August 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2210-1: Security update for nautilus
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for nautilus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2210-1 Rating: low References: #1060031 Cross-References: CVE-2017-14604 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nautilus fixes the following issues: Security issue fixed: - CVE-2017-14604: Add a metadata::trusted metadata to the file once the user acknowledges the file as trusted, and also remove the "trusted" content in the desktop file (bsc#1060031). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-802=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnome-shell-search-provider-nautilus-3.20.3-8.3.1 libnautilus-extension1-3.20.3-8.3.1 libnautilus-extension1-debuginfo-3.20.3-8.3.1 nautilus-3.20.3-8.3.1 nautilus-debuginfo-3.20.3-8.3.1 nautilus-debugsource-3.20.3-8.3.1 nautilus-devel-3.20.3-8.3.1 typelib-1_0-Nautilus-3_0-3.20.3-8.3.1 - openSUSE Leap 42.3 (x86_64): libnautilus-extension1-32bit-3.20.3-8.3.1 libnautilus-extension1-debuginfo-32bit-3.20.3-8.3.1 - openSUSE Leap 42.3 (noarch): nautilus-lang-3.20.3-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-14604.html https://bugzilla.suse.com/1060031

1 0

openSUSE-SU-2018:2209-1: moderate: Security update for libsndfile
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2209-1 Rating: moderate References: #1071767 #1071777 #1100167 Cross-References: CVE-2017-17456 CVE-2017-17457 CVE-2018-13139 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libsndfile fixes the following issues: Security issues fixed: - CVE-2018-13139: Fix a stack-based buffer overflow in psf_memset in common.c that allows remote attackers to cause a denial of service (bsc#1100167). - CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777) - CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-806=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsndfile-debugsource-1.0.28-lp150.3.3.1 libsndfile-devel-1.0.28-lp150.3.3.1 libsndfile1-1.0.28-lp150.3.3.1 libsndfile1-debuginfo-1.0.28-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libsndfile-progs-1.0.28-lp150.3.3.1 libsndfile-progs-debuginfo-1.0.28-lp150.3.3.1 libsndfile-progs-debugsource-1.0.28-lp150.3.3.1 libsndfile1-32bit-1.0.28-lp150.3.3.1 libsndfile1-32bit-debuginfo-1.0.28-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-17456.html https://www.suse.com/security/cve/CVE-2017-17457.html https://www.suse.com/security/cve/CVE-2018-13139.html https://bugzilla.suse.com/1071767 https://bugzilla.suse.com/1071777 https://bugzilla.suse.com/1100167

1 0

openSUSE-SU-2018:2208-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2208-1 Rating: moderate References: #1094289 Cross-References: CVE-2018-0739 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094289). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-807=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.3.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.3.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-0739.html https://bugzilla.suse.com/1094289

1 0

openSUSE-SU-2018:2206-1: important: Security update for java-10-openjdk
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for java-10-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2206-1 Rating: important References: #1096420 #1101645 #1101651 #1101655 #1101656 Cross-References: CVE-2018-2940 CVE-2018-2952 CVE-2018-2972 CVE-2018-2973 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for OpenJDK 10.0.2 fixes the following security issues: - CVE-2018-2940: the libraries sub-component contained an easily exploitable vulnerability that allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining unauthorized read access to data that's accessible to the server. [bsc#1101645] - CVE-2018-2952: the concurrency sub-component contained a difficult to exploit vulnerability that allowed attackers to compromise Java SE, Java SE Embedded, or JRockit over the network. This issue could have been abused to mount a partial denial-of-service attack on the server. [bsc#1101651] - CVE-2018-2972: the security sub-component contained a difficult to exploit vulnerability that allowed attackers to compromise Java SE over the network, potentially gaining unauthorized access to critical data or complete access to all Java SE accessible data. [bsc#1101655) - CVE-2018-2973: the JSSE sub-component contained a difficult to exploit vulnerability allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining the ability to create, delete or modify critical data or all Java SE, Java SE Embedded accessible data without authorization. [bsc#1101656] Furthemore, the following bugs were fixed: - Properly remove the existing alternative for java before reinstalling it. [bsc#1096420] - idlj was moved to the *-devel package. [bsc#1096420] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-810=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-10-openjdk-10.0.2.0-lp150.2.3.2 java-10-openjdk-accessibility-10.0.2.0-lp150.2.3.2 java-10-openjdk-accessibility-debuginfo-10.0.2.0-lp150.2.3.2 java-10-openjdk-debuginfo-10.0.2.0-lp150.2.3.2 java-10-openjdk-debugsource-10.0.2.0-lp150.2.3.2 java-10-openjdk-demo-10.0.2.0-lp150.2.3.2 java-10-openjdk-devel-10.0.2.0-lp150.2.3.2 java-10-openjdk-headless-10.0.2.0-lp150.2.3.2 java-10-openjdk-jmods-10.0.2.0-lp150.2.3.2 java-10-openjdk-src-10.0.2.0-lp150.2.3.2 - openSUSE Leap 15.0 (noarch): java-10-openjdk-javadoc-10.0.2.0-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-2940.html https://www.suse.com/security/cve/CVE-2018-2952.html https://www.suse.com/security/cve/CVE-2018-2972.html https://www.suse.com/security/cve/CVE-2018-2973.html https://bugzilla.suse.com/1096420 https://bugzilla.suse.com/1101645 https://bugzilla.suse.com/1101651 https://bugzilla.suse.com/1101655 https://bugzilla.suse.com/1101656

