.2_04-19.2 xen-tools-4.9.2_04-19.2 xen-tools-debuginfo-4.9.2_04-19.2 xen-tools-domU-4.9.2_04-19.2 xen-tools-domU-debuginfo-4.9.2_04-19.2 References: https://www.suse.com/security/cve/CVE-2018-10471.html https://www.suse.com/security/cve/CVE-2018-10472.html https://www.suse.com/security/cve/CVE-2018-7540.html https://www.suse.com/security/cve/CVE-2018-7541.html https://www.suse.com/security/cve/CVE-2018-7542.html https://www.suse.com/security/cve/CVE-2018-8897.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1072834 https://bugzilla.suse.com/1080634 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 https://bugzilla.suse.com/1087251 https://bugzilla.suse.com/1087252 https://bugzilla.suse.com/1089152 https://bugzilla.suse.com/1089635 https://bugzilla.suse.com/1090820 https://bugzilla.suse.com/1090822 https://bugzilla.suse.com/1090823

1 0

openSUSE-SU-2018:1271-1: important: Security update for opencv
by opensuse-security＠opensuse.org 11 May '18

11 May '18

openSUSE Security Update: Security update for opencv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1271-1 Rating: important References: #1033150 #1033152 Cross-References: CVE-2016-1516 CVE-2016-1517 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opencv fixes the following issues: - CVE-2016-1517: Fixed a denial of service (segfault) via vectors involving corrupt chunks (boo#1033150) - CVE-2016-1516: Fixed a double free issue that allows attackers to execute arbitrary code (boo#1033152). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-455=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): libopencv-qt56_3-3.1.0-5.1 libopencv-qt56_3-debuginfo-3.1.0-5.1 libopencv3_1-3.1.0-5.1 opencv-3.1.0-5.1 opencv-devel-3.1.0-5.1 opencv-doc-3.1.0-5.1 opencv-qt5-3.1.0-5.1 opencv-qt5-debuginfo-3.1.0-5.1 opencv-qt5-debugsource-3.1.0-5.1 opencv-qt5-devel-3.1.0-5.1 opencv-qt5-doc-3.1.0-5.1 python-opencv-3.1.0-5.1 python-opencv-qt5-3.1.0-5.1 python-opencv-qt5-debuginfo-3.1.0-5.1 python3-opencv-3.1.0-5.1 python3-opencv-qt5-3.1.0-5.1 python3-opencv-qt5-debuginfo-3.1.0-5.1 References: https://www.suse.com/security/cve/CVE-2016-1516.html https://www.suse.com/security/cve/CVE-2016-1517.html https://bugzilla.suse.com/1033150 https://bugzilla.suse.com/1033152

1 0

openSUSE-SU-2018:1265-1: important: Security update for opencv
by opensuse-security＠opensuse.org 11 May '18

11 May '18

openSUSE Security Update: Security update for opencv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1265-1 Rating: important References: #1033150 #1033152 Cross-References: CVE-2016-1516 CVE-2016-1517 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opencv fixes the following issues: - CVE-2016-1517: Fixed a denial of service (segfault) via vectors involving corrupt chunks (boo#1033150) - CVE-2016-1516: Fixed a double free issue that allows attackers to execute arbitrary code (boo#1033152). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-455=1 Package List: - openSUSE Leap 42.3 (x86_64): libopencv-qt56_3-3.1.0-4.3.1 libopencv-qt56_3-debuginfo-3.1.0-4.3.1 libopencv3_1-3.1.0-4.3.1 libopencv3_1-debuginfo-3.1.0-4.3.1 opencv-3.1.0-4.3.1 opencv-debuginfo-3.1.0-4.3.1 opencv-debugsource-3.1.0-4.3.1 opencv-devel-3.1.0-4.3.1 opencv-doc-3.1.0-4.3.1 opencv-qt5-3.1.0-4.3.1 opencv-qt5-debuginfo-3.1.0-4.3.1 opencv-qt5-debugsource-3.1.0-4.3.1 opencv-qt5-devel-3.1.0-4.3.1 opencv-qt5-doc-3.1.0-4.3.1 python-opencv-3.1.0-4.3.1 python-opencv-debuginfo-3.1.0-4.3.1 python-opencv-qt5-3.1.0-4.3.1 python-opencv-qt5-debuginfo-3.1.0-4.3.1 python3-opencv-3.1.0-4.3.1 python3-opencv-debuginfo-3.1.0-4.3.1 python3-opencv-qt5-3.1.0-4.3.1 python3-opencv-qt5-debuginfo-3.1.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2016-1516.html https://www.suse.com/security/cve/CVE-2016-1517.html https://bugzilla.suse.com/1033150 https://bugzilla.suse.com/1033152

