May 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1199-1: Recommended update for python3-PyYAML
by maintenance＠opensuse.org 09 May '18

09 May '18

openSUSE Recommended Update: Recommended update for python3-PyYAML ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1199-1 Rating: low References: #1073879 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-PyYAML contains the following fixes: - Adding an implicit resolver to a derived loader should not affect the base loader - Uniform representation for OrderedDict? across different versions of Python - Fixed comparison to None warning This version update to 3.12 unifies the Python 2 and Python 3 sources of the module, as used on SLES 12. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-440=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): python-PyYAML-debugsource-3.12-13.1 python3-PyYAML-3.12-13.1 python3-PyYAML-debuginfo-3.12-13.1 References: https://bugzilla.suse.com/1073879

1 0

openSUSE-SU-2018:1198-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 09 May '18

09 May '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1198-1 Rating: moderate References: #1086774 #1086775 #1086813 #1086814 #1086817 #1086820 Cross-References: CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301 CVE-2018-1302 CVE-2018-1303 CVE-2018-1312 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: * CVE-2018-1283: when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header leading to unexpected behavior [bsc#1086814]. * CVE-2018-1301: due to an out of bound access after a size limit being reached by reading the HTTP header, a specially crafted request could lead to remote denial of service. [bsc#1086817] * CVE-2018-1303: a specially crafted HTTP request header could lead to crash due to an out of bound read while preparing data to be cached in shared memory.[bsc#1086813] * CVE-2017-15715: a regular expression could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. leading to corruption of uploaded files.[bsc#1086774] * CVE-2018-1312: when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection. [bsc#1086775] * CVE-2017-15710: mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all. [bsc#1086820] * CVE-2018-1302: when an HTTP/2 stream was destroyed after being handled, it could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk. [bsc#1086820] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-438=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-22.1 apache2-debuginfo-2.4.23-22.1 apache2-debugsource-2.4.23-22.1 apache2-devel-2.4.23-22.1 apache2-event-2.4.23-22.1 apache2-event-debuginfo-2.4.23-22.1 apache2-example-pages-2.4.23-22.1 apache2-prefork-2.4.23-22.1 apache2-prefork-debuginfo-2.4.23-22.1 apache2-utils-2.4.23-22.1 apache2-utils-debuginfo-2.4.23-22.1 apache2-worker-2.4.23-22.1 apache2-worker-debuginfo-2.4.23-22.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-22.1 References: https://www.suse.com/security/cve/CVE-2017-15710.html https://www.suse.com/security/cve/CVE-2017-15715.html https://www.suse.com/security/cve/CVE-2018-1283.html https://www.suse.com/security/cve/CVE-2018-1301.html https://www.suse.com/security/cve/CVE-2018-1302.html https://www.suse.com/security/cve/CVE-2018-1303.html https://www.suse.com/security/cve/CVE-2018-1312.html https://bugzilla.suse.com/1086774 https://bugzilla.suse.com/1086775 https://bugzilla.suse.com/1086813 https://bugzilla.suse.com/1086814 https://bugzilla.suse.com/1086817 https://bugzilla.suse.com/1086820

1 0

openSUSE-RU-2018:1197-1: important: Recommended update for gcc7
by maintenance＠opensuse.org 09 May '18

