August 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2502-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2502-1 Rating: important References: #1095219 #1100612 #1100613 #1104641 Cross-References: CVE-2018-10887 CVE-2018-10888 CVE-2018-11235 CVE-2018-15501 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libgit2 to version 0.26.5 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10887: Fixed an integer overflow which in turn leads to an out of bound read, allowing to read the base object, which could be exploited by an attacker to cause denial of service (DoS) (bsc#1100613). - CVE-2018-10888: Fixed an out-of-bound read while reading a binary delta file, which could be exploited by an attacker t ocause a denial of service (DoS) (bsc#1100612). - CVE-2018-11235: Fixed a remote code execution, which could occur with a crafted .gitmodules file (bsc#1095219) - CVE-2018-15501: Prevent out-of-bounds reads when processing smart-protocol "ng" packets (bsc#1104641) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-922=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgit2-26-0.26.6-lp150.2.3.1 libgit2-26-debuginfo-0.26.6-lp150.2.3.1 libgit2-debugsource-0.26.6-lp150.2.3.1 libgit2-devel-0.26.6-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libgit2-26-32bit-0.26.6-lp150.2.3.1 libgit2-26-32bit-debuginfo-0.26.6-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10887.html https://www.suse.com/security/cve/CVE-2018-10888.html https://www.suse.com/security/cve/CVE-2018-11235.html https://www.suse.com/security/cve/CVE-2018-15501.html https://bugzilla.suse.com/1095219 https://bugzilla.suse.com/1100612 https://bugzilla.suse.com/1100613 https://bugzilla.suse.com/1104641

1 0

openSUSE-RU-2018:2490-1: moderate: Recommended update for python-websocket-client
by maintenance＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Recommended Update: Recommended update for python-websocket-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2490-1 Rating: moderate References: #1076519 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-websocket-client fixes the following issues: - The library did not contain a CA bundle and the system CAs had to be manually specified. Make it use the systems ca bundle file by default (boo#1076519) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-916=1 Package List: - openSUSE Leap 15.0 (noarch): python2-websocket-client-0.44.0-lp150.2.3.1 python3-websocket-client-0.44.0-lp150.2.3.1 References: https://bugzilla.suse.com/1076519

1 0

openSUSE-RU-2018:2489-1: moderate: Recommended update for postfix
by maintenance＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Recommended Update: Recommended update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2489-1 Rating: moderate References: #1087471 #1094965 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for postfix fixes the following issues: - Postfix version update to 3.3.1 (bsc#1094965) * Postfix did not support running as a PID=1 process, which complicated Postfix deployment in containers. The "postfix start-fg" command will now run the Postfix master daemon as a PID=1 process if possible * Segfault in the postconf(1) command after it could not open a Postfix database configuration file due to a file permission error (dereferencing a null pointer) * The luser_relay feature became a black hole, when the luser_relay parameter was set to a non-existent local address (i.e. mail disappeared silently) * Missing error propagation in the tlsproxy(8) daemon could result in a segfault after TLS handshake error (dereferencing a 0xffff...ffff pointer). This daemon handles the TLS protocol when a non-whitelisted client sends a STARTTLS command to postscreen(8). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-917=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): postfix-3.3.1-lp150.4.3.1 postfix-debuginfo-3.3.1-lp150.4.3.1 postfix-debugsource-3.3.1-lp150.4.3.1 postfix-devel-3.3.1-lp150.4.3.1 postfix-lmdb-3.3.1-lp150.4.3.1 postfix-lmdb-debuginfo-3.3.1-lp150.4.3.1 postfix-mysql-3.3.1-lp150.4.3.1 postfix-mysql-debuginfo-3.3.1-lp150.4.3.1 postfix-postgresql-3.3.1-lp150.4.3.1 postfix-postgresql-debuginfo-3.3.1-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): postfix-doc-3.3.1-lp150.4.3.1 References: https://bugzilla.suse.com/1087471 https://bugzilla.suse.com/1094965

