July 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2139-1: moderate: Recommended update for ffmpeg-4
by maintenance＠opensuse.org 30 Jul '18

30 Jul '18

openSUSE Recommended Update: Recommended update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2139-1 Rating: moderate References: #1102532 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ffmpeg-4 fixes the following issues: - Avoid ffmpeg-4 depending on ffnvcodec (boo#1102532) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-781=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-781=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ffmpeg-4-debugsource-4.0.1-7.1 ffmpeg-4-libavcodec-devel-4.0.1-7.1 ffmpeg-4-libavdevice-devel-4.0.1-7.1 ffmpeg-4-libavfilter-devel-4.0.1-7.1 ffmpeg-4-libavformat-devel-4.0.1-7.1 ffmpeg-4-libavresample-devel-4.0.1-7.1 ffmpeg-4-libavutil-devel-4.0.1-7.1 ffmpeg-4-libpostproc-devel-4.0.1-7.1 ffmpeg-4-libswresample-devel-4.0.1-7.1 ffmpeg-4-libswscale-devel-4.0.1-7.1 ffmpeg-4-private-devel-4.0.1-7.1 libavcodec58-4.0.1-7.1 libavcodec58-debuginfo-4.0.1-7.1 libavdevice58-4.0.1-7.1 libavdevice58-debuginfo-4.0.1-7.1 libavfilter7-4.0.1-7.1 libavfilter7-debuginfo-4.0.1-7.1 libavformat58-4.0.1-7.1 libavformat58-debuginfo-4.0.1-7.1 libavresample4-4.0.1-7.1 libavresample4-debuginfo-4.0.1-7.1 libavutil56-4.0.1-7.1 libavutil56-debuginfo-4.0.1-7.1 libpostproc55-4.0.1-7.1 libpostproc55-debuginfo-4.0.1-7.1 libswresample3-4.0.1-7.1 libswresample3-debuginfo-4.0.1-7.1 libswscale5-4.0.1-7.1 libswscale5-debuginfo-4.0.1-7.1 - openSUSE Leap 42.3 (x86_64): libavcodec58-32bit-4.0.1-7.1 libavcodec58-debuginfo-32bit-4.0.1-7.1 libavdevice58-32bit-4.0.1-7.1 libavdevice58-debuginfo-32bit-4.0.1-7.1 libavfilter7-32bit-4.0.1-7.1 libavfilter7-debuginfo-32bit-4.0.1-7.1 libavformat58-32bit-4.0.1-7.1 libavformat58-debuginfo-32bit-4.0.1-7.1 libavresample4-32bit-4.0.1-7.1 libavresample4-debuginfo-32bit-4.0.1-7.1 libavutil56-32bit-4.0.1-7.1 libavutil56-debuginfo-32bit-4.0.1-7.1 libpostproc55-32bit-4.0.1-7.1 libpostproc55-debuginfo-32bit-4.0.1-7.1 libswresample3-32bit-4.0.1-7.1 libswresample3-debuginfo-32bit-4.0.1-7.1 libswscale5-32bit-4.0.1-7.1 libswscale5-debuginfo-32bit-4.0.1-7.1 - openSUSE Leap 15.0 (x86_64): ffmpeg-4-debugsource-4.0.1-lp150.7.1 ffmpeg-4-libavcodec-devel-4.0.1-lp150.7.1 ffmpeg-4-libavdevice-devel-4.0.1-lp150.7.1 ffmpeg-4-libavfilter-devel-4.0.1-lp150.7.1 ffmpeg-4-libavformat-devel-4.0.1-lp150.7.1 ffmpeg-4-libavresample-devel-4.0.1-lp150.7.1 ffmpeg-4-libavutil-devel-4.0.1-lp150.7.1 ffmpeg-4-libpostproc-devel-4.0.1-lp150.7.1 ffmpeg-4-libswresample-devel-4.0.1-lp150.7.1 ffmpeg-4-libswscale-devel-4.0.1-lp150.7.1 ffmpeg-4-private-devel-4.0.1-lp150.7.1 libavcodec58-4.0.1-lp150.7.1 libavcodec58-debuginfo-4.0.1-lp150.7.1 libavdevice58-4.0.1-lp150.7.1 libavdevice58-debuginfo-4.0.1-lp150.7.1 libavfilter7-4.0.1-lp150.7.1 libavfilter7-debuginfo-4.0.1-lp150.7.1 libavformat58-4.0.1-lp150.7.1 libavformat58-debuginfo-4.0.1-lp150.7.1 libavresample4-4.0.1-lp150.7.1 libavresample4-debuginfo-4.0.1-lp150.7.1 libavutil56-4.0.1-lp150.7.1 libavutil56-debuginfo-4.0.1-lp150.7.1 libpostproc55-4.0.1-lp150.7.1 libpostproc55-debuginfo-4.0.1-lp150.7.1 libswresample3-4.0.1-lp150.7.1 libswresample3-debuginfo-4.0.1-lp150.7.1 libswscale5-4.0.1-lp150.7.1 libswscale5-debuginfo-4.0.1-lp150.7.1 References: https://bugzilla.suse.com/1102532

