August 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2018:2195-1: Optional update to add kubectl to SUSE PackageHub
by maintenance＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Optional Update: Optional update to add kubectl to SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2195-1 Rating: low References: #1097473 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds kubectl to the SUSE PackageHub. Kubectl contains client tools for Kubernetes. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-797=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go-md2man-1.0.6+git20160904.a65d4d2-2.1 golang-github-cpuguy83-go-md2man-1.0.6+git20160904.a65d4d2-2.1 golang-github-jteeuwen-go-bindata-3.0.7+git20151023.72.a0ff256-2.1 golang-github-jteeuwen-go-bindata-debuginfo-3.0.7+git20151023.72.a0ff256-2.1 golang-github-jteeuwen-go-bindata-debugsource-3.0.7+git20151023.72.a0ff256-2.1 kubectl-1.9.8-2.1 References: https://bugzilla.suse.com/1097473

1 0

openSUSE-OU-2018:2194-1: Optional package cacti
by maintenance＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Optional Update: Optional package cacti ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2194-1 Rating: low References: #022564 #1047512 #1048102 #1050950 #1051633 #1054390 #1054742 #1067163 #1067164 #1067166 #1068028 #1101024 #1101139 #837440 #862993 #867607 #870821 #872008 #934187 #937997 #958863 #958977 #960678 #965930 #971357 #974013 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update introduces cacti to PackageHub: Cacti is a complete front-end to RRDtool, capable of taking care of generating graphs, data gathering and so on. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-796=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.1.38-2.1 cacti-doc-1.1.38-2.1 References: https://www.suse.com/security/cve/CVE-2006-6799.html https://www.suse.com/security/cve/CVE-2007-3112.html https://www.suse.com/security/cve/CVE-2007-3113.html https://www.suse.com/security/cve/CVE-2013-5588.html https://www.suse.com/security/cve/CVE-2013-5589.html https://www.suse.com/security/cve/CVE-2014-2326.html https://www.suse.com/security/cve/CVE-2014-2327.html https://www.suse.com/security/cve/CVE-2014-2328.html https://www.suse.com/security/cve/CVE-2014-2708.html https://www.suse.com/security/cve/CVE-2014-2709.html https://www.suse.com/security/cve/CVE-2014-4000.html https://www.suse.com/security/cve/CVE-2014-4002.html https://www.suse.com/security/cve/CVE-2014-5025.html https://www.suse.com/security/cve/CVE-2014-5026.html https://www.suse.com/security/cve/CVE-2015-4342.html https://www.suse.com/security/cve/CVE-2015-4634.html https://www.suse.com/security/cve/CVE-2015-8369.html https://www.suse.com/security/cve/CVE-2015-8377.html https://www.suse.com/security/cve/CVE-2015-8604.html https://www.suse.com/security/cve/CVE-2016-2313.html https://www.suse.com/security/cve/CVE-2016-3172.html https://www.suse.com/security/cve/CVE-2016-3659.html https://www.suse.com/security/cve/CVE-2017-10970.html https://www.suse.com/security/cve/CVE-2017-11163.html https://www.suse.com/security/cve/CVE-2017-11691.html https://www.suse.com/security/cve/CVE-2017-12065.html https://www.suse.com/security/cve/CVE-2017-12927.html https://www.suse.com/security/cve/CVE-2017-12978.html https://www.suse.com/security/cve/CVE-2017-15194.html https://www.suse.com/security/cve/CVE-2017-16641.html https://www.suse.com/security/cve/CVE-2017-16660.html https://www.suse.com/security/cve/CVE-2017-16661.html https://www.suse.com/security/cve/CVE-2017-16785.html https://bugzilla.suse.com/022564 https://bugzilla.suse.com/1047512 https://bugzilla.suse.com/1048102 https://bugzilla.suse.com/1050950 https://bugzilla.suse.com/1051633 https://bugzilla.suse.com/1054390 https://bugzilla.suse.com/1054742 https://bugzilla.suse.com/1067163 https://bugzilla.suse.com/1067164 https://bugzilla.suse.com/1067166 https://bugzilla.suse.com/1068028 https://bugzilla.suse.com/1101024 https://bugzilla.suse.com/1101139 https://bugzilla.suse.com/837440 https://bugzilla.suse.com/862993 https://bugzilla.suse.com/867607 https://bugzilla.suse.com/870821 https://bugzilla.suse.com/872008 https://bugzilla.suse.com/934187 https://bugzilla.suse.com/937997 https://bugzilla.suse.com/958863 https://bugzilla.suse.com/958977 https://bugzilla.suse.com/960678 https://bugzilla.suse.com/965930 https://bugzilla.suse.com/971357 https://bugzilla.suse.com/974013

