July 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:1953-1: moderate: Security update for libvorbis
by opensuse-security＠opensuse.org 13 Jul '18

13 Jul '18

openSUSE Security Update: Security update for libvorbis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1953-1 Rating: moderate References: #1091070 Cross-References: CVE-2018-10392 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvorbis fixes the following issues: The following security issue was fixed: - Fixed the validation of channels in mapping0_forward(), which previously allowed remote attackers to cause a denial of service via specially crafted files (CVE-2018-10392, bsc#1091070) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-722=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvorbis-debugsource-1.3.6-lp150.3.3.1 libvorbis-devel-1.3.6-lp150.3.3.1 libvorbis0-1.3.6-lp150.3.3.1 libvorbis0-debuginfo-1.3.6-lp150.3.3.1 libvorbisenc2-1.3.6-lp150.3.3.1 libvorbisenc2-debuginfo-1.3.6-lp150.3.3.1 libvorbisfile3-1.3.6-lp150.3.3.1 libvorbisfile3-debuginfo-1.3.6-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libvorbis-devel-32bit-1.3.6-lp150.3.3.1 libvorbis0-32bit-1.3.6-lp150.3.3.1 libvorbis0-32bit-debuginfo-1.3.6-lp150.3.3.1 libvorbisenc2-32bit-1.3.6-lp150.3.3.1 libvorbisenc2-32bit-debuginfo-1.3.6-lp150.3.3.1 libvorbisfile3-32bit-1.3.6-lp150.3.3.1 libvorbisfile3-32bit-debuginfo-1.3.6-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): libvorbis-doc-1.3.6-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10392.html https://bugzilla.suse.com/1091070

1 0

openSUSE-RU-2018:1939-1: moderate: Recommended update for perl-Gtk2-Unique
by maintenance＠opensuse.org 12 Jul '18

12 Jul '18

openSUSE Recommended Update: Recommended update for perl-Gtk2-Unique ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1939-1 Rating: moderate References: #1099774 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Gtk2-Unique fixes the following issues: - Fix crash on starting of second instance (rt#120115, boo#1099774). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-713=1 Package List: - openSUSE Leap 15.0 (x86_64): perl-Gtk2-Unique-0.05-lp150.2.3.1 perl-Gtk2-Unique-debuginfo-0.05-lp150.2.3.1 perl-Gtk2-Unique-debugsource-0.05-lp150.2.3.1 References: https://bugzilla.suse.com/1099774

1 0

openSUSE-SU-2018:1924-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 11 Jul '18

11 Jul '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1924-1 Rating: moderate References: #1100343 #1100344 Cross-References: CVE-2018-3761 CVE-2018-3762 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Security issues fixed: - CVE-2018-3761: Fix improper authentication on the OAuth2 token endpoint (bsc#1100344). - CVE-2018-3762: Fix improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to (bsc#1100343). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-712=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-712=1 Package List: - openSUSE Leap 42.3 (noarch): nextcloud-13.0.4-9.1 - openSUSE Leap 15.0 (noarch): nextcloud-13.0.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-3761.html https://www.suse.com/security/cve/CVE-2018-3762.html https://bugzilla.suse.com/1100343 https://bugzilla.suse.com/1100344

1 0

openSUSE-RU-2018:1923-1: important: Recommended update for MozillaThunderbird
by maintenance＠opensuse.org 11 Jul '18

11 Jul '18

openSUSE Recommended Update: Recommended update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1923-1 Rating: important References: #1100780 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Mozilla Thunderbird fixes the following issue: * Deleting or detaching attachments corrupted messages under certain circumstances (boo#1100780) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-711=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-711=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): MozillaThunderbird-52.9.1-71.1 MozillaThunderbird-buildsymbols-52.9.1-71.1 MozillaThunderbird-debuginfo-52.9.1-71.1 MozillaThunderbird-debugsource-52.9.1-71.1 MozillaThunderbird-devel-52.9.1-71.1 MozillaThunderbird-translations-common-52.9.1-71.1 MozillaThunderbird-translations-other-52.9.1-71.1 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-52.9.1-lp150.3.11.1 MozillaThunderbird-buildsymbols-52.9.1-lp150.3.11.1 MozillaThunderbird-debuginfo-52.9.1-lp150.3.11.1 MozillaThunderbird-debugsource-52.9.1-lp150.3.11.1 MozillaThunderbird-devel-52.9.1-lp150.3.11.1 MozillaThunderbird-translations-common-52.9.1-lp150.3.11.1 MozillaThunderbird-translations-other-52.9.1-lp150.3.11.1 References: https://bugzilla.suse.com/1100780

