June 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:1721-1: moderate: Security update for poppler
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for poppler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1721-1 Rating: moderate References: #1045939 #1059066 #1059101 #1059155 #1060220 #1061092 #1061263 #1061264 #1061265 #1064593 #1074453 Cross-References: CVE-2017-1000456 CVE-2017-14517 CVE-2017-14518 CVE-2017-14520 CVE-2017-14617 CVE-2017-14928 CVE-2017-14975 CVE-2017-14976 CVE-2017-14977 CVE-2017-15565 CVE-2017-9865 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for poppler fixes the following issues: These security issues were fixed: - CVE-2017-14517: Prevent NULL Pointer dereference in the XRef::parseEntry() function via a crafted PDF document (bsc#1059066). - CVE-2017-9865: Fixed a stack-based buffer overflow vulnerability in GfxState.cc that would have allowed attackers to facilitate a denial-of-service attack via specially crafted PDF documents. (bsc#1045939) - CVE-2017-14518: Remedy a floating point exception in isImageInterpolationRequired() that could have been exploited using a specially crafted PDF document. (bsc#1059101) - CVE-2017-14520: Remedy a floating point exception in Splash::scaleImageYuXd() that could have been exploited using a specially crafted PDF document. (bsc#1059155) - CVE-2017-14617: Fixed a floating point exception in Stream.cc, which may lead to a potential attack when handling malicious PDF files. (bsc#1060220) - CVE-2017-14928: Fixed a NULL Pointer dereference in AnnotRichMedia::Configuration::Configuration() in Annot.cc, which may lead to a potential attack when handling malicious PDF files. (bsc#1061092) - CVE-2017-14975: Fixed a NULL pointer dereference vulnerability, that existed because a data structure in FoFiType1C.cc was not initialized, which allowed an attacker to launch a denial of service attack. (bsc#1061263) - CVE-2017-14976: Fixed a heap-based buffer over-read vulnerability in FoFiType1C.cc that occurred when an out-of-bounds font dictionary index was encountered, which allowed an attacker to launch a denial of service attack. (bsc#1061264) - CVE-2017-14977: Fixed a NULL pointer dereference vulnerability in the FoFiTrueType::getCFFBlock() function in FoFiTrueType.cc that occurred due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack. (bsc#1061265) - CVE-2017-15565: Prevent NULL Pointer dereference in the GfxImageColorMap::getGrayLine() function via a crafted PDF document (bsc#1064593). - CVE-2017-1000456: Validate boundaries in TextPool::addWord to prevent overflows in subsequent calculations (bsc#1074453). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-648=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpoppler-cpp0-0.43.0-8.1 libpoppler-cpp0-debuginfo-0.43.0-8.1 libpoppler-devel-0.43.0-8.1 libpoppler-glib-devel-0.43.0-8.1 libpoppler-glib8-0.43.0-8.1 libpoppler-glib8-debuginfo-0.43.0-8.1 libpoppler-qt4-4-0.43.0-8.1 libpoppler-qt4-4-debuginfo-0.43.0-8.1 libpoppler-qt4-devel-0.43.0-8.1 libpoppler-qt5-1-0.43.0-8.1 libpoppler-qt5-1-debuginfo-0.43.0-8.1 libpoppler-qt5-devel-0.43.0-8.1 libpoppler60-0.43.0-8.1 libpoppler60-debuginfo-0.43.0-8.1 poppler-debugsource-0.43.0-8.1 poppler-qt-debugsource-0.43.0-8.1 poppler-qt5-debugsource-0.43.0-8.1 poppler-tools-0.43.0-8.1 poppler-tools-debuginfo-0.43.0-8.1 typelib-1_0-Poppler-0_18-0.43.0-8.1 - openSUSE Leap 42.3 (x86_64): libpoppler-cpp0-32bit-0.43.0-8.1 libpoppler-cpp0-debuginfo-32bit-0.43.0-8.1 libpoppler-glib8-32bit-0.43.0-8.1 libpoppler-glib8-debuginfo-32bit-0.43.0-8.1 libpoppler-qt4-4-32bit-0.43.0-8.1 libpoppler-qt4-4-debuginfo-32bit-0.43.0-8.1 libpoppler-qt5-1-32bit-0.43.0-8.1 libpoppler-qt5-1-debuginfo-32bit-0.43.0-8.1 libpoppler60-32bit-0.43.0-8.1 libpoppler60-debuginfo-32bit-0.43.0-8.1 References: https://www.suse.com/security/cve/CVE-2017-1000456.html https://www.suse.com/security/cve/CVE-2017-14517.html https://www.suse.com/security/cve/CVE-2017-14518.html https://www.suse.com/security/cve/CVE-2017-14520.html https://www.suse.com/security/cve/CVE-2017-14617.html https://www.suse.com/security/cve/CVE-2017-14928.html https://www.suse.com/security/cve/CVE-2017-14975.html https://www.suse.com/security/cve/CVE-2017-14976.html https://www.suse.com/security/cve/CVE-2017-14977.html https://www.suse.com/security/cve/CVE-2017-15565.html https://www.suse.com/security/cve/CVE-2017-9865.html https://bugzilla.suse.com/1045939 https://bugzilla.suse.com/1059066 https://bugzilla.suse.com/1059101 https://bugzilla.suse.com/1059155 https://bugzilla.suse.com/1060220 https://bugzilla.suse.com/1061092 https://bugzilla.suse.com/1061263 https://bugzilla.suse.com/1061264 https://bugzilla.suse.com/1061265 https://bugzilla.suse.com/1064593 https://bugzilla.suse.com/1074453

