June 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1842-1: moderate: Recommended update for libXaw
by maintenance＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Recommended Update: Recommended update for libXaw ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1842-1 Rating: moderate References: #1098411 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libXaw fixes the following issues: - a segmentation fault may have occurred in xen PV domU during a live migration if a required font was not installed (boo#1098411) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-680=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-680=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libXaw-debugsource-1.0.13-5.3.1 libXaw-devel-1.0.13-5.3.1 libXaw6-1.0.13-5.3.1 libXaw6-debuginfo-1.0.13-5.3.1 libXaw7-1.0.13-5.3.1 libXaw7-debuginfo-1.0.13-5.3.1 libXaw8-1.0.13-5.3.1 - openSUSE Leap 42.3 (x86_64): libXaw-devel-32bit-1.0.13-5.3.1 libXaw6-32bit-1.0.13-5.3.1 libXaw6-debuginfo-32bit-1.0.13-5.3.1 libXaw7-32bit-1.0.13-5.3.1 libXaw7-debuginfo-32bit-1.0.13-5.3.1 libXaw8-32bit-1.0.13-5.3.1 - openSUSE Leap 15.0 (i586 x86_64): libXaw-debugsource-1.0.13-lp150.2.3.1 libXaw-devel-1.0.13-lp150.2.3.1 libXaw6-1.0.13-lp150.2.3.1 libXaw6-debuginfo-1.0.13-lp150.2.3.1 libXaw7-1.0.13-lp150.2.3.1 libXaw7-debuginfo-1.0.13-lp150.2.3.1 libXaw8-1.0.13-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libXaw-devel-32bit-1.0.13-lp150.2.3.1 libXaw6-32bit-1.0.13-lp150.2.3.1 libXaw6-32bit-debuginfo-1.0.13-lp150.2.3.1 libXaw7-32bit-1.0.13-lp150.2.3.1 libXaw7-32bit-debuginfo-1.0.13-lp150.2.3.1 libXaw8-32bit-1.0.13-lp150.2.3.1 References: https://bugzilla.suse.com/1098411

1 0

openSUSE-RU-2018:1841-1: Recommended update for ibus
by maintenance＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Recommended Update: Recommended update for ibus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1841-1 Rating: low References: #1076854 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ibus provides the following fix: - Do not set LC_CTYPE so that the system locale can be changed by just modifying LANG. (bsc#1076854) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-683=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ibus-1.5.13-5.3.1 ibus-debuginfo-1.5.13-5.3.1 ibus-debugsource-1.5.13-5.3.1 ibus-devel-1.5.13-5.3.1 ibus-gtk-1.5.13-5.3.1 ibus-gtk-debuginfo-1.5.13-5.3.1 ibus-gtk3-1.5.13-5.3.1 ibus-gtk3-debuginfo-1.5.13-5.3.1 libibus-1_0-5-1.5.13-5.3.1 libibus-1_0-5-debuginfo-1.5.13-5.3.1 python-ibus-1.5.13-5.3.1 typelib-1_0-IBus-1_0-1.5.13-5.3.1 - openSUSE Leap 42.3 (x86_64): ibus-gtk-32bit-1.5.13-5.3.1 ibus-gtk-debuginfo-32bit-1.5.13-5.3.1 ibus-gtk3-32bit-1.5.13-5.3.1 ibus-gtk3-debuginfo-32bit-1.5.13-5.3.1 libibus-1_0-5-32bit-1.5.13-5.3.1 libibus-1_0-5-debuginfo-32bit-1.5.13-5.3.1 - openSUSE Leap 42.3 (noarch): ibus-branding-openSUSE-KDE-1.5.13-5.3.1 ibus-lang-1.5.13-5.3.1 References: https://bugzilla.suse.com/1076854

1 0

openSUSE-RU-2018:1840-1: moderate: Recommended update for kwayland
by maintenance＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Recommended Update: Recommended update for kwayland ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1840-1 Rating: moderate References: #1097606 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kwayland fixes the following issues: - Under Wayland, copy-past from GTK3 applications did not work (boo#1097606) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-679=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): kwayland-5.45.0-lp150.2.3.1 kwayland-debuginfo-5.45.0-lp150.2.3.1 kwayland-debugsource-5.45.0-lp150.2.3.1 kwayland-devel-5.45.0-lp150.2.3.1 kwayland-devel-debuginfo-5.45.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): kwayland-32bit-5.45.0-lp150.2.3.1 kwayland-32bit-debuginfo-5.45.0-lp150.2.3.1 kwayland-devel-32bit-5.45.0-lp150.2.3.1 kwayland-devel-32bit-debuginfo-5.45.0-lp150.2.3.1 References: https://bugzilla.suse.com/1097606

