August 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2313-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2313-1 Rating: moderate References: #1103799 Cross-References: CVE-2018-14912 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cgit to version 1.2.1 fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off (boo#1103799) The following other changes were made: - Update to upstream release 1.2.1: - syntax-highlighting: replace invalid unicode with '?' - ui-repolist: properly sort by age - ui-patch: fix crash when using path limit - Update bundled git to 2.11.1 - Update to upstream release 1.0: * Add repo.homepage/gitweb.homepage setting and homepage tab. * Show reverse paths in title bar so that browser tab shows filename. * Allow redirects even when caching is turned on. * More gracefully deal with unparsable commits. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-864=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cgit-1.2.1-13.3.1 cgit-debuginfo-1.2.1-13.3.1 cgit-debugsource-1.2.1-13.3.1 References: https://www.suse.com/security/cve/CVE-2018-14912.html https://bugzilla.suse.com/1103799

1 0

openSUSE-SU-2018:2310-1: moderate: Security update for sddm
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2310-1 Rating: moderate References: #1099908 #1101450 Cross-References: CVE-2018-14345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sddm fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14345: Fixed the authentication, which did not check the password for users with an already existing session and allowed any user with access to the system bus to unlock any graphical session. (boo#1101450) The following other bugs were addressed: - Fallback to embedded theme, if none is set - Corrected section name for Wayland - Removed patch, which is no longer needed, because bug in libxcb was fixed in the meanwhile (boo#1099908) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-862=1 Package List: - openSUSE Leap 15.0 (x86_64): sddm-0.17.0-lp150.9.3.1 sddm-branding-openSUSE-0.17.0-lp150.9.3.1 sddm-branding-upstream-0.17.0-lp150.9.3.1 sddm-debuginfo-0.17.0-lp150.9.3.1 sddm-debugsource-0.17.0-