1 0

openSUSE-RU-2018:2138-1: moderate: Recommended update for ffmpeg-4
by maintenance＠opensuse.org 30 Jul '18

30 Jul '18

openSUSE Recommended Update: Recommended update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2138-1 Rating: moderate References: #1102532 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ffmpeg-4 fixes the following issues: - Avoid ffmpeg-4 depending on ffnvcodec (boo#1102532) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-781=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ffmpeg-4-debugsource-4.0.1-7.1 ffmpeg-4-libavcodec-devel-4.0.1-7.1 ffmpeg-4-libavdevice-devel-4.0.1-7.1 ffmpeg-4-libavfilter-devel-4.0.1-7.1 ffmpeg-4-libavformat-devel-4.0.1-7.1 ffmpeg-4-libavresample-devel-4.0.1-7.1 ffmpeg-4-libavutil-devel-4.0.1-7.1 ffmpeg-4-libpostproc-devel-4.0.1-7.1 ffmpeg-4-libswresample-devel-4.0.1-7.1 ffmpeg-4-libswscale-devel-4.0.1-7.1 ffmpeg-4-private-devel-4.0.1-7.1 libavcodec58-4.0.1-7.1 libavcodec58-debuginfo-4.0.1-7.1 libavdevice58-4.0.1-7.1 libavdevice58-debuginfo-4.0.1-7.1 libavfilter7-4.0.1-7.1 libavfilter7-debuginfo-4.0.1-7.1 libavformat58-4.0.1-7.1 libavformat58-debuginfo-4.0.1-7.1 libavresample4-4.0.1-7.1 libavresample4-debuginfo-4.0.1-7.1 libavutil56-4.0.1-7.1 libavutil56-debuginfo-4.0.1-7.1 libpostproc55-4.0.1-7.1 libpostproc55-debuginfo-4.0.1-7.1 libswresample3-4.0.1-7.1 libswresample3-debuginfo-4.0.1-7.1 libswscale5-4.0.1-7.1 libswscale5-debuginfo-4.0.1-7.1 References: https://bugzilla.suse.com/1102532