1 0

openSUSE-RU-2018:1720-1: moderate: Recommended update for openssl
by maintenance＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Recommended Update: Recommended update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1720-1 Rating: moderate References: #1090765 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openssl provides the following fix: - Suggest libopenssl1_0_0-hmac from libopenssl1_0_0 package to avoid dependency issues during updates. (bsc#1090765) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-645=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenssl-devel-1.0.2j-22.1 libopenssl1_0_0-1.0.2j-22.1 libopenssl1_0_0-debuginfo-1.0.2j-22.1 libopenssl1_0_0-hmac-1.0.2j-22.1 openssl-1.0.2j-22.1 openssl-cavs-1.0.2j-22.1 openssl-cavs-debuginfo-1.0.2j-22.1 openssl-debuginfo-1.0.2j-22.1 openssl-debugsource-1.0.2j-22.1 - openSUSE Leap 42.3 (noarch): openssl-doc-1.0.2j-22.1 - openSUSE Leap 42.3 (x86_64): libopenssl-devel-32bit-1.0.2j-22.1 libopenssl1_0_0-32bit-1.0.2j-22.1 libopenssl1_0_0-debuginfo-32bit-1.0.2j-22.1 libopenssl1_0_0-hmac-32bit-1.0.2j-22.1 References: https://bugzilla.suse.com/1090765