1 0

openSUSE-SU-2018:2188-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2188-1 Rating: moderate References: #1082692 #1101776 #1101777 #1101786 #1101788 #1101794 #1101800 #1101804 #1101810 Cross-References: CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14368 CVE-2018-14369 CVE-2018-7325 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-7325: RPKI-Router infinite loop (boo#1082692) - CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, boo#1101777) - CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, boo#1101788) - CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, boo#1101804) - CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, boo#1101786) - CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, boo#1101810) - CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, boo#1101776) - CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, boo#1101794) - CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, boo#1101800) Bug fixes: - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.16.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-792=1 Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.16-44.1 wireshark-debuginfo-2.2.16-44.1 wireshark-debugsource-2.2.16-44.1 wireshark-devel-2.2.16-44.1 wireshark-ui-gtk-2.2.16-44.1 wireshark-ui-gtk-debuginfo-2.2.16-44.1 wireshark-ui-qt-2.2.16-44.1 wireshark-ui-qt-debuginfo-2.2.16-44.1 References: https://www.suse.com/security/cve/CVE-2018-14339.html https://www.suse.com/security/cve/CVE-2018-14340.html https://www.suse.com/security/cve/CVE-2018-14341.html https://www.suse.com/security/cve/CVE-2018-14342.html https://www.suse.com/security/cve/CVE-2018-14343.html https://www.suse.com/security/cve/CVE-2018-14344.html https://www.suse.com/security/cve/CVE-2018-14368.html https://www.suse.com/security/cve/CVE-2018-14369.html https://www.suse.com/security/cve/CVE-2018-7325.html https://bugzilla.suse.com/1082692 https://bugzilla.suse.com/1101776 https://bugzilla.suse.com/1101777 https://bugzilla.suse.com/1101786 https://bugzilla.suse.com/1101788 https://bugzilla.suse.com/1101794 https://bugzilla.suse.com/1101800 https://bugzilla.suse.com/1101804 https://bugzilla.suse.com/1101810

1 0

openSUSE-SU-2018:2184-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2184-1 Rating: moderate References: #1101776 #1101777 #1101786 #1101788 #1101791 #1101794 #1101800 #1101802 #1101804 #1101810 Cross-References: CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14367 CVE-2018-14368 CVE-2018-14369 CVE-2018-14370 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, boo#1101777) - CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, boo#1101788) - CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, boo#1101804) - CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, boo#1101786) - CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, boo#1101810) - CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, boo#1101776) - CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, boo#1101794) - CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, boo#1101800) - CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, boo#1101791) - CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, boo#1101802) Bug fixes: - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.8.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-793=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.8-lp150.2.6.1 libwireshark9-debuginfo-2.4.8-lp150.2.6.1 libwiretap7-2.4.8-lp150.2.6.1 libwiretap7-debuginfo-2.4.8-lp150.2.6.1 libwscodecs1-2.4.8-lp150.2.6.1 libwscodecs1-debuginfo-2.4.8-lp150.2.6.1 libwsutil8-2.4.8-lp150.2.6.1 libwsutil8-debuginfo-2.4.8-lp150.2.6.1 wireshark-2.4.8-lp150.2.6.1 wireshark-debuginfo-2.4.8-lp150.2.6.1 wireshark-debugsource-2.4.8-lp150.2.6.1 wireshark-devel-2.4.8-lp150.2.6.1 wireshark-ui-qt-2.4.8-lp150.2.6.1 wireshark-ui-qt-debuginfo-2.4.8-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-14339.html https://www.suse.com/security/cve/CVE-2018-14340.html https://www.suse.com/security/cve/CVE-2018-14341.html https://www.suse.com/security/cve/CVE-2018-14342.html https://www.suse.com/security/cve/CVE-2018-14343.html https://www.suse.com/security/cve/CVE-2018-14344.html https://www.suse.com/security/cve/CVE-2018-14367.html https://www.suse.com/security/cve/CVE-2018-14368.html https://www.suse.com/security/cve/CVE-2018-14369.html https://www.suse.com/security/cve/CVE-2018-14370.html https://bugzilla.suse.com/1101776 https://bugzilla.suse.com/1101777 https://bugzilla.suse.com/1101786 https://bugzilla.suse.com/1101788 https://bugzilla.suse.com/1101791 https://bugzilla.suse.com/1101794 https://bugzilla.suse.com/1101800 https://bugzilla.suse.com/1101802 https://bugzilla.suse.com/1101804 https://bugzilla.suse.com/1101810