1 0

openSUSE-SU-2018:2205-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2205-1 Rating: moderate References: #1084300 Cross-References: CVE-2018-7738 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for util-linux fixes the following security issue: - CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name (bsc#1084300) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-811=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libblkid-devel-2.31.1-lp150.7.6.1 libblkid-devel-static-2.31.1-lp150.7.6.1 libblkid1-2.31.1-lp150.7.6.1 libblkid1-debuginfo-2.31.1-lp150.7.6.1 libfdisk-devel-2.31.1-lp150.7.6.1 libfdisk-devel-static-2.31.1-lp150.7.6.1 libfdisk1-2.31.1-lp150.7.6.1 libfdisk1-debuginfo-2.31.1-lp150.7.6.1 libmount-devel-2.31.1-lp150.7.6.1 libmount-devel-static-2.31.1-lp150.7.6.1 libmount1-2.31.1-lp150.7.6.1 libmount1-debuginfo-2.31.1-lp150.7.6.1 libsmartcols-devel-2.31.1-lp150.7.6.1 libsmartcols-devel-static-2.31.1-lp150.7.6.1 libsmartcols1-2.31.1-lp150.7.6.1 libsmartcols1-debuginfo-2.31.1-lp150.7.6.1 libuuid-devel-2.31.1-lp150.7.6.1 libuuid-devel-static-2.31.1-lp150.7.6.1 libuuid1-2.31.1-lp150.7.6.1 libuuid1-debuginfo-2.31.1-lp150.7.6.1 util-linux-2.31.1-lp150.7.6.1 util-linux-debuginfo-2.31.1-lp150.7.6.1 util-linux-debugsource-2.31.1-lp150.7.6.1 util-linux-systemd-2.31.1-lp150.7.6.1 util-linux-systemd-debuginfo-2.31.1-lp150.7.6.1 util-linux-systemd-debugsource-2.31.1-lp150.7.6.1 uuidd-2.31.1-lp150.7.6.1 uuidd-debuginfo-2.31.1-lp150.7.6.1 - openSUSE Leap 15.0 (noarch): util-linux-lang-2.31.1-lp150.7.6.1 - openSUSE Leap 15.0 (x86_64): libblkid-devel-32bit-2.31.1-lp150.7.6.1 libblkid1-32bit-2.31.1-lp150.7.6.1 libblkid1-32bit-debuginfo-2.31.1-lp150.7.6.1 libmount-devel-32bit-2.31.1-lp150.7.6.1 libmount1-32bit-2.31.1-lp150.7.6.1 libmount1-32bit-debuginfo-2.31.1-lp150.7.6.1 libuuid-devel-32bit-2.31.1-lp150.7.6.1 libuuid1-32bit-2.31.1-lp150.7.6.1 libuuid1-32bit-debuginfo-2.31.1-lp150.7.6.1 python-libmount-2.31.1-lp150.7.6.1 python-libmount-debuginfo-2.31.1-lp150.7.6.1 python-libmount-debugsource-2.31.1-lp150.7.6.1 References: https://www.suse.com/security/cve/CVE-2018-7738.html https://bugzilla.suse.com/1084300