1 0

openSUSE-RU-2018:1218-1: Recommended update for opera
by maintenance＠opensuse.org 11 May '18

11 May '18

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1218-1 Rating: low References: #1092833 Affected Products: openSUSE Leap 42.3:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for opera fixes the following issues: - Update to version 53.0.2907.37 (boo#1092833) * See https://blogs.opera.com/desktop/changelog-for-53/#b2907.37 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3:NonFree: zypper in -t patch openSUSE-2018-453=1 Package List: - openSUSE Leap 42.3:NonFree (x86_64): opera-53.0.2907.37-65.1 References: https://bugzilla.suse.com/1092833

1 0

openSUSE-SU-2018:1215-1: moderate: Security update for cairo
by opensuse-security＠opensuse.org 10 May '18

10 May '18

openSUSE Security Update: Security update for cairo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1215-1 Rating: moderate References: #1049092 Cross-References: CVE-2017-9814 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cairo fixes the following issues: - CVE-2017-9814: out-of-bounds read in cairo-truetype-subset.c could lead to denial of service (bsc#1049092). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-445=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cairo-debugsource-1.15.2-8.3.1 cairo-devel-1.15.2-8.3.1 cairo-tools-1.15.2-8.3.1 cairo-tools-debuginfo-1.15.2-8.3.1 libcairo-gobject2-1.15.2-8.3.1 libcairo-gobject2-debuginfo-1.15.2-8.3.1 libcairo-script-interpreter2-1.15.2-8.3.1 libcairo-script-interpreter2-debuginfo-1.15.2-8.3.1 libcairo2-1.15.2-8.3.1 libcairo2-debuginfo-1.15.2-8.3.1 - openSUSE Leap 42.3 (x86_64): cairo-devel-32bit-1.15.2-8.3.1 libcairo-gobject2-32bit-1.15.2-8.3.1 libcairo-gobject2-debuginfo-32bit-1.15.2-8.3.1 libcairo-script-interpreter2-32bit-1.15.2-8.3.1 libcairo-script-interpreter2-debuginfo-32bit-1.15.2-8.3.1 libcairo2-32bit-1.15.2-8.3.1 libcairo2-debuginfo-32bit-1.15.2-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-9814.html https://bugzilla.suse.com/1049092

1 0

openSUSE-SU-2018:1214-1: moderate: Security update for libapr1
by opensuse-security＠opensuse.org 10 May '18

10 May '18

openSUSE Security Update: Security update for libapr1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1214-1 Rating: moderate References: #1064982 Cross-References: CVE-2017-12613 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following issues: - CVE-2017-12613: DoS or information disclosure in pr_exp_time*() or apr_os_exp_time*() functions (bsc#1064982). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-450=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libapr1-1.5.1-9.3.1 libapr1-debuginfo-1.5.1-9.3.1 libapr1-debugsource-1.5.1-9.3.1 libapr1-devel-1.5.1-9.3.1 References: https://www.suse.com/security/cve/CVE-2017-12613.html https://bugzilla.suse.com/1064982

1 0