1 0

openSUSE-SU-2018:1719-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1719-1 Rating: important References: #1087066 #1090023 #1090024 #1090025 #1090026 #1090027 #1090028 #1090029 #1090030 #1090032 #1090033 Cross-References: CVE-2018-2790 CVE-2018-2794 CVE-2018-2795 CVE-2018-2796 CVE-2018-2797 CVE-2018-2798 CVE-2018-2799 CVE-2018-2800 CVE-2018-2814 CVE-2018-2815 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-openjdk to version 8u171 fixes the following issues: These security issues were fixed: - S8180881: Better packaging of deserialization - S8182362: Update CipherOutputStream Usage - S8183032: Upgrade to LittleCMS 2.9 - S8189123: More consistent classloading - S8189969, CVE-2018-2790, bsc#1090023: Manifest better manifest entries - S8189977, CVE-2018-2795, bsc#1090025: Improve permission portability - S8189981, CVE-2018-2796, bsc#1090026: Improve queuing portability - S8189985, CVE-2018-2797, bsc#1090027: Improve tabular data portability - S8189989, CVE-2018-2798, bsc#1090028: Improve container portability - S8189993, CVE-2018-2799, bsc#1090029: Improve document portability - S8189997, CVE-2018-2794, bsc#1090024: Enhance keystore mechanisms - S8190478: Improved interface method selection - S8190877: Better handling of abstract classes - S8191696: Better mouse positioning - S8192025, CVE-2018-2814, bsc#1090032: Less referential references - S8192030: Better MTSchema support - S8192757, CVE-2018-2815, bsc#1090033: Improve stub classes implementation - S8193409: Improve AES supporting classes - S8193414: Improvements in MethodType lookups - S8193833, CVE-2018-2800, bsc#1090030: Better RMI connection support For other changes please consult the changelog. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-641=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-641=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.171-24.1 java-1_8_0-openjdk-accessibility-1.8.0.171-24.1 java-1_8_0-openjdk-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-debugsource-1.8.0.171-24.1 java-1_8_0-openjdk-demo-1.8.0.171-24.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-devel-1.8.0.171-24.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-headless-1.8.0.171-24.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.171-24.1 java-1_8_0-openjdk-src-1.8.0.171-24.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.171-24.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-accessibility-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-debugsource-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-demo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-devel-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-headless-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.171-lp150.2.3.1 java-1_8_0-openjdk-src-1.8.0.171-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.171-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-2790.html https://www.suse.com/security/cve/CVE-2018-2794.html https://www.suse.com/security/cve/CVE-2018-2795.html https://www.suse.com/security/cve/CVE-2018-2796.html https://www.suse.com/security/cve/CVE-2018-2797.html https://www.suse.com/security/cve/CVE-2018-2798.html https://www.suse.com/security/cve/CVE-2018-2799.html https://www.suse.com/security/cve/CVE-2018-2800.html https://www.suse.com/security/cve/CVE-2018-2814.html https://www.suse.com/security/cve/CVE-2018-2815.html https://bugzilla.suse.com/1087066 https://bugzilla.suse.com/1090023 https://bugzilla.suse.com/1090024 https://bugzilla.suse.com/1090025 https://bugzilla.suse.com/1090026 https://bugzilla.suse.com/1090027 https://bugzilla.suse.com/1090028 https://bugzilla.suse.com/1090029 https://bugzilla.suse.com/1090030 https://bugzilla.suse.com/1090032 https://bugzilla.suse.com/1090033

1 0

openSUSE-RU-2018:1718-1: moderate: Recommended update for calibre
by maintenance＠opensuse.org 16 Jun '18

16 Jun '18

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1718-1 Rating: moderate References: #1097180 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for calibre adds support for a number of e-book reads, amoung other improvements: - Support Kobo Clara HD (boo#1097180)o - Improve PDF output - Various UI and e-book handling bug fixes - Add option to output EPUB 3 files Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-647=1 Package List: - openSUSE Leap 15.0 (x86_64): calibre-3.25.0-lp150.3.3.1 calibre-debuginfo-3.25.0-lp150.3.3.1 calibre-debugsource-3.25.0-lp150.3.3.1 References: https://bugzilla.suse.com/1097180

1 0

openSUSE-RU-2018:1717-1: moderate: Recommended update for pin
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for pin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1717-1 Rating: moderate References: #1095723 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pin fixes the following issues: - Bugfix: pin was broken on systems without /etc/SuSE-release file (boo#1095723) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-639=1 Package List: - openSUSE Leap 15.0 (noarch): pin-0.38-lp150.2.3.1 References: https://bugzilla.suse.com/1095723