09 May '18

openSUSE Recommended Update: Recommended update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1197-1 Rating: important References: #1061667 #1068967 #1084812 #1087550 #1087930 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for gcc7 to 7.3 release fixes the following issues: - Update to GCC 7.3 release and further updated to gcc-7-branch head (r258812). - Various AArch64 compile fixes are included: * Picks fix to no longer enable -mpc-relative-literal-loads by default with --enable-fix-cortex-a53-843419. * Enable --enable-fix-cortex-a53-843419 for aarch64. [bsc#1084812] [bsc#1087930] * Enable --enable-fix-cortex-a53-835769 for aarch64. * Contains fix for PR82445 which is about a RPI1 bootloader miscompile. [bsc#1061667] * Fixed bogus stack probe instruction on ARM. [bsc#1068967] - Revert the ios_base::failure ABI back to compatible behavior with the default ABI. [bsc#1087550] - Fix nvptx offload target compiler install so GCC can pick up required files. Split out the newlib part into cross-nvptx-newlib7-devel and avoid conflicts with GCC 8 variant via Provides/Conflicts of cross-nvptx-newlib-devel. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-439=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp7-7.3.1+r258812-10.1 cpp7-debuginfo-7.3.1+r258812-10.1 gcc7-7.3.1+r258812-10.1 gcc7-ada-7.3.1+r258812-10.1 gcc7-ada-debuginfo-7.3.1+r258812-10.1 gcc7-c++-7.3.1+r258812-10.1 gcc7-c++-debuginfo-7.3.1+r258812-10.1 gcc7-debuginfo-7.3.1+r258812-10.1 gcc7-debugsource-7.3.1+r258812-10.1 gcc7-fortran-7.3.1+r258812-10.1 gcc7-fortran-debuginfo-7.3.1+r258812-10.1 gcc7-go-7.3.1+r258812-10.1 gcc7-go-debuginfo-7.3.1+r258812-10.1 gcc7-locale-7.3.1+r258812-10.1 gcc7-testresults-7.3.1+r258812-10.1 libada7-7.3.1+r258812-10.1 libada7-debuginfo-7.3.1+r258812-10.1 libasan4-7.3.1+r258812-10.1 libasan4-debuginfo-7.3.1+r258812-10.1 libatomic1-7.3.1+r258812-10.1 libatomic1-debuginfo-7.3.1+r258812-10.1 libcilkrts5-7.3.1+r258812-10.1 libcilkrts5-debuginfo-7.3.1+r258812-10.1 libgcc_s1-7.3.1+r258812-10.1 libgcc_s1-debuginfo-7.3.1+r258812-10.1 libgfortran4-7.3.1+r258812-10.1 libgfortran4-debuginfo-7.3.1+r258812-10.1 libgo11-7.3.1+r258812-10.1 libgo11-debuginfo-7.3.1+r258812-10.1 libgomp1-7.3.1+r258812-10.1 libgomp1-debuginfo-7.3.1+r258812-10.1 libitm1-7.3.1+r258812-10.1 libitm1-debuginfo-7.3.1+r258812-10.1 libmpx2-7.3.1+r258812-10.1 libmpx2-debuginfo-7.3.1+r258812-10.1 libmpxwrappers2-7.3.1+r258812-10.1 libmpxwrappers2-debuginfo-7.3.1+r258812-10.1 libquadmath0-7.3.1+r258812-10.1 libquadmath0-debuginfo-7.3.1+r258812-10.1 libstdc++6-7.3.1+r258812-10.1 libstdc++6-debuginfo-7.3.1+r258812-10.1 libstdc++6-devel-gcc7-7.3.1+r258812-10.1 libstdc++6-locale-7.3.1+r258812-10.1 libubsan0-7.3.1+r258812-10.1 libubsan0-debuginfo-7.3.1+r258812-10.1 - openSUSE Leap 42.3 (noarch): gcc7-info-7.3.1+r258812-10.1 - openSUSE Leap 42.3 (x86_64): cross-nvptx-gcc7-7.3.1+r258812-10.1 cross-nvptx-newlib7-devel-7.3.1+r258812-10.1 gcc7-32bit-7.3.1+r258812-10.1 gcc7-ada-32bit-7.3.1+r258812-10.1 gcc7-c++-32bit-7.3.1+r258812-10.1 gcc7-fortran-32bit-7.3.1+r258812-10.1 gcc7-go-32bit-7.3.1+r258812-10.1 libada7-32bit-7.3.1+r258812-10.1 libada7-32bit-debuginfo-7.3.1+r258812-10.1 libasan4-32bit-7.3.1+r258812-10.1 libasan4-32bit-debuginfo-7.3.1+r258812-10.1 libatomic1-32bit-7.3.1+r258812-10.1 libatomic1-32bit-debuginfo-7.3.1+r258812-10.1 libcilkrts5-32bit-7.3.1+r258812-10.1 libcilkrts5-32bit-debuginfo-7.3.1+r258812-10.1 libgcc_s1-32bit-7.3.1+r258812-10.1 libgcc_s1-32bit-debuginfo-7.3.1+r258812-10.1 libgfortran4-32bit-7.3.1+r258812-10.1 libgfortran4-32bit-debuginfo-7.3.1+r258812-10.1 libgo11-32bit-7.3.1+r258812-10.1 libgo11-32bit-debuginfo-7.3.1+r258812-10.1 libgomp1-32bit-7.3.1+r258812-10.1 libgomp1-32bit-debuginfo-7.3.1+r258812-10.1 libitm1-32bit-7.3.1+r258812-10.1 libitm1-32bit-debuginfo-7.3.1+r258812-10.1 liblsan0-7.3.1+r258812-10.1 liblsan0-debuginfo-7.3.1+r258812-10.1 libmpx2-32bit-7.3.1+r258812-10.1 libmpx2-32bit-debuginfo-7.3.1+r258812-10.1 libmpxwrappers2-32bit-7.3.1+r258812-10.1 libmpxwrappers2-32bit-debuginfo-7.3.1+r258812-10.1 libquadmath0-32bit-7.3.1+r258812-10.1 libquadmath0-32bit-debuginfo-7.3.1+r258812-10.1 libstdc++6-32bit-7.3.1+r258812-10.1 libstdc++6-32bit-debuginfo-7.3.1+r258812-10.1 libstdc++6-devel-gcc7-32bit-7.3.1+r258812-10.1 libtsan0-7.3.1+r258812-10.1 libtsan0-debuginfo-7.3.1+r258812-10.1 libubsan0-32bit-7.3.1+r258812-10.1 libubsan0-32bit-debuginfo-7.3.1+r258812-10.1 References: https://bugzilla.suse.com/1061667 https://bugzilla.suse.com/1068967 https://bugzilla.suse.com/1084812 https://bugzilla.suse.com/1087550 https://bugzilla.suse.com/1087930