1 0

openSUSE-SU-2018:2135-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2135-1 Rating: important References: #1102530 Cross-References: CVE-2018-4117 CVE-2018-6044 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6164 CVE-2018-6165 CVE-2018-6166 CVE-2018-6167 CVE-2018-6168 CVE-2018-6169 CVE-2018-6170 CVE-2018-6171 CVE-2018-6172 CVE-2018-6173 CVE-2018-6174 CVE-2018-6175 CVE-2018-6176 CVE-2018-6177 CVE-2018-6178 CVE-2018-6179 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update for Chromium to version 68.0.3440.75 fixes multiple issues. Security issues fixed (boo#1102530): - CVE-2018-6153: Stack buffer overflow in Skia - CVE-2018-6154: Heap buffer overflow in WebGL - CVE-2018-6155: Use after free in WebRTC - CVE-2018-6156: Heap buffer overflow in WebRTC - CVE-2018-6157: Type confusion in WebRTC - CVE-2018-6158: Use after free in Blink - CVE-2018-6159: Same origin policy bypass in ServiceWorker - CVE-2018-6161: Same origin policy bypass in WebAudio - CVE-2018-6162: Heap buffer overflow in WebGL - CVE-2018-6163: URL spoof in Omnibox - CVE-2018-6164: Same origin policy bypass in ServiceWorker - CVE-2018-6165: URL spoof in Omnibox - CVE-2018-6166: URL spoof in Omnibox - CVE-2018-6167: URL spoof in Omnibox - CVE-2018-6168: CORS bypass in Blink - CVE-2018-6169: Permissions bypass in extension installation - CVE-2018-6170: Type confusion in PDFium - CVE-2018-6171: Use after free in WebBluetooth - CVE-2018-6172: URL spoof in Omnibox - CVE-2018-6173: URL spoof in Omnibox - CVE-2018-6174: Integer overflow in SwiftShader - CVE-2018-6175: URL spoof in Omnibox - CVE-2018-6176: Local user privilege escalation in Extensions - CVE-2018-6177: Cross origin information leak in Blink - CVE-2018-6178: UI spoof in Extensions - CVE-2018-6179: Local file information leak in Extensions - CVE-2018-6044: Request privilege escalation in Extensions - CVE-2018-4117: Cross origin information leak in Blink The following user interface changes are included: - Chrome will show the "Not secure" warning on all plain HTTP pages Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-780=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-68.0.3440.75-61.1 chromedriver-debuginfo-68.0.3440.75-61.1 chromium-68.0.3440.75-61.1 chromium-debuginfo-68.0.3440.75-61.1 chromium-debugsource-68.0.3440.75-61.1 References: https://www.suse.com/security/cve/CVE-2018-4117.html https://www.suse.com/security/cve/CVE-2018-6044.html https://www.suse.com/security/cve/CVE-2018-6153.html https://www.suse.com/security/cve/CVE-2018-6154.html https://www.suse.com/security/cve/CVE-2018-6155.html https://www.suse.com/security/cve/CVE-2018-6156.html https://www.suse.com/security/cve/CVE-2018-6157.html https://www.suse.com/security/cve/CVE-2018-6158.html https://www.suse.com/security/cve/CVE-2018-6159.html https://www.suse.com/security/cve/CVE-2018-6161.html https://www.suse.com/security/cve/CVE-2018-6162.html https://www.suse.com/security/cve/CVE-2018-6163.html https://www.suse.com/security/cve/CVE-2018-6164.html https://www.suse.com/security/cve/CVE-2018-6165.html https://www.suse.com/security/cve/CVE-2018-6166.html https://www.suse.com/security/cve/CVE-2018-6167.html https://www.suse.com/security/cve/CVE-2018-6168.html https://www.suse.com/security/cve/CVE-2018-6169.html https://www.suse.com/security/cve/CVE-2018-6170.html https://www.suse.com/security/cve/CVE-2018-6171.html https://www.suse.com/security/cve/CVE-2018-6172.html https://www.suse.com/security/cve/CVE-2018-6173.html https://www.suse.com/security/cve/CVE-2018-6174.html https://www.suse.com/security/cve/CVE-2018-6175.html https://www.suse.com/security/cve/CVE-2018-6176.html https://www.suse.com/security/cve/CVE-2018-6177.html https://www.suse.com/security/cve/CVE-2018-6178.html https://www.suse.com/security/cve/CVE-2018-6179.html https://bugzilla.suse.com/1102530