1 0

openSUSE-SU-2018:2488-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2488-1 Rating: moderate References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB - Fixed a regression where django.template.Template crashed if the template_string argument is lazy - Fixed __regex and __iregex lookups with MySQL - Fixed admin check crash when using a query expression in ModelAdmin.ordering - Fixed admin changelist crash when using a query expression without asc() or desc() in the page’s ordering - Fixed a regression that broke custom template filters that use decorators - Fixed detection of custom URL converters in included pattern - Fixed a regression that added an unnecessary subquery to the GROUP BY clause on MySQL when using a RawSQL annotation - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable - Corrected the import paths that inspectdb generates for django.contrib.postgres fields - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-914=1 Package List: - openSUSE Leap 15.0 (noarch): python3-Django-2.0.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680

1 0

openSUSE-SU-2018:2487-1: Security update for libXcursor
by opensuse-security＠opensuse.org 24 Aug '18

24 Aug '18

openSUSE Security Update: Security update for libXcursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2487-1 Rating: low References: #1103511 Cross-References: CVE-2015-9262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libXcursor fixes the following issues: - CVE-2015-9262: _XcursorThemeInherits allowed remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow (bsc#1103511) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-915=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libXcursor-debugsource-1.1.14-10.6.1 libXcursor-devel-1.1.14-10.6.1 libXcursor1-1.1.14-10.6.1 libXcursor1-debuginfo-1.1.14-10.6.1 - openSUSE Leap 42.3 (x86_64): libXcursor-devel-32bit-1.1.14-10.6.1 libXcursor1-32bit-1.1.14-10.6.1 libXcursor1-debuginfo-32bit-1.1.14-10.6.1 References: https://www.suse.com/security/cve/CVE-2015-9262.html https://bugzilla.suse.com/1103511

1 0

openSUSE-SU-2018:2479-1: important: Security update for ceph
by opensuse-security＠opensuse.org 22 Aug '18

22 Aug '18

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2479-1 Rating: important References: #1051598 #1054061 #1056125 #1056967 #1059458 #1060904 #1061461 #1063014 #1066182 #1066502 #1067088 #1067119 #1067705 #1070357 #1071386 #1074301 #1079076 #1080788 #1081379 #1081600 #1086340 #1087269 #1087493 Cross-References: CVE-2017-16818 CVE-2018-7262 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 21 fixes is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379). - CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014). Bug fixes: - bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster. - bsc#1079076: RGW openssl fixes. - bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start. - bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool. - bsc#1087269: allow_ec_overwrites option not in command options list. - bsc#1051598: Fix mountpoint check for systemctl enable --runtime. - bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR. - bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster. - bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs. - bsc#1060904: Loglevel misleading during keystone authentication. - bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs. - bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2. - bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw. - bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy. - bsc#1066182: Container synchronization between two Ceph clusters failed. - bsc#1081600: Crash in civetweb/RGW. - bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client. - bsc#1074301: OSDs keep aborting: SnapMapper failed asserts. - bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled. - bsc#1080788: fsid mismatch when creating additional OSDs. - bsc#1071386: Metadata spill onto block.slow. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-541=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-debugsource-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-9.1 References: https://www.suse.com/security/cve/CVE-2017-16818.html https://www.suse.com/security/cve/CVE-2018-7262.html https://bugzilla.suse.com/1051598 https://bugzilla.suse.com/1054061 https://bugzilla.suse.com/1056125 https://bugzilla.suse.com/1056967 https://bugzilla.suse.com/1059458 https://bugzilla.suse.com/1060904 https://bugzilla.suse.com/1061461 https://bugzilla.suse.com/1063014 https://bugzilla.suse.com/1066182 https://bugzilla.suse.com/1066502 https://bugzilla.suse.com/1067088 https://bugzilla.suse.com/1067119 https://bugzilla.suse.com/1067705 https://bugzilla.suse.com/1070357 https://bugzilla.suse.com/1071386 https://bugzilla.suse.com/1074301 https://bugzilla.suse.com/1079076 https://bugzilla.suse.com/1080788 https://bugzilla.suse.com/1081379 https://bugzilla.suse.com/1081600 https://bugzilla.suse.com/1086340 https://bugzilla.suse.com/1087269 https://bugzilla.suse.com/1087493