1 0

openSUSE-RU-2018:1922-1: important: Recommended update for MozillaThunderbird
by maintenance＠opensuse.org 11 Jul '18

11 Jul '18

openSUSE Recommended Update: Recommended update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1922-1 Rating: important References: #1100780 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Mozilla Thunderbird fixes the following issue: * Deleting or detaching attachments corrupted messages under certain circumstances (boo#1100780) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-711=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.9.1-68.1 MozillaThunderbird-buildsymbols-52.9.1-68.1 MozillaThunderbird-debuginfo-52.9.1-68.1 MozillaThunderbird-debugsource-52.9.1-68.1 MozillaThunderbird-devel-52.9.1-68.1 MozillaThunderbird-translations-common-52.9.1-68.1 MozillaThunderbird-translations-other-52.9.1-68.1 References: https://bugzilla.suse.com/1100780

1 0

openSUSE-RU-2018:1921-1: moderate: Recommended update for mc
by maintenance＠opensuse.org 11 Jul '18

11 Jul '18

openSUSE Recommended Update: Recommended update for mc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1921-1 Rating: moderate References: #1087708 #1098235 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mc fixes the following issues: - Fix logins to remote SSH sessions where only Keyboard-Interactive password is available and tunneled password is disabled (boo#1098235) - Fix mc to call xls2csv correctly (boo#1087708) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-710=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-710=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): mc-4.8.15-10.3.1 mc-debuginfo-4.8.15-10.3.1 mc-debugsource-4.8.15-10.3.1 - openSUSE Leap 42.3 (noarch): mc-lang-4.8.15-10.3.1 - openSUSE Leap 15.0 (noarch): mc-lang-4.8.20-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mc-4.8.20-lp150.3.3.1 mc-debuginfo-4.8.20-lp150.3.3.1 mc-debugsource-4.8.20-lp150.3.3.1 References: https://bugzilla.suse.com/1087708 https://bugzilla.suse.com/1098235

1 0

openSUSE-SU-2018:1914-1: moderate: Security update for unzip
by opensuse-security＠opensuse.org 07 Jul '18

07 Jul '18

openSUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1914-1 Rating: moderate References: #1080074 #910683 #914442 Cross-References: CVE-2014-9636 CVE-2018-1000035 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for unzip fixes the following issues: - CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442) - CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074) This non-security issue was fixed: +- Allow processing of Windows zip64 archives (Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher) (bnc#910683) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-709=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): unzip-6.00-lp150.3.3.1 unzip-debuginfo-6.00-lp150.3.3.1 unzip-debugsource-6.00-lp150.3.3.1 unzip-doc-6.00-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): unzip-rcc-6.00-lp150.3.3.1 unzip-rcc-debuginfo-6.00-lp150.3.3.1 unzip-rcc-debugsource-6.00-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2014-9636.html https://www.suse.com/security/cve/CVE-2018-1000035.html https://bugzilla.suse.com/1080074 https://bugzilla.suse.com/910683 https://bugzilla.suse.com/914442

1 0

openSUSE-SU-2018:1913-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 07 Jul '18