1 0

openSUSE-SU-2018:2134-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2134-1 Rating: important References: #1102530 Cross-References: CVE-2018-4117 CVE-2018-6044 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6164 CVE-2018-6165 CVE-2018-6166 CVE-2018-6167 CVE-2018-6168 CVE-2018-6169 CVE-2018-6170 CVE-2018-6171 CVE-2018-6172 CVE-2018-6173 CVE-2018-6174 CVE-2018-6175 CVE-2018-6176 CVE-2018-6177 CVE-2018-6178 CVE-2018-6179 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update for Chromium to version 68.0.3440.75 fixes multiple issues. Security issues fixed (boo#1102530): - CVE-2018-6153: Stack buffer overflow in Skia - CVE-2018-6154: Heap buffer overflow in WebGL - CVE-2018-6155: Use after free in WebRTC - CVE-2018-6156: Heap buffer overflow in WebRTC - CVE-2018-6157: Type confusion in WebRTC - CVE-2018-6158: Use after free in Blink - CVE-2018-6159: Same origin policy bypass in ServiceWorker - CVE-2018-6161: Same origin policy bypass in WebAudio - CVE-2018-6162: Heap buffer overflow in WebGL - CVE-2018-6163: URL spoof in Omnibox - CVE-2018-6164: Same origin policy bypass in ServiceWorker - CVE-2018-6165: URL spoof in Omnibox - CVE-2018-6166: URL spoof in Omnibox - CVE-2018-6167: URL spoof in Omnibox - CVE-2018-6168: CORS bypass in Blink - CVE-2018-6169: Permissions bypass in extension installation - CVE-2018-6170: Type confusion in PDFium - CVE-2018-6171: Use after free in WebBluetooth - CVE-2018-6172: URL spoof in Omnibox - CVE-2018-6173: URL spoof in Omnibox - CVE-2018-6174: Integer overflow in SwiftShader - CVE-2018-6175: URL spoof in Omnibox - CVE-2018-6176: Local user privilege escalation in Extensions - CVE-2018-6177: Cross origin information leak in Blink - CVE-2018-6178: UI spoof in Extensions - CVE-2018-6179: Local file information leak in Extensions - CVE-2018-6044: Request privilege escalation in Extensions - CVE-2018-4117: Cross origin information leak in Blink The following user interface changes are included: - Chrome will show the "Not secure" warning on all plain HTTP pages Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-780=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-780=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-68.0.3440.75-164.1 chromedriver-debuginfo-68.0.3440.75-164.1 chromium-68.0.3440.75-164.1 chromium-debuginfo-68.0.3440.75-164.1 chromium-debugsource-68.0.3440.75-164.1 - openSUSE Leap 15.0 (x86_64): chromedriver-68.0.3440.75-lp150.2.6.1 chromedriver-debuginfo-68.0.3440.75-lp150.2.6.1 chromium-68.0.3440.75-lp150.2.6.1 chromium-debuginfo-68.0.3440.75-lp150.2.6.1 chromium-debugsource-68.0.3440.75-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-4117.html https://www.suse.com/security/cve/CVE-2018-6044.html https://www.suse.com/security/cve/CVE-2018-6153.html https://www.suse.com/security/cve/CVE-2018-6154.html https://www.suse.com/security/cve/CVE-2018-6155.html https://www.suse.com/security/cve/CVE-2018-6156.html https://www.suse.com/security/cve/CVE-2018-6157.html https://www.suse.com/security/cve/CVE-2018-6158.html https://www.suse.com/security/cve/CVE-2018-6159.html https://www.suse.com/security/cve/CVE-2018-6161.html https://www.suse.com/security/cve/CVE-2018-6162.html https://www.suse.com/security/cve/CVE-2018-6163.html https://www.suse.com/security/cve/CVE-2018-6164.html https://www.suse.com/security/cve/CVE-2018-6165.html https://www.suse.com/security/cve/CVE-2018-6166.html https://www.suse.com/security/cve/CVE-2018-6167.html https://www.suse.com/security/cve/CVE-2018-6168.html https://www.suse.com/security/cve/CVE-2018-6169.html https://www.suse.com/security/cve/CVE-2018-6170.html https://www.suse.com/security/cve/CVE-2018-6171.html https://www.suse.com/security/cve/CVE-2018-6172.html https://www.suse.com/security/cve/CVE-2018-6173.html https://www.suse.com/security/cve/CVE-2018-6174.html https://www.suse.com/security/cve/CVE-2018-6175.html https://www.suse.com/security/cve/CVE-2018-6176.html https://www.suse.com/security/cve/CVE-2018-6177.html https://www.suse.com/security/cve/CVE-2018-6178.html https://www.suse.com/security/cve/CVE-2018-6179.html https://bugzilla.suse.com/1102530