1 0

openSUSE-RU-2018:1188-1: moderate: Recommended update for mozilla-nspr, mozilla-nss
by maintenance＠opensuse.org 09 May '18

09 May '18

openSUSE Recommended Update: Recommended update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1188-1 Rating: moderate References: #1061204 #1092031 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mozilla-nspr, mozilla-nss fixes the following issues: - boo#1092031: Update Mozilla NSS to 3.36.1, Mozilla NSPR to 4.19 as dependencies for an upcoming update to Mozilla Firefox 60 ESR. - boo#1061204: Separate hardware and software implementations for AES and GCM to avoid implicit execution of SSE2 methods if compiled for i586 Changes in Mozilla NSS: - TLS 1.3 support has been updated to draft -23 - various updates to cryptography functions - bug fixes and correctness fixes - TLS compression is no longer supported. API calls will succeed but TLS compression will remain disabled Changes in Mozilla NSPR: - add TCP Fast Open functionality Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-437=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libfreebl3-3.36.1-47.1 libfreebl3-debuginfo-3.36.1-47.1 libsoftokn3-3.36.1-47.1 libsoftokn3-debuginfo-3.36.1-47.1 mozilla-nspr-4.19-17.3.1 mozilla-nspr-debuginfo-4.19-17.3.1 mozilla-nspr-debugsource-4.19-17.3.1 mozilla-nspr-devel-4.19-17.3.1 mozilla-nss-3.36.1-47.1 mozilla-nss-certs-3.36.1-47.1 mozilla-nss-certs-debuginfo-3.36.1-47.1 mozilla-nss-debuginfo-3.36.1-47.1 mozilla-nss-debugsource-3.36.1-47.1 mozilla-nss-devel-3.36.1-47.1 mozilla-nss-sysinit-3.36.1-47.1 mozilla-nss-sysinit-debuginfo-3.36.1-47.1 mozilla-nss-tools-3.36.1-47.1 mozilla-nss-tools-debuginfo-3.36.1-47.1 - openSUSE Leap 42.3 (x86_64): libfreebl3-32bit-3.36.1-47.1 libfreebl3-debuginfo-32bit-3.36.1-47.1 libsoftokn3-32bit-3.36.1-47.1 libsoftokn3-debuginfo-32bit-3.36.1-47.1 mozilla-nspr-32bit-4.19-17.3.1 mozilla-nspr-debuginfo-32bit-4.19-17.3.1 mozilla-nss-32bit-3.36.1-47.1 mozilla-nss-certs-32bit-3.36.1-47.1 mozilla-nss-certs-debuginfo-32bit-3.36.1-47.1 mozilla-nss-debuginfo-32bit-3.36.1-47.1 mozilla-nss-sysinit-32bit-3.36.1-47.1 mozilla-nss-sysinit-debuginfo-32bit-3.36.1-47.1 References: https://bugzilla.suse.com/1061204 https://bugzilla.suse.com/1092031