1 0

openSUSE-RU-2018:1839-1: moderate: Recommended update for wireless-regdb
by maintenance＠opensuse.org 29 Jun '18

29 Jun '18

openSUSE Recommended Update: Recommended update for wireless-regdb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1839-1 Rating: moderate References: #1095397 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wireless-regdb to version 2018.05.09 provides the following fixes: (bsc#1095397) - Updated regulatory database for France and Panama. - Fixes in python3 scripts. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-678=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-678=1 Package List: - openSUSE Leap 42.3 (noarch): wireless-regdb-2018.05.09-5.6.1 - openSUSE Leap 15.0 (noarch): wireless-regdb-2018.05.09-lp150.2.3.1 References: https://bugzilla.suse.com/1095397

1 0

openSUSE-SU-2018:1834-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 28 Jun '18

28 Jun '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1834-1 Rating: moderate References: #1007276 #1074317 #1082332 #1082825 #1086408 #1092949 #974621 Cross-References: CVE-2016-3632 CVE-2016-8331 CVE-2017-11613 CVE-2017-13726 CVE-2017-18013 CVE-2018-10963 CVE-2018-7456 CVE-2018-8905 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for tiff fixes the following issues: These security issues were fixed: - CVE-2017-18013: There was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. (bsc#1074317) - CVE-2018-10963: The TIFFWriteDirectorySec() function in tif_dirwrite.c allowed remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726. (bsc#1092949) - CVE-2018-7456: Prevent a NULL Pointer dereference in the function TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013 (bsc#1082825) - CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer (bsc#1082332) - CVE-2018-8905: Prevent heap-based buffer overflow in the function LZWDecodeCompat via a crafted TIFF file (bsc#1086408) - CVE-2016-8331: Prevent remote code execution because of incorrect handling of TIFF images. A crafted TIFF document could have lead to a type confusion vulnerability resulting in remote code execution. This vulnerability could have been be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality (bsc#1007276) - CVE-2016-3632: The _TIFFVGetField function allowed remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image (bsc#974621) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-677=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-31.1 libtiff5-4.0.9-31.1 libtiff5-debuginfo-4.0.9-31.1 tiff-4.0.9-31.1 tiff-debuginfo-4.0.9-31.1 tiff-debugsource-4.0.9-31.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-31.1 libtiff5-32bit-4.0.9-31.1 libtiff5-debuginfo-32bit-4.0.9-31.1 References: https://www.suse.com/security/cve/CVE-2016-3632.html https://www.suse.com/security/cve/CVE-2016-8331.html https://www.suse.com/security/cve/CVE-2017-11613.html https://www.suse.com/security/cve/CVE-2017-13726.html https://www.suse.com/security/cve/CVE-2017-18013.html https://www.suse.com/security/cve/CVE-2018-10963.html https://www.suse.com/security/cve/CVE-2018-7456.html https://www.suse.com/security/cve/CVE-2018-8905.html https://bugzilla.suse.com/1007276 https://bugzilla.suse.com/1074317 https://bugzilla.suse.com/1082332 https://bugzilla.suse.com/1082825 https://bugzilla.suse.com/1086408 https://bugzilla.suse.com/1092949 https://bugzilla.suse.com/974621

1 0

openSUSE-SU-2018:1833-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 28 Jun '18