1 0

openSUSE-SU-2018:2133-1: moderate: Security update for e2fsprogs
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for e2fsprogs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2133-1 Rating: moderate References: #1009532 #1038194 #915402 #918346 #960273 Cross-References: CVE-2015-0247 CVE-2015-1572 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for e2fsprogs fixes the following issues: Security issues fixed: - CVE-2015-0247: Fixed couple of heap overflows in e2fsprogs (fsck, dumpe2fs, e2image...) (bsc#915402). - CVE-2015-1572: Fixed potential buffer overflow in closefs() (bsc#918346). Bug fixes: - bsc#1038194: generic/405 test fails with /dev/mapper/thin-vol is inconsistent on ext4 file system. - bsc#1009532: resize2fs hangs when trying to resize a large ext4 file system. - bsc#960273: xfsprogs does not call %{?regenerate_initrd_post}. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-771=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): e2fsprogs-1.43.8-lp150.3.3.1 e2fsprogs-debuginfo-1.43.8-lp150.3.3.1 e2fsprogs-debugsource-1.43.8-lp150.3.3.1 e2fsprogs-devel-1.43.8-lp150.3.3.1 libcom_err-devel-1.43.8-lp150.3.3.1 libcom_err-devel-static-1.43.8-lp150.3.3.1 libcom_err2-1.43.8-lp150.3.3.1 libcom_err2-debuginfo-1.43.8-lp150.3.3.1 libext2fs-devel-1.43.8-lp150.3.3.1 libext2fs-devel-static-1.43.8-lp150.3.3.1 libext2fs2-1.43.8-lp150.3.3.1 libext2fs2-debuginfo-1.43.8-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): e2fsprogs-32bit-debuginfo-1.43.8-lp150.3.3.1 libcom_err-devel-32bit-1.43.8-lp150.3.3.1 libcom_err2-32bit-1.43.8-lp150.3.3.1 libcom_err2-32bit-debuginfo-1.43.8-lp150.3.3.1 libext2fs-devel-32bit-1.43.8-lp150.3.3.1 libext2fs2-32bit-1.43.8-lp150.3.3.1 libext2fs2-32bit-debuginfo-1.43.8-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2015-0247.html https://www.suse.com/security/cve/CVE-2015-1572.html https://bugzilla.suse.com/1009532 https://bugzilla.suse.com/1038194 https://bugzilla.suse.com/915402 https://bugzilla.suse.com/918346 https://bugzilla.suse.com/960273

1 0

openSUSE-SU-2018:2132-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2132-1 Rating: moderate References: #1100353 #1100354 #1100355 Cross-References: CVE-2018-13346 CVE-2018-13347 CVE-2018-13348 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mercurial fixes the following issues: Security issues fixed: - CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (bsc#1100354). - CVE-2018-13347: Fix mpatch.c that mishandles integer addition and subtraction (bsc#1100355). - CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that mishandles certain situations where there should be at least 12 bytes remaining after thecurrent position in the patch data (bsc#1100353). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-772=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): mercurial-4.5.2-lp150.2.3.1 mercurial-debuginfo-4.5.2-lp150.2.3.1 mercurial-debugsource-4.5.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): mercurial-lang-4.5.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-13346.html https://www.suse.com/security/cve/CVE-2018-13347.html https://www.suse.com/security/cve/CVE-2018-13348.html https://bugzilla.suse.com/1100353 https://bugzilla.suse.com/1100354 https://bugzilla.suse.com/1100355