1 0

openSUSE-SU-2018:1175-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 09 May '18

09 May '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1175-1 Rating: important References: #1084296 #1086124 #1090000 #1091288 Cross-References: CVE-2017-11215 CVE-2017-11225 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073 CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077 CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081 CVE-2018-6082 CVE-2018-6083 CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102 CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106 CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114 CVE-2018-6115 CVE-2018-6116 CVE-2018-6117 CVE-2018-6118 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 61 vulnerabilities is now available. Description: This update for Chromium to version 66.0.3359.139 fixes the following issues: - CVE-2018-6118: Use after free in Media Cache (bsc#1091288) - CVE-2018-6085: Use after free in Disk Cache - CVE-2018-6086: Use after free in Disk Cache - CVE-2018-6087: Use after free in WebAssembly - CVE-2018-6088: Use after free in PDFium - CVE-2018-6089: Same origin policy bypass in Service Worker - CVE-2018-6090: Heap buffer overflow in Skia - CVE-2018-6091: Incorrect handling of plug-ins by Service Worker - CVE-2018-6092: Integer overflow in WebAssembly - CVE-2018-6093: Same origin bypass in Service Worker - CVE-2018-6094: Exploit hardening regression in Oilpan - CVE-2018-6095: Lack of meaningful user interaction requirement before file upload - CVE-2018-6096: Fullscreen UI spoof - CVE-2018-6097: Fullscreen UI spoof - CVE-2018-6098: URL spoof in Omnibox - CVE-2018-6099: CORS bypass in ServiceWorker - CVE-2018-6100: URL spoof in Omnibox - CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools - CVE-2018-6102: URL spoof in Omnibox - CVE-2018-6103: UI spoof in Permissions - CVE-2018-6104: URL spoof in Omnibox - CVE-2018-6105: URL spoof in Omnibox - CVE-2018-6106: Incorrect handling of promises in V8 - CVE-2018-6107: URL spoof in Omnibox - CVE-2018-6108: URL spoof in Omnibox - CVE-2018-6109: Incorrect handling of files by FileAPI - CVE-2018-6110: Incorrect handling of plaintext files via file:// - CVE-2018-6111: Heap-use-after-free in DevTools - CVE-2018-6112: Incorrect URL handling in DevTools - CVE-2018-6113: URL spoof in Navigation - CVE-2018-6114: CSP bypass - CVE-2018-6115: SmartScreen bypass in downloads - CVE-2018-6116: Incorrect low memory handling in WebAssembly - CVE-2018-6117: Confusing autofill settings - CVE-2017-11215: Use after free in Flash - CVE-2017-11225: Use after free in Flash - CVE-2018-6060: Use after free in Blink - CVE-2018-6061: Race condition in V8 - CVE-2018-6062: Heap buffer overflow in Skia - CVE-2018-6057: Incorrect permissions on shared memory - CVE-2018-6063: Incorrect permissions on shared memory - CVE-2018-6064: Type confusion in V8 - CVE-2018-6065: Integer overflow in V8 - CVE-2018-6066: Same Origin Bypass via canvas - CVE-2018-6067: Buffer overflow in Skia - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab - CVE-2018-6069: Stack buffer overflow in Skia - CVE-2018-6070: CSP bypass through extensions - CVE-2018-6071: Heap bufffer overflow in Skia - CVE-2018-6072: Integer overflow in PDFium - CVE-2018-6073: Heap bufffer overflow in WebGL - CVE-2018-6074: Mark-of-the-Web bypass - CVE-2018-6075: Overly permissive cross origin downloads - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink - CVE-2018-6077: Timing attack using SVG filters - CVE-2018-6078: URL Spoof in OmniBox - CVE-2018-6079: Information disclosure via texture data in WebGL - CVE-2018-6080: Information disclosure in IPC call - CVE-2018-6081: XSS in interstitials - CVE-2018-6082: Circumvention of port blocking - CVE-2018-6083: Incorrect processing of AppManifests - bsc#1086124: Various fixes from internal audits, fuzzing and other initiatives This update also supports mitigation against the Spectre vulnerabilities: "Strict site isolation" is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-436=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-66.0.3359.139-2.1 chromedriver-debuginfo-66.0.3359.139-2.1 chromium-66.0.3359.139-2.1 chromium-debuginfo-66.0.3359.139-2.1 chromium-debugsource-66.0.3359.139-2.1 References: https://www.suse.com/security/cve/CVE-2017-11215.html https://www.suse.com/security/cve/CVE-2017-11225.html https://www.suse.com/security/cve/CVE-2018-6057.html https://www.suse.com/security/cve/CVE-2018-6060.html https://www.suse.com/security/cve/CVE-2018-6061.html https://www.suse.com/security/cve/CVE-2018-6062.html https://www.suse.com/security/cve/CVE-2018-6063.html https://www.suse.com/security/cve/CVE-2018-6064.html https://www.suse.com/security/cve/CVE-2018-6065.html https://www.suse.com/security/cve/CVE-2018-6066.html https://www.suse.com/security/cve/CVE-2018-6067.html https://www.suse.com/security/cve/CVE-2018-6068.html https://www.suse.com/security/cve/CVE-2018-6069.html https://www.suse.com/security/cve/CVE-2018-6070.html https://www.suse.com/security/cve/CVE-2018-6071.html https://www.suse.com/security/cve/CVE-2018-6072.html https://www.suse.com/security/cve/CVE-2018-6073.html https://www.suse.com/security/cve/CVE-2018-6074.html https://www.suse.com/security/cve/CVE-2018-6075.html https://www.suse.com/security/cve/CVE-2018-6076.html https://www.suse.com/security/cve/CVE-2018-6077.html https://www.suse.com/security/cve/CVE-2018-6078.html https://www.suse.com/security/cve/CVE-2018-6079.html https://www.suse.com/security/cve/CVE-2018-6080.html https://www.suse.com/security/cve/CVE-2018-6081.html https://www.suse.com/security/cve/CVE-2018-6082.html https://www.suse.com/security/cve/CVE-2018-6083.html https://www.suse.com/security/cve/CVE-2018-6085.html https://www.suse.com/security/cve/CVE-2018-6086.html https://www.suse.com/security/cve/CVE-2018-6087.html https://www.suse.com/security/cve/CVE-2018-6088.html https://www.suse.com/security/cve/CVE-2018-6089.html https://www.suse.com/security/cve/CVE-2018-6090.html https://www.suse.com/security/cve/CVE-2018-6091.html https://www.suse.com/security/cve/CVE-2018-6092.html https://www.suse.com/security/cve/CVE-2018-6093.html https://www.suse.com/security/cve/CVE-2018-6094.html https://www.suse.com/security/cve/CVE-2018-6095.html https://www.suse.com/security/cve/CVE-2018-6096.html https://www.suse.com/security/cve/CVE-2018-6097.html https://www.suse.com/security/cve/CVE-2018-6098.html https://www.suse.com/security/cve/CVE-2018-6099.html https://www.suse.com/security/cve/CVE-2018-6100.html https://www.suse.com/security/cve/CVE-2018-6101.html https://www.suse.com/security/cve/CVE-2018-6102.html https://www.suse.com/security/cve/CVE-2018-6103.html https://www.suse.com/security/cve/CVE-2018-6104.html https://www.suse.com/security/cve/CVE-2018-6105.html https://www.suse.com/security/cve/CVE-2018-6106.html https://www.suse.com/security/cve/CVE-2018-6107.html https://www.suse.com/security/cve/CVE-2018-6108.html https://www.suse.com/security/cve/CVE-2018-6109.html https://www.suse.com/security/cve/CVE-2018-6110.html https://www.suse.com/security/cve/CVE-2018-6111.html https://www.suse.com/security/cve/CVE-2018-6112.html https://www.suse.com/security/cve/CVE-2018-6113.html https://www.suse.com/security/cve/CVE-2018-6114.html https://www.suse.com/security/cve/CVE-2018-6115.html https://www.suse.com/security/cve/CVE-2018-6116.html https://www.suse.com/security/cve/CVE-2018-6117.html https://www.suse.com/security/cve/CVE-2018-6118.html https://bugzilla.suse.com/1084296 https://bugzilla.suse.com/1086124 https://bugzilla.suse.com/1090000 https://bugzilla.suse.com/1091288