1 0

openSUSE-SU-2018:2180-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2180-1 Rating: moderate References: #1100694 Cross-References: CVE-2018-1000613 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following issues: Security issue fixed: - CVE-2018-1000613: Fix use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (boo#1100694). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-794=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.60-23.7.1 bouncycastle-javadoc-1.60-23.7.1 References: https://www.suse.com/security/cve/CVE-2018-1000613.html https://bugzilla.suse.com/1100694

1 0

openSUSE-SU-2018:2178-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 03 Aug '18

03 Aug '18

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2178-1 Rating: moderate References: #1064455 #1090766 #1097410 Cross-References: CVE-2018-0495 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libgcrypt fixes the following issues: The following security vulnerability was addressed: - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures (bsc#1097410). The following other issues were fixed: - Extended the fipsdrv dsa-sign and dsa-verify commands with the --algo parameter for the FIPS testing of DSA SigVer and SigGen (bsc#1064455). - Ensure libgcrypt20-hmac and libgcrypt20 are installed in the correct order. (bsc#1090766) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-795=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgcrypt-cavs-1.6.1-45.1 libgcrypt-cavs-debuginfo-1.6.1-45.1 libgcrypt-debugsource-1.6.1-45.1 libgcrypt-devel-1.6.1-45.1 libgcrypt-devel-debuginfo-1.6.1-45.1 libgcrypt20-1.6.1-45.1 libgcrypt20-debuginfo-1.6.1-45.1 libgcrypt20-hmac-1.6.1-45.1 - openSUSE Leap 42.3 (x86_64): libgcrypt-devel-32bit-1.6.1-45.1 libgcrypt-devel-debuginfo-32bit-1.6.1-45.1 libgcrypt20-32bit-1.6.1-45.1 libgcrypt20-debuginfo-32bit-1.6.1-45.1 libgcrypt20-hmac-32bit-1.6.1-45.1 References: https://www.suse.com/security/cve/CVE-2018-0495.html https://bugzilla.suse.com/1064455 https://bugzilla.suse.com/1090766 https://bugzilla.suse.com/1097410

1 0

openSUSE-RU-2018:2170-1: moderate: Recommended update for libkgapi
by maintenance＠opensuse.org 02 Aug '18