1 0

openSUSE-SU-2018:2439-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2439-1 Rating: low References: #1102007 Cross-References: CVE-2018-14435 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: The following security issue was fixed: - CVE-2018-14435: Fixed a memory leak in DecodeImage in coders/pcd.c (boo#1102007) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-906=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-96.2 GraphicsMagick-debuginfo-1.3.25-96.2 GraphicsMagick-debugsource-1.3.25-96.2 GraphicsMagick-devel-1.3.25-96.2 libGraphicsMagick++-Q16-12-1.3.25-96.2 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-96.2 libGraphicsMagick++-devel-1.3.25-96.2 libGraphicsMagick-Q16-3-1.3.25-96.2 libGraphicsMagick-Q16-3-debuginfo-1.3.25-96.2 libGraphicsMagick3-config-1.3.25-96.2 libGraphicsMagickWand-Q16-2-1.3.25-96.2 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-96.2 perl-GraphicsMagick-1.3.25-96.2 perl-GraphicsMagick-debuginfo-1.3.25-96.2 References: https://www.suse.com/security/cve/CVE-2018-14435.html https://bugzilla.suse.com/1102007

1 0

openSUSE-SU-2018:2438-1: moderate: Security update for perl-Archive-Zip
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for perl-Archive-Zip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2438-1 Rating: moderate References: #1099497 Cross-References: CVE-2018-10860 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-Archive-Zip fixes the following security issue: - CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-904=1 Package List: - openSUSE Leap 15.0 (noarch): perl-Archive-Zip-1.60-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10860.html https://bugzilla.suse.com/1099497

1 0

openSUSE-RU-2018:2437-1: moderate: Recommended update for libyui-ncurses-pkg
by maintenance＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Recommended Update: Recommended update for libyui-ncurses-pkg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2437-1 Rating: moderate References: #991090 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libyui-ncurses-pkg fixes the following issues: - Fix "out of disk space" error at start when such a large disk is present in the system. (bsc#991090) - Fix displaying negative disk sizes in the disk usage dialog. (bsc#991090) - Added new "Services" filter, displayed only when at least one repository service is present (FATE#321043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-903=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libyui-ncurses-pkg-debugsource-2.48.5.2-lp150.2.3.1 libyui-ncurses-pkg-devel-2.48.5.2-lp150.2.3.1 libyui-ncurses-pkg8-2.48.5.2-lp150.2.3.1 libyui-ncurses-pkg8-debuginfo-2.48.5.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libyui-ncurses-pkg-doc-2.48.5.2-lp150.2.3.1 References: https://bugzilla.suse.com/991090

1 0

openSUSE-SU-2018:2436-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2436-1 Rating: important References: #1027519 #1091107 #1103276 Cross-References: CVE-2018-3646 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-911=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xen-debugsource-4.10.1_08-lp150.2.9.1 xen-devel-4.10.1_08-lp150.2.9.1 xen-libs-4.10.1_08-lp150.2.9.1 xen-libs-debuginfo-4.10.1_08-lp150.2.9.1 xen-tools-domU-4.10.1_08-lp150.2.9.1 xen-tools-domU-debuginfo-4.10.1_08-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): xen-4.10.1_08-lp150.2.9.1 xen-doc-html-4.10.1_08-lp150.2.9.1 xen-libs-32bit-4.10.1_08-lp150.2.9.1 xen-libs-32bit-debuginfo-4.10.1_08-lp150.2.9.1 xen-tools-4.10.1_08-lp150.2.9.1 xen-tools-debuginfo-4.10.1_08-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1103276

1 0