07 Jul '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1913-1 Rating: moderate References: #1099098 Cross-References: CVE-2018-12882 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2018-12882: exif_read_from_impl allowed attackers to trigger a use-after-free (in exif_read_from_file) because it closed a stream that it is not responsible for closing (bsc#1099098) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-708=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-40.1 apache2-mod_php7-debuginfo-7.0.7-40.1 php7-7.0.7-40.1 php7-bcmath-7.0.7-40.1 php7-bcmath-debuginfo-7.0.7-40.1 php7-bz2-7.0.7-40.1 php7-bz2-debuginfo-7.0.7-40.1 php7-calendar-7.0.7-40.1 php7-calendar-debuginfo-7.0.7-40.1 php7-ctype-7.0.7-40.1 php7-ctype-debuginfo-7.0.7-40.1 php7-curl-7.0.7-40.1 php7-curl-debuginfo-7.0.7-40.1 php7-dba-7.0.7-40.1 php7-dba-debuginfo-7.0.7-40.1 php7-debuginfo-7.0.7-40.1 php7-debugsource-7.0.7-40.1 php7-devel-7.0.7-40.1 php7-dom-7.0.7-40.1 php7-dom-debuginfo-7.0.7-40.1 php7-enchant-7.0.7-40.1 php7-enchant-debuginfo-7.0.7-40.1 php7-exif-7.0.7-40.1 php7-exif-debuginfo-7.0.7-40.1 php7-fastcgi-7.0.7-40.1 php7-fastcgi-debuginfo-7.0.7-40.1 php7-fileinfo-7.0.7-40.1 php7-fileinfo-debuginfo-7.0.7-40.1 php7-firebird-7.0.7-40.1 php7-firebird-debuginfo-7.0.7-40.1 php7-fpm-7.0.7-40.1 php7-fpm-debuginfo-7.0.7-40.1 php7-ftp-7.0.7-40.1 php7-ftp-debuginfo-7.0.7-40.1 php7-gd-7.0.7-40.1 php7-gd-debuginfo-7.0.7-40.1 php7-gettext-7.0.7-40.1 php7-gettext-debuginfo-7.0.7-40.1 php7-gmp-7.0.7-40.1 php7-gmp-debuginfo-7.0.7-40.1 php7-iconv-7.0.7-40.1 php7-iconv-debuginfo-7.0.7-40.1 php7-imap-7.0.7-40.1 php7-imap-debuginfo-7.0.7-40.1 php7-intl-7.0.7-40.1 php7-intl-debuginfo-7.0.7-40.1 php7-json-7.0.7-40.1 php7-json-debuginfo-7.0.7-40.1 php7-ldap-7.0.7-40.1 php7-ldap-debuginfo-7.0.7-40.1 php7-mbstring-7.0.7-40.1 php7-mbstring-debuginfo-7.0.7-40.1 php7-mcrypt-7.0.7-40.1 php7-mcrypt-debuginfo-7.0.7-40.1 php7-mysql-7.0.7-40.1 php7-mysql-debuginfo-7.0.7-40.1 php7-odbc-7.0.7-40.1 php7-odbc-debuginfo-7.0.7-40.1 php7-opcache-7.0.7-40.1 php7-opcache-debuginfo-7.0.7-40.1 php7-openssl-7.0.7-40.1 php7-openssl-debuginfo-7.0.7-40.1 php7-pcntl-7.0.7-40.1 php7-pcntl-debuginfo-7.0.7-40.1 php7-pdo-7.0.7-40.1 php7-pdo-debuginfo-7.0.7-40.1 php7-pgsql-7.0.7-40.1 php7-pgsql-debuginfo-7.0.7-40.1 php7-phar-7.0.7-40.1 php7-phar-debuginfo-7.0.7-40.1 php7-posix-7.0.7-40.1 php7-posix-debuginfo-7.0.7-40.1 php7-pspell-7.0.7-40.1 php7-pspell-debuginfo-7.0.7-40.1 php7-readline-7.0.7-40.1 php7-readline-debuginfo-7.0.7-40.1 php7-shmop-7.0.7-40.1 php7-shmop-debuginfo-7.0.7-40.1 php7-snmp-7.0.7-40.1 php7-snmp-debuginfo-7.0.7-40.1 php7-soap-7.0.7-40.1 php7-soap-debuginfo-7.0.7-40.1 php7-sockets-7.0.7-40.1 php7-sockets-debuginfo-7.0.7-40.1 php7-sqlite-7.0.7-40.1 php7-sqlite-debuginfo-7.0.7-40.1 php7-sysvmsg-7.0.7-40.1 php7-sysvmsg-debuginfo-7.0.7-40.1 php7-sysvsem-7.0.7-40.1 php7-sysvsem-debuginfo-7.0.7-40.1 php7-sysvshm-7.0.7-40.1 php7-sysvshm-debuginfo-7.0.7-40.1 php7-tidy-7.0.7-40.1 php7-tidy-debuginfo-7.0.7-40.1 php7-tokenizer-7.0.7-40.1 php7-tokenizer-debuginfo-7.0.7-40.1 php7-wddx-7.0.7-40.1 php7-wddx-debuginfo-7.0.7-40.1 php7-xmlreader-7.0.7-40.1 php7-xmlreader-debuginfo-7.0.7-40.1 php7-xmlrpc-7.0.7-40.1 php7-xmlrpc-debuginfo-7.0.7-40.1 php7-xmlwriter-7.0.7-40.1 php7-xmlwriter-debuginfo-7.0.7-40.1 php7-xsl-7.0.7-40.1 php7-xsl-debuginfo-7.0.7-40.1 php7-zip-7.0.7-40.1 php7-zip-debuginfo-7.0.7-40.1 php7-zlib-7.0.7-40.1 php7-zlib-debuginfo-7.0.7-40.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-40.1 php7-pear-Archive_Tar-7.0.7-40.1 References: https://www.suse.com/security/cve/CVE-2018-12882.html https://bugzilla.suse.com/1099098

