May 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1126-1: moderate: Recommended update for etc-update
by maintenance＠opensuse.org 02 May '18

02 May '18

openSUSE Recommended Update: Recommended update for etc-update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1126-1 Rating: moderate References: #1091111 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for etc-update fixes the following issues: _ boo#1091111: the etc-update utility did not properly handle files as they are found on rpm-based distributions (.rpmsave, .rpmnew and .rpmorig) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-411=1 Package List: - openSUSE Leap 42.3 (noarch): etc-update-2.3.31-11.5.1 References: https://bugzilla.suse.com/1091111

1 0

openSUSE-SU-2018:1123-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 02 May '18

02 May '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1123-1 Rating: moderate References: #1050623 #1055010 #1080522 #1085236 #1086773 #1087027 #1087037 #1089781 Cross-References: CVE-2017-11641 CVE-2017-13066 CVE-2017-18229 CVE-2017-18251 CVE-2017-18254 CVE-2018-10177 CVE-2018-6799 CVE-2018-9018 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - security update (core) * CVE-2018-6799: The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used. [boo#1080522] - security update (png.c) * CVE-2018-9018: In GraphicsMagick 1.3.28, there is a divide-by-zero in the ReadMNGImage function of coders/png.c. Remote attackers could leverage this vulnerability to cause a crash and denial of service via a crafted mng file. [boo#1086773] - security update (gif.c) * CVE-2017-18254: An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file. [boo#1087027] - security update (pcd.c) * CVE-2017-18251: An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file. [boo#1087037] * CVE-2017-18229: An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations. [boo#1085236] * CVE-2017-11641: GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.[boo#1050623] * CVE-2017-13066: GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c. [boo#1055010] * CVE-2018-10177: Specially crafted PNG images may have triggered an infinite loop [bsc#1089781] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-407=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-87.1 GraphicsMagick-debuginfo-1.3.25-87.1 GraphicsMagick-debugsource-1.3.25-87.1 GraphicsMagick-devel-1.3.25-87.1 libGraphicsMagick++-Q16-12-1.3.25-87.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-87.1 libGraphicsMagick++-devel-1.3.25-87.1 libGraphicsMagick-Q16-3-1.3.25-87.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-87.1 libGraphicsMagick3-config-1.3.25-87.1 libGraphicsMagickWand-Q16-2-1.3.25-87.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-87.1 perl-GraphicsMagick-1.3.25-87.1 perl-GraphicsMagick-debuginfo-1.3.25-87.1 References: https://www.suse.com/security/cve/CVE-2017-11641.html https://www.suse.com/security/cve/CVE-2017-13066.html https://www.suse.com/security/cve/CVE-2017-18229.html https://www.suse.com/security/cve/CVE-2017-18251.html https://www.suse.com/security/cve/CVE-2017-18254.html https://www.suse.com/security/cve/CVE-2018-10177.html https://www.suse.com/security/cve/CVE-2018-6799.html https://www.suse.com/security/cve/CVE-2018-9018.html https://bugzilla.suse.com/1050623 https://bugzilla.suse.com/1055010 https://bugzilla.suse.com/1080522 https://bugzilla.suse.com/1085236 https://bugzilla.suse.com/1086773 https://bugzilla.suse.com/1087027 https://bugzilla.suse.com/1087037 https://bugzilla.suse.com/1089781

1 0

openSUSE-SU-2018:1120-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 02 May '18

02 May '18

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1120-1 Rating: moderate References: #1091045 Cross-References: CVE-2017-6888 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for flac fixes the following issues: - CVE-2017-6888: Fix memory leak in read_metadata_vorbiscomment_() function could lead to denial of service (boo#1091045). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-408=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): flac-1.3.2-2.3.1 flac-debuginfo-1.3.2-2.3.1 flac-debugsource-1.3.2-2.3.1 flac-devel-1.3.2-2.3.1 libFLAC++6-1.3.2-2.3.1 libFLAC++6-debuginfo-1.3.2-2.3.1 libFLAC8-1.3.2-2.3.1 libFLAC8-debuginfo-1.3.2-2.3.1 - openSUSE Leap 42.3 (noarch): flac-doc-1.3.2-2.3.1 - openSUSE Leap 42.3 (x86_64): flac-devel-32bit-1.3.2-2.3.1 libFLAC++6-32bit-1.3.2-2.3.1 libFLAC++6-debuginfo-32bit-1.3.2-2.3.1 libFLAC8-32bit-1.3.2-2.3.1 libFLAC8-debuginfo-32bit-1.3.2-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-6888.html https://bugzilla.suse.com/1091045

1 0

openSUSE-SU-2018:1119-1: moderate: Security update for quassel
by opensuse-security＠opensuse.org 02 May '18

02 May '18

openSUSE Security Update: Security update for quassel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1119-1 Rating: moderate References: #1069468 #1090495 Cross-References: CVE-2018-1000178 CVE-2018-1000179 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for quassel fixes the following issues: Security fixes (boo#1090495): - CVE-2018-1000178: A heap metadata corruption in qdatastream could have been exploited to launch an unauthenticated remote code execution - CVE-2018-1000179: A remote attacker could have caused a Denial of Service attack by initiating login attempts before the core got initialized The following tracked packaging change is included: - boo#1069468: no longer use /var/adm/fillup-templates This update also includes various small bug fixes in the upstream 0.12.4 release. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-409=1 Package List: - openSUSE Leap 42.3 (x86_64): quassel-base-0.12.5-5.3.1 quassel-client-0.12.5-5.3.1 quassel-client-debuginfo-0.12.5-5.3.1 quassel-client-qt5-0.12.5-5.3.1 quassel-client-qt5-debuginfo-0.12.5-5.3.1 quassel-core-0.12.5-5.3.1 quassel-core-debuginfo-0.12.5-5.3.1 quassel-debugsource-0.12.5-5.3.1 quassel-mono-0.12.5-5.3.1 quassel-mono-debuginfo-0.12.5-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000178.html https://www.suse.com/security/cve/CVE-2018-1000179.html https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/1090495

1 0

openSUSE-RU-2018:1118-1: Recommended update for yast2-packager
by maintenance＠opensuse.org 02 May '18

02 May '18

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1118-1 Rating: low References: #1078323 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-packager adds a warning to inform the user that changes in a repository managed by a service will be lost in the next refresh of the service (bsc#1078323). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-410=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-packager-3.2.26-6.1 References: https://bugzilla.suse.com/1078323

1 0