1 0

openSUSE-SU-2018:1710-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1710-1 Rating: important References: #1090023 #1090024 #1090025 #1090026 #1090027 #1090028 #1090029 #1090030 #1090032 #1090033 Cross-References: CVE-2018-2790 CVE-2018-2794 CVE-2018-2795 CVE-2018-2796 CVE-2018-2797 CVE-2018-2798 CVE-2018-2799 CVE-2018-2800 CVE-2018-2814 CVE-2018-2815 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 7u181 fixes the following issues: + S8162488: JDK should be updated to use LittleCMS 2.8 + S8180881: Better packaging of deserialization + S8182362: Update CipherOutputStream Usage + S8183032: Upgrade to LittleCMS 2.9 + S8189123: More consistent classloading + S8190478: Improved interface method selection + S8190877: Better handling of abstract classes + S8191696: Better mouse positioning + S8192030: Better MTSchema support + S8193409: Improve AES supporting classes + S8193414: Improvements in MethodType lookups + S8189969, CVE-2018-2790, bsc#1090023: Manifest better manifest entries + S8189977, CVE-2018-2795, bsc#1090025: Improve permission portability + S8189981, CVE-2018-2796, bsc#1090026: Improve queuing portability + S8189985, CVE-2018-2797, bsc#1090027: Improve tabular data portability + S8189989, CVE-2018-2798, bsc#1090028: Improve container portability + S8189993, CVE-2018-2799, bsc#1090029: Improve document portability + S8189997, CVE-2018-2794, bsc#1090024: Enhance keystore mechanisms + S8192025, CVE-2018-2814, bsc#1090032: Less referential references + S8192757, CVE-2018-2815, bsc#1090033: Improve stub classes implementation + S8193833, CVE-2018-2800, bsc#1090030: Better RMI connection support For additional changes please consult the changelog. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-637=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.181-51.1 java-1_7_0-openjdk-accessibility-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.181-51.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-debugsource-1.7.0.181-51.1 java-1_7_0-openjdk-demo-1.7.0.181-51.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-devel-1.7.0.181-51.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-headless-1.7.0.181-51.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.181-51.1 java-1_7_0-openjdk-src-1.7.0.181-51.1 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.181-51.1 References: https://www.suse.com/security/cve/CVE-2018-2790.html https://www.suse.com/security/cve/CVE-2018-2794.html https://www.suse.com/security/cve/CVE-2018-2795.html https://www.suse.com/security/cve/CVE-2018-2796.html https://www.suse.com/security/cve/CVE-2018-2797.html https://www.suse.com/security/cve/CVE-2018-2798.html https://www.suse.com/security/cve/CVE-2018-2799.html https://www.suse.com/security/cve/CVE-2018-2800.html https://www.suse.com/security/cve/CVE-2018-2814.html https://www.suse.com/security/cve/CVE-2018-2815.html https://bugzilla.suse.com/1090023 https://bugzilla.suse.com/1090024 https://bugzilla.suse.com/1090025 https://bugzilla.suse.com/1090026 https://bugzilla.suse.com/1090027 https://bugzilla.suse.com/1090028 https://bugzilla.suse.com/1090029 https://bugzilla.suse.com/1090030 https://bugzilla.suse.com/1090032 https://bugzilla.suse.com/1090033

1 0

openSUSE-SU-2018:1709-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1709-1 Rating: moderate References: #1091610 Cross-References: CVE-2018-1115 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: PostgreSQL was updated to 9.6.9 fixing bugs and security issues: Release notes: - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-9-6-9.html A dump/restore is not required for those running 9.6.X. However, if you use the adminpack extension, you should update it as per the first changelog entry below. Also, if the function marking mistakes mentioned in the second and third changelog entries below affect you, you will want to take steps to correct your database catalogs. Security issue fixed: - CVE-2018-1115: Remove public execute privilege from contrib/adminpack's pg_logfile_rotate() function pg_logfile_rotate() is a deprecated wrapper for the core function pg_rotate_logfile(). When that function was changed to rely on SQL privileges for access control rather than a hard-coded superuser check, pg_logfile_rotate() should have been updated as well, but the need for this was missed. Hence, if adminpack is installed, any user could request a logfile rotation, creating a minor security issue. After installing this update, administrators should update adminpack by performing ALTER EXTENSION adminpack UPDATE in each database in which adminpack is installed. (bsc#1091610) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-638=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libecpg6-9.6.9-18.1 libecpg6-debuginfo-9.6.9-18.1 libpq5-9.6.9-18.1 libpq5-debuginfo-9.6.9-18.1 postgresql96-9.6.9-18.1 postgresql96-contrib-9.6.9-18.1 postgresql96-contrib-debuginfo-9.6.9-18.1 postgresql96-debuginfo-9.6.9-18.1 postgresql96-debugsource-9.6.9-18.1 postgresql96-devel-9.6.9-18.1 postgresql96-devel-debuginfo-9.6.9-18.1 postgresql96-libs-debugsource-9.6.9-18.1 postgresql96-plperl-9.6.9-18.1 postgresql96-plperl-debuginfo-9.6.9-18.1 postgresql96-plpython-9.6.9-18.1 postgresql96-plpython-debuginfo-9.6.9-18.1 postgresql96-pltcl-9.6.9-18.1 postgresql96-pltcl-debuginfo-9.6.9-18.1 postgresql96-server-9.6.9-18.1 postgresql96-server-debuginfo-9.6.9-18.1 postgresql96-test-9.6.9-18.1 - openSUSE Leap 42.3 (x86_64): libecpg6-32bit-9.6.9-18.1 libecpg6-debuginfo-32bit-9.6.9-18.1 libpq5-32bit-9.6.9-18.1 libpq5-debuginfo-32bit-9.6.9-18.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.9-18.1 References: https://www.suse.com/security/cve/CVE-2018-1115.html https://bugzilla.suse.com/1091610