1 0

openSUSE-RU-2018:1158-1: moderate: Recommended udpate for pam_kwallet
by maintenance＠opensuse.org 07 May '18

07 May '18

openSUSE Recommended Update: Recommended udpate for pam_kwallet ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1158-1 Rating: moderate References: #1092047 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pam_kwallet fixes the following issue: - boo#1092047: Regression in previous update, addressed by avoiding giving an stderr to kwallet Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-426=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): pam_kwallet-5.7.1-4.6.1 pam_kwallet-debuginfo-5.7.1-4.6.1 pam_kwallet-debugsource-5.7.1-4.6.1 References: https://bugzilla.suse.com/1092047

1 0

openSUSE-RU-2018:1154-1: Recommended update for cluster-glue
by maintenance＠opensuse.org 05 May '18

05 May '18

openSUSE Recommended Update: Recommended update for cluster-glue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1154-1 Rating: low References: #1050908 #1059171 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for cluster-glue provides the following fix: - stonith: Make sure a Reset can continue even if one of the nodes is already off by returning success with RESETPOWERON=0. (bsc#1050908) - stonith:external/ec2: Enforce en_US.UTF-8 locale when invoking aws client. (bsc#1059171) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-425=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cluster-glue-1.0.12+v1.git.1485976882.03d61cd-2.3.1 cluster-glue-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.3.1 cluster-glue-debugsource-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue-devel-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue-devel-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue2-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue2-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.3.1 stonith-bladehpi-1.0.12+v1.git.1485976882.03d61cd-2.3.1 stonith-bladehpi-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.3.1 - openSUSE Leap 42.3 (x86_64): libglue-devel-32bit-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue-devel-debuginfo-32bit-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue2-32bit-1.0.12+v1.git.1485976882.03d61cd-2.3.1 libglue2-debuginfo-32bit-1.0.12+v1.git.1485976882.03d61cd-2.3.1 References: https://bugzilla.suse.com/1050908 https://bugzilla.suse.com/1059171

1 0

openSUSE-RU-2018:1151-1: Recommended update for rust
by maintenance＠opensuse.org 04 May '18

04 May '18

openSUSE Recommended Update: Recommended update for rust ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1151-1 Rating: low References: #1030232 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rust, cargo fixes the following issues: - bsc#1030232: Update rust to 1.24.0, cargo to 0.25.0 These versions are build dependencies for an upcoming update to Mozilla Firefox 60 RSR. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-424=1 Package List: - openSUSE Leap 42.3 (x86_64): cargo-0.25.0-2.6.1 cargo-debuginfo-0.25.0-2.6.1 rust-1.24.0-2.6.3 rust-debuginfo-1.24.0-2.6.3 rust-debugsource-1.24.0-2.6.3 rust-doc-1.24.0-2.6.3 rust-gdb-1.24.0-2.6.3 rust-std-1.24.0-2.6.3 rust-std-debuginfo-1.24.0-2.6.3 - openSUSE Leap 42.3 (noarch): rust-src-1.24.0-2.6.3 References: https://bugzilla.suse.com/1030232

1 0

openSUSE-RU-2018:1150-1: moderate: Recommended update for gcc48
by maintenance＠opensuse.org 04 May '18