1 0

openSUSE-SU-2018:1912-1: moderate: Security update for openvpn
by opensuse-security＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1912-1 Rating: moderate References: #1090839 Cross-References: CVE-2018-9336 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn fixes the following issues: - CVE-2018-9336: Fix potential double-free() in Interactive Service could lead to denial of service (bsc#1090839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-705=1 Package List: - openSUSE Leap 15.0 (x86_64): openvpn-2.4.3-lp150.3.3.1 openvpn-auth-pam-plugin-2.4.3-lp150.3.3.1 openvpn-auth-pam-plugin-debuginfo-2.4.3-lp150.3.3.1 openvpn-debuginfo-2.4.3-lp150.3.3.1 openvpn-debugsource-2.4.3-lp150.3.3.1 openvpn-devel-2.4.3-lp150.3.3.1 openvpn-down-root-plugin-2.4.3-lp150.3.3.1 openvpn-down-root-plugin-debuginfo-2.4.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-9336.html https://bugzilla.suse.com/1090839

1 0

openSUSE-RU-2018:1911-1: moderate: Recommended update for openvswitch
by maintenance＠opensuse.org 06 Jul '18

06 Jul '18

openSUSE Recommended Update: Recommended update for openvswitch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1911-1 Rating: moderate References: #1076284 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openvswitch provides the following fixes: - Add support for RedHat distributions. All SUSE macros are now conditional and the spec file has been adapted based on the upstream one. (fate#324537) - Fix documentation installation to make sure the testsuite runs properly. (bsc#1076284) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-703=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): openvswitch-2.7.0-13.1 openvswitch-debuginfo-2.7.0-13.1 openvswitch-debugsource-2.7.0-13.1 openvswitch-devel-2.7.0-13.1 openvswitch-ovn-central-2.7.0-13.1 openvswitch-ovn-central-debuginfo-2.7.0-13.1 openvswitch-ovn-common-2.7.0-13.1 openvswitch-ovn-common-debuginfo-2.7.0-13.1 openvswitch-ovn-docker-2.7.0-13.1 openvswitch-ovn-host-2.7.0-13.1 openvswitch-ovn-host-debuginfo-2.7.0-13.1 openvswitch-ovn-vtep-2.7.0-13.1 openvswitch-ovn-vtep-debuginfo-2.7.0-13.1 openvswitch-pki-2.7.0-13.1 openvswitch-test-2.7.0-13.1 openvswitch-test-debuginfo-2.7.0-13.1 openvswitch-vtep-2.7.0-13.1 openvswitch-vtep-debuginfo-2.7.0-13.1 python-openvswitch-2.7.0-13.1 python-openvswitch-test-2.7.0-13.1 References: https://bugzilla.suse.com/1076284

1 0