1 0

openSUSE-SU-2018:2203-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2203-1 Rating: moderate References: #1072947 #1078662 #1080740 #1084300 Cross-References: CVE-2018-7738 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for util-linux fixes the following issues: This non-security issue was fixed: - CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user (bsc#1084300). These non-security issues were fixed: - Fixed crash loop in lscpu (bsc#1072947). - Fixed possible segfault of umount -a - Fixed mount -a on NFS bind mounts (bsc#1080740). - Fixed lsblk on NVMe (bsc#1078662). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-805=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libblkid-devel-2.29.2-8.1 libblkid-devel-static-2.29.2-8.1 libblkid1-2.29.2-8.1 libblkid1-debuginfo-2.29.2-8.1 libfdisk-devel-2.29.2-8.1 libfdisk-devel-static-2.29.2-8.1 libfdisk1-2.29.2-8.1 libfdisk1-debuginfo-2.29.2-8.1 libmount-devel-2.29.2-8.1 libmount-devel-static-2.29.2-8.1 libmount1-2.29.2-8.1 libmount1-debuginfo-2.29.2-8.1 libsmartcols-devel-2.29.2-8.1 libsmartcols-devel-static-2.29.2-8.1 libsmartcols1-2.29.2-8.1 libsmartcols1-debuginfo-2.29.2-8.1 libuuid-devel-2.29.2-8.1 libuuid-devel-static-2.29.2-8.1 libuuid1-2.29.2-8.1 libuuid1-debuginfo-2.29.2-8.1 python-libmount-2.29.2-8.1 python-libmount-debuginfo-2.29.2-8.1 python-libmount-debugsource-2.29.2-8.1 util-linux-2.29.2-8.1 util-linux-debuginfo-2.29.2-8.1 util-linux-debugsource-2.29.2-8.1 util-linux-systemd-2.29.2-8.1 util-linux-systemd-debuginfo-2.29.2-8.1 util-linux-systemd-debugsource-2.29.2-8.1 uuidd-2.29.2-8.1 uuidd-debuginfo-2.29.2-8.1 - openSUSE Leap 42.3 (x86_64): libblkid-devel-32bit-2.29.2-8.1 libblkid1-32bit-2.29.2-8.1 libblkid1-debuginfo-32bit-2.29.2-8.1 libmount-devel-32bit-2.29.2-8.1 libmount1-32bit-2.29.2-8.1 libmount1-debuginfo-32bit-2.29.2-8.1 libuuid-devel-32bit-2.29.2-8.1 libuuid1-32bit-2.29.2-8.1 libuuid1-debuginfo-32bit-2.29.2-8.1 - openSUSE Leap 42.3 (noarch): util-linux-lang-2.29.2-8.1 References: https://www.suse.com/security/cve/CVE-2018-7738.html https://bugzilla.suse.com/1072947 https://bugzilla.suse.com/1078662 https://bugzilla.suse.com/1080740 https://bugzilla.suse.com/1084300

1 0

openSUSE-RU-2018:2202-1: Recommended update for lldpd
by maintenance＠opensuse.org 06 Aug '18

06 Aug '18

openSUSE Recommended Update: Recommended update for lldpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2202-1 Rating: low References: #1103351 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update brings lldpd to version 1.0.1: * Fixes several issues such as + Ensure chassis-related changes are propagated immediately. + Ensure management address change is correctly detected. * Brings some new functionality Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-800=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): liblldpctl4-1.0.1-5.1 lldpd-1.0.1-5.1 lldpd-devel-1.0.1-5.1 References: https://bugzilla.suse.com/1103351

1 0

openSUSE-RU-2018:2201-1: moderate: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 04 Aug '18

04 Aug '18

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2201-1 Rating: moderate References: #1103305 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpMyAdmin fiyes the following issue: - missing dependency on php-ctype (boo#1103305) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-798=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.2-26.1 References: https://bugzilla.suse.com/1103305

1 0

openSUSE-RU-2018:2199-1: moderate: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 04 Aug '18

04 Aug '18

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2199-1 Rating: moderate References: #1103305 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpMyAdmin fiyes the following issue: - missing dependency on php-ctype (boo#1103305) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-798=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-798=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.8.2-18.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.8.2-lp150.2.6.1 References: https://bugzilla.suse.com/1103305

1 0

openSUSE-RU-2018:2198-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 04 Aug '18

04 Aug '18

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2198-1 Rating: moderate References: #1058463 #1094797 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for open-iscsi provides the following fixes: - Fix an issue with ARP booting when using different subnets. (bsc#1058463) - Fix a core dump which can occur if iscsiuio is started and immediately stopped. (bsc#1094797) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-799=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): iscsiuio-0.7.8.2-56.3 iscsiuio-debuginfo-0.7.8.2-56.3 open-iscsi-2.0.874-56.3 open-iscsi-debuginfo-2.0.874-56.3 open-iscsi-debugsource-2.0.874-56.3 open-isns-0.97-4.2.1 open-isns-debuginfo-0.97-4.2.1 open-isns-debugsource-0.97-4.2.1 open-isns-devel-0.97-4.2.1 References: https://bugzilla.suse.com/1058463 https://bugzilla.suse.com/1094797

1 0