28 Jun '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1833-1 Rating: important References: #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12367 CVE-2018-12369 CVE-2018-12371 CVE-2018-5156 CVE-2018-5187 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This security update for MozillaFirefox to version 60.1.0esr fixes multiple issues. Security issues fixed (MFSA 2018-16, boo#1098998): - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-12361: Integer overflow in SwizzleData - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12371: Integer overflow in Skia library during edge builder allocation - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming - CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments - CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1 - CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Other issues fixed: - various stability and regression fixes - do not disable system installed unsigned language packs (bmo#1464766) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-676=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-676=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.1.0-106.1 MozillaFirefox-branding-upstream-60.1.0-106.1 MozillaFirefox-buildsymbols-60.1.0-106.1 MozillaFirefox-debuginfo-60.1.0-106.1 MozillaFirefox-debugsource-60.1.0-106.1 MozillaFirefox-devel-60.1.0-106.1 MozillaFirefox-translations-common-60.1.0-106.1 MozillaFirefox-translations-other-60.1.0-106.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.1.0-lp150.3.11.1 MozillaFirefox-branding-upstream-60.1.0-lp150.3.11.1 MozillaFirefox-buildsymbols-60.1.0-lp150.3.11.1 MozillaFirefox-debuginfo-60.1.0-lp150.3.11.1 MozillaFirefox-debugsource-60.1.0-lp150.3.11.1 MozillaFirefox-devel-60.1.0-lp150.3.11.1 MozillaFirefox-translations-common-60.1.0-lp150.3.11.1 MozillaFirefox-translations-other-60.1.0-lp150.3.11.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12369.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1098998

1 0

openSUSE-OU-2018:1823-1: Optional update to add cpphs to the SUSE PackageHub
by maintenance＠opensuse.org 27 Jun '18

27 Jun '18

openSUSE Optional Update: Optional update to add cpphs to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:1823-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds cpphs to the SUSE PackageHub. Cpphs is a re-implementation of the C pre-processor in Haskell. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-675=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cpphs-1.20.8-2.1 ghc-cpphs-1.20.8-2.1 ghc-cpphs-devel-1.20.8-2.1 References:

1 0

openSUSE-SU-2018:1811-1: moderate: Security update for go1.9
by opensuse-security＠opensuse.org 23 Jun '18

23 Jun '18

openSUSE Security Update: Security update for go1.9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1811-1 Rating: moderate References: #1081495 Cross-References: CVE-2018-7187 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for go1.9 fixes the following issues: Security issues fixed: - CVE-2018-7187: arbitrary command execution via VCS path (boo#1081495) Non-security changes: - Update to version 1.9.7 - fixes to the go command and compiler - minimal support to the go command for the vgo transition Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-672=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-672=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): go-1.9.7-37.2 go-doc-1.9.7-37.2 go1.9-1.9.7-10.1 go1.9-doc-1.9.7-10.1 - openSUSE Leap 42.3 (x86_64): go-race-1.9.7-37.2 go1.9-race-1.9.7-10.1 - openSUSE Leap 15.0 (i586 x86_64): go-1.9.7-lp150.2.4.1 go-doc-1.9.7-lp150.2.4.1 go1.9-1.9.7-lp150.2.4.2 go1.9-doc-1.9.7-lp150.2.4.2 - openSUSE Leap 15.0 (x86_64): go-race-1.9.7-lp150.2.4.1 go1.9-race-1.9.7-lp150.2.4.2 References: https://www.suse.com/security/cve/CVE-2018-7187.html https://bugzilla.suse.com/1081495

1 0

openSUSE-RU-2018:1810-1: moderate: Recommended update for hg-git
by maintenance＠opensuse.org 23 Jun '18

23 Jun '18

openSUSE Recommended Update: Recommended update for hg-git ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1810-1 Rating: moderate References: #1096561 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hg-git fixes the following issues: - hg-git was incompatible with mercurial 4.5 (boo#1096561) This update to version 0.8.11 also contains the following changes: - add config knob for marking git branches public - re-enable support for git subrepositories Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-673=1 Package List: - openSUSE Leap 15.0 (noarch): hg-git-0.8.11-lp150.2.3.1 References: https://bugzilla.suse.com/1096561

1 0

openSUSE-SU-2018:1809-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 23 Jun '18

23 Jun '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1809-1 Rating: important References: #1098751 #1098752 Cross-References: CVE-2018-12581 CVE-2018-12613 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes multiple issues. Security issues fixed: * CVE-2018-12613: File inclusion and remote code execution attack (boo#1098751) * CVE-2018-12581: XSS in Designer feature (boo#1098752) This update to version 4.8.2 also contains number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-669=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.2-23.1 References: https://www.suse.com/security/cve/CVE-2018-12581.html https://www.suse.com/security/cve/CVE-2018-12613.html https://bugzilla.suse.com/1098751 https://bugzilla.suse.com/1098752

1 0