1 0

openSUSE-SU-2018:1708-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1708-1 Rating: moderate References: #1096745 #1097525 Cross-References: CVE-2018-12019 CVE-2018-12020 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures: - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs (boo#1097525) - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode (boo#1096745) This mitigation prevents CVE-2018-12020 from being exploited even if GnuPG is not patched. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-630=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-630=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): enigmail-2.0.7-21.1 - openSUSE Leap 15.0 (x86_64): enigmail-2.0.7-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-12019.html https://www.suse.com/security/cve/CVE-2018-12020.html https://bugzilla.suse.com/1096745 https://bugzilla.suse.com/1097525

1 0

openSUSE-RU-2018:1707-1: moderate: Recommended update for docker, catatonit
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for docker, catatonit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1707-1 Rating: moderate References: #1065609 #1073877 #1085117 #1089732 #1091633 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for docker implements one feature and fixes several issues. These features were added in this release: - fate#324652: docker-init support was added in the form of 'catatonit'. This allows users to use the --init option with 'docker run', which spawns a very simple init as pid1 in the container. This includes the addition of a new package (catatonit). (bsc#1091633) These non-security issues were fixed: - bsc#1073877 bsc#1089732: Update the generated AppArmor profile so that it allows contained processes to be signalled by 'docker kill'. - bsc#1085117: Build and package the man pages for docker sub-commands. - bsc#1065609: Do not log incorrect warnings when attempting to inject non-existent host files. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-636=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): catatonit-0.1.3-2.1 catatonit-debuginfo-0.1.3-2.1 catatonit-debugsource-0.1.3-2.1 - openSUSE Leap 42.3 (x86_64): docker-17.09.1_ce-39.1 docker-debuginfo-17.09.1_ce-39.1 docker-debugsource-17.09.1_ce-39.1 docker-test-17.09.1_ce-39.1 docker-test-debuginfo-17.09.1_ce-39.1 - openSUSE Leap 42.3 (noarch): docker-bash-completion-17.09.1_ce-39.1 docker-zsh-completion-17.09.1_ce-39.1 References: https://bugzilla.suse.com/1065609 https://bugzilla.suse.com/1073877 https://bugzilla.suse.com/1085117 https://bugzilla.suse.com/1089732 https://bugzilla.suse.com/1091633

1 0

openSUSE-SU-2018:1706-1: moderate: Security update for enigmail
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1706-1 Rating: moderate References: #1096745 #1097525 Cross-References: CVE-2018-12019 CVE-2018-12020 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures: - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs (boo#1097525) - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode (boo#1096745) This mitigation prevents CVE-2018-12020 from being exploited even if GnuPG is not patched. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-630=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.7-18.1 References: https://www.suse.com/security/cve/CVE-2018-12019.html https://www.suse.com/security/cve/CVE-2018-12020.html https://bugzilla.suse.com/1096745 https://bugzilla.suse.com/1097525

1 0