02 Aug '18

openSUSE Recommended Update: Recommended update for libkgapi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2170-1 Rating: moderate References: #1101938 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libkgapi fixes the following issues: - Bugfix: Don't log oauth credentials in journal (boo#1101938) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-791=1 Package List: - openSUSE Leap 15.0 (noarch): libkgapi-lang-17.12.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libKPimGAPIBlogger5-17.12.3-lp150.2.3.1 libKPimGAPIBlogger5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPICalendar5-17.12.3-lp150.2.3.1 libKPimGAPICalendar5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPIContacts5-17.12.3-lp150.2.3.1 libKPimGAPIContacts5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPICore5-17.12.3-lp150.2.3.1 libKPimGAPICore5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPIDrive5-17.12.3-lp150.2.3.1 libKPimGAPIDrive5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPILatitude5-17.12.3-lp150.2.3.1 libKPimGAPILatitude5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPIMaps5-17.12.3-lp150.2.3.1 libKPimGAPIMaps5-debuginfo-17.12.3-lp150.2.3.1 libKPimGAPITasks5-17.12.3-lp150.2.3.1 libKPimGAPITasks5-debuginfo-17.12.3-lp150.2.3.1 libkgapi-debuginfo-17.12.3-lp150.2.3.1 libkgapi-debugsource-17.12.3-lp150.2.3.1 libkgapi-devel-17.12.3-lp150.2.3.1 References: https://bugzilla.suse.com/1101938

1 0

openSUSE-OU-2018:2167-1: Optional package icingaweb2
by maintenance＠opensuse.org 01 Aug '18

01 Aug '18

openSUSE Optional Update: Optional package icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2167-1 Rating: low References: #1101357 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: Provides package icingaweb2 v2.5.3 (boo#1101357) Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-790=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingaweb2-2.5.3-2.1 icingaweb2-common-2.5.3-2.1 icingaweb2-icingacli-2.5.3-2.1 icingaweb2-vendor-HTMLPurifier-4.6.0-2.1 icingaweb2-vendor-JShrink-1.0.1-2.1 icingaweb2-vendor-Parsedown-1.0.0-2.1 icingaweb2-vendor-dompdf-0.6.1-2.1 icingaweb2-vendor-lessphp-0.4.0-2.1 icingaweb2-vendor-zf1-1.12.20-2.1 php-Icinga-2.5.3-2.1 References: https://bugzilla.suse.com/1101357

1 0

openSUSE-SU-2018:2166-1: moderate: Security update for rsyslog
by opensuse-security＠opensuse.org 01 Aug '18

01 Aug '18

openSUSE Security Update: Security update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2166-1 Rating: moderate References: #935393 Cross-References: CVE-2015-3243 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsyslog fixes the following issues: The following security vulnerability was addressed: CVE-2015-3243: Make sure that log files are not created world-readable (bsc#935393) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-789=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): rsyslog-8.24.0-2.3.1 rsyslog-debuginfo-8.24.0-2.3.1 rsyslog-debugsource-8.24.0-2.3.1 rsyslog-diag-tools-8.24.0-2.3.1 rsyslog-diag-tools-debuginfo-8.24.0-2.3.1 rsyslog-doc-8.24.0-2.3.1 rsyslog-module-dbi-8.24.0-2.3.1 rsyslog-module-dbi-debuginfo-8.24.0-2.3.1 rsyslog-module-elasticsearch-8.24.0-2.3.1 rsyslog-module-elasticsearch-debuginfo-8.24.0-2.3.1 rsyslog-module-gcrypt-8.24.0-2.3.1 rsyslog-module-gcrypt-debuginfo-8.24.0-2.3.1 rsyslog-module-gssapi-8.24.0-2.3.1 rsyslog-module-gssapi-debuginfo-8.24.0-2.3.1 rsyslog-module-gtls-8.24.0-2.3.1 rsyslog-module-gtls-debuginfo-8.24.0-2.3.1 rsyslog-module-guardtime-8.24.0-2.3.1 rsyslog-module-guardtime-debuginfo-8.24.0-2.3.1 rsyslog-module-mmnormalize-8.24.0-2.3.1 rsyslog-module-mmnormalize-debuginfo-8.24.0-2.3.1 rsyslog-module-mysql-8.24.0-2.3.1 rsyslog-module-mysql-debuginfo-8.24.0-2.3.1 rsyslog-module-omamqp1-8.24.0-2.3.1 rsyslog-module-omamqp1-debuginfo-8.24.0-2.3.1 rsyslog-module-omhttpfs-8.24.0-2.3.1 rsyslog-module-omhttpfs-debuginfo-8.24.0-2.3.1 rsyslog-module-omtcl-8.24.0-2.3.1 rsyslog-module-omtcl-debuginfo-8.24.0-2.3.1 rsyslog-module-pgsql-8.24.0-2.3.1 rsyslog-module-pgsql-debuginfo-8.24.0-2.3.1 rsyslog-module-relp-8.24.0-2.3.1 rsyslog-module-relp-debuginfo-8.24.0-2.3.1 rsyslog-module-snmp-8.24.0-2.3.1 rsyslog-module-snmp-debuginfo-8.24.0-2.3.1 rsyslog-module-udpspoof-8.24.0-2.3.1 rsyslog-module-udpspoof-debuginfo-8.24.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-3243.html https://bugzilla.suse.com/935393