1 0

openSUSE-SU-2018:2131-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2131-1 Rating: moderate References: #1072697 #1100694 Cross-References: CVE-2017-13098 CVE-2018-1000613 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bouncycastle fixes the following issues: Security issues fixed: - CVE-2018-1000613: Fix use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (boo#1100694). - CVE-2017-13098: Fix against Bleichenbacher oracle when not using the lightweight APIs (boo#1072697). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-776=1 Package List: - openSUSE Leap 15.0 (noarch): bouncycastle-1.60-lp150.2.3.1 bouncycastle-javadoc-1.60-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2017-13098.html https://www.suse.com/security/cve/CVE-2018-1000613.html https://bugzilla.suse.com/1072697 https://bugzilla.suse.com/1100694

1 0

openSUSE-SU-2018:2130-1: moderate: Security update for qutebrowser
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for qutebrowser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2130-1 Rating: moderate References: #1101507 Cross-References: CVE-2018-1000559 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for qutebrowser fixes the following issues: Security issue fixed: - CVE-2018-1000559: Fix an XSS issue on qute://history (boo#1101507). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-774=1 Package List: - openSUSE Leap 42.3 (noarch): qutebrowser-0.11.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000559.html https://bugzilla.suse.com/1101507

1 0

openSUSE-SU-2018:2129-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2129-1 Rating: moderate References: #1097158 #1097624 #1098592 Cross-References: CVE-2018-0732 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158). - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-763=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2n-lp150.2.3.1 libopenssl1_0_0-1.0.2n-lp150.2.3.1 libopenssl1_0_0-debuginfo-1.0.2n-lp150.2.3.1 libopenssl1_0_0-hmac-1.0.2n-lp150.2.3.1 libopenssl1_0_0-steam-1.0.2n-lp150.2.3.1 libopenssl1_0_0-steam-debuginfo-1.0.2n-lp150.2.3.1 openssl-1_0_0-1.0.2n-lp150.2.3.1 openssl-1_0_0-cavs-1.0.2n-lp150.2.3.1 openssl-1_0_0-cavs-debuginfo-1.0.2n-lp150.2.3.1 openssl-1_0_0-debuginfo-1.0.2n-lp150.2.3.1 openssl-1_0_0-debugsource-1.0.2n-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2n-lp150.2.3.1 libopenssl1_0_0-32bit-1.0.2n-lp150.2.3.1 libopenssl1_0_0-32bit-debuginfo-1.0.2n-lp150.2.3.1 libopenssl1_0_0-hmac-32bit-1.0.2n-lp150.2.3.1 libopenssl1_0_0-steam-32bit-1.0.2n-lp150.2.3.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2n-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2n-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097624 https://bugzilla.suse.com/1098592

1 0

openSUSE-SU-2018:2128-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 28 Jul '18

28 Jul '18

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2128-1 Rating: moderate References: #1076957 Cross-References: CVE-2016-10708 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssh fixes the following issues: Security issue fixed: - CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message (bsc#1076957). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-765=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): openssh-7.2p2-21.1 openssh-askpass-gnome-7.2p2-21.1 openssh-askpass-gnome-debuginfo-7.2p2-21.1 openssh-cavs-7.2p2-21.1 openssh-cavs-debuginfo-7.2p2-21.1 openssh-debuginfo-7.2p2-21.1 openssh-debugsource-7.2p2-21.1 openssh-fips-7.2p2-21.1 openssh-helpers-7.2p2-21.1 openssh-helpers-debuginfo-7.2p2-21.1 References: https://www.suse.com/security/cve/CVE-2016-10708.html https://bugzilla.suse.com/1076957

1 0