04 May '18

openSUSE Recommended Update: Recommended update for gcc48 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1150-1 Rating: moderate References: #1082130 #1083945 #1087932 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for the system compiler gcc48 fixes the following issues: - Support for generating IBM Z series Spectre Variant 2 fix method "expolines" was added (bsc#1083945) - A miscompilation of SPECcpu2017 526.blender was fixed. (bsc#1082130) - ARM Arch64 Cortex-A53 errata 843419 and 835769 were enabled by default, which could have lead to crashes of built binaries on Cortex A53 processors like in the Raspberry Pi3. (bsc#1087932) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-421=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp48-4.8.5-35.1 cpp48-debuginfo-4.8.5-35.1 gcc48-4.8.5-35.1 gcc48-ada-4.8.5-35.1 gcc48-ada-debuginfo-4.8.5-35.1 gcc48-c++-4.8.5-35.1 gcc48-c++-debuginfo-4.8.5-35.1 gcc48-debuginfo-4.8.5-35.1 gcc48-debugsource-4.8.5-35.1 gcc48-fortran-4.8.5-35.1 gcc48-fortran-debuginfo-4.8.5-35.1 gcc48-gij-4.8.5-35.1 gcc48-gij-debuginfo-4.8.5-35.1 gcc48-java-4.8.5-35.1 gcc48-java-debuginfo-4.8.5-35.1 gcc48-locale-4.8.5-35.1 gcc48-obj-c++-4.8.5-35.1 gcc48-obj-c++-debuginfo-4.8.5-35.1 gcc48-objc-4.8.5-35.1 gcc48-objc-debuginfo-4.8.5-35.1 gcc48-testresults-4.8.5-35.1 libada48-4.8.5-35.1 libada48-debuginfo-4.8.5-35.1 libasan0-4.8.5-35.1 libasan0-debuginfo-4.8.5-35.1 libffi48-debugsource-4.8.5-35.1 libffi48-devel-4.8.5-35.1 libgcj48-4.8.5-35.1 libgcj48-debuginfo-4.8.5-35.1 libgcj48-debugsource-4.8.5-35.1 libgcj48-devel-4.8.5-35.1 libgcj48-devel-debuginfo-4.8.5-35.1 libgcj48-jar-4.8.5-35.1 libgcj_bc1-4.8.5-35.1 libobjc4-4.8.5-35.1 libobjc4-debuginfo-4.8.5-35.1 libstdc++48-devel-4.8.5-35.1 - openSUSE Leap 42.3 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.5-35.1 cross-armv6hl-gcc48-icecream-backend-4.8.5-35.1 cross-armv7hl-gcc48-icecream-backend-4.8.5-35.1 cross-i386-gcc48-icecream-backend-4.8.5-35.1 cross-ia64-gcc48-icecream-backend-4.8.5-35.1 cross-ppc-gcc48-icecream-backend-4.8.5-35.1 cross-ppc64-gcc48-icecream-backend-4.8.5-35.1 cross-ppc64le-gcc48-icecream-backend-4.8.5-35.1 cross-s390-gcc48-icecream-backend-4.8.5-35.1 cross-s390x-gcc48-icecream-backend-4.8.5-35.1 gcc48-32bit-4.8.5-35.1 gcc48-ada-32bit-4.8.5-35.1 gcc48-fortran-32bit-4.8.5-35.1 gcc48-gij-32bit-4.8.5-35.1 gcc48-gij-debuginfo-32bit-4.8.5-35.1 gcc48-objc-32bit-4.8.5-35.1 libada48-32bit-4.8.5-35.1 libada48-32bit-debuginfo-4.8.5-35.1 libasan0-32bit-4.8.5-35.1 libasan0-32bit-debuginfo-4.8.5-35.1 libffi48-devel-32bit-4.8.5-35.1 libgcj48-32bit-4.8.5-35.1 libgcj48-debuginfo-32bit-4.8.5-35.1 libgcj48-devel-32bit-4.8.5-35.1 libgcj48-devel-debuginfo-32bit-4.8.5-35.1 libobjc4-32bit-4.8.5-35.1 libobjc4-32bit-debuginfo-4.8.5-35.1 libstdc++48-devel-32bit-4.8.5-35.1 - openSUSE Leap 42.3 (noarch): gcc48-info-4.8.5-35.1 libstdc++48-doc-4.8.5-35.1 References: https://bugzilla.suse.com/1082130 https://bugzilla.suse.com/1083945 https://bugzilla.suse.com/1087932

1 0

openSUSE-SU-2018:1149-1: moderate: Security update for pam_kwallet
by opensuse-security＠opensuse.org 04 May '18

04 May '18

openSUSE Security Update: Security update for pam_kwallet ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1149-1 Rating: moderate References: #1090863 Cross-References: CVE-2018-10380 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pam_kwallet fixes the following issues: Security issue fixed: - CVE-2018-10380: Fix local root vulnerability (boo#1090863). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-423=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): pam_kwallet-5.7.1-4.3.1 pam_kwallet-debuginfo-5.7.1-4.3.1 pam_kwallet-debugsource-5.7.1-4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10380.html https://bugzilla.suse.com/1090863

1 0