1 0

openSUSE-SU-2018:2159-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 01 Aug '18

01 Aug '18

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2159-1 Rating: moderate References: #1082318 #1092877 #1094150 #1094154 #1094161 Cross-References: CVE-2017-18269 CVE-2018-11236 CVE-2018-11237 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for glibc fixes the following security issues: - CVE-2017-18269: An SSE2-optimized memmove implementation for i386 did not correctly perform the overlapping memory check if the source memory range spaned the middle of the address space, resulting in corrupt data being produced by the copy operation. This may have disclosed information to context-dependent attackers, resulted in a denial of service or code execution (bsc#1094150). - CVE-2018-11236: Prevent integer overflow on 32-bit architectures when processing very long pathname arguments to the realpath function, leading to a stack-based buffer overflow (bsc#1094161). - CVE-2018-11237: An AVX-512-optimized implementation of the mempcpy function may have writen data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper (bsc#1092877, bsc#1094154). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-788=1 Package List: - openSUSE Leap 15.0 (i586 i686 x86_64): glibc-2.26-lp150.11.6.120 glibc-debuginfo-2.26-lp150.11.6.120 glibc-debugsource-2.26-lp150.11.6.120 glibc-devel-2.26-lp150.11.6.120 glibc-devel-debuginfo-2.26-lp150.11.6.120 glibc-devel-static-2.26-lp150.11.6.120 glibc-locale-2.26-lp150.11.6.120 glibc-locale-debuginfo-2.26-lp150.11.6.120 glibc-profile-2.26-lp150.11.6.120 - openSUSE Leap 15.0 (i586 x86_64): glibc-extra-2.26-lp150.11.6.120 glibc-extra-debuginfo-2.26-lp150.11.6.120 glibc-utils-2.26-lp150.11.6.120 glibc-utils-debuginfo-2.26-lp150.11.6.120 glibc-utils-src-debugsource-2.26-lp150.11.6.120 nscd-2.26-lp150.11.6.120 nscd-debuginfo-2.26-lp150.11.6.120 - openSUSE Leap 15.0 (x86_64): glibc-32bit-2.26-lp150.11.6.120 glibc-32bit-debuginfo-2.26-lp150.11.6.120 glibc-devel-32bit-2.26-lp150.11.6.120 glibc-devel-32bit-debuginfo-2.26-lp150.11.6.120 glibc-devel-static-32bit-2.26-lp150.11.6.120 glibc-locale-32bit-2.26-lp150.11.6.120 glibc-locale-32bit-debuginfo-2.26-lp150.11.6.120 glibc-profile-32bit-2.26-lp150.11.6.120 glibc-utils-32bit-2.26-lp150.11.6.120 glibc-utils-32bit-debuginfo-2.26-lp150.11.6.120 - openSUSE Leap 15.0 (noarch): glibc-html-2.26-lp150.11.6.120 glibc-i18ndata-2.26-lp150.11.6.120 glibc-info-2.26-lp150.11.6.120 References: https://www.suse.com/security/cve/CVE-2017-18269.html https://www.suse.com/security/cve/CVE-2018-11236.html https://www.suse.com/security/cve/CVE-2018-11237.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1092877 https://bugzilla.suse.com/1094150 https://bugzilla.suse.com/1094154 https://bugzilla.suse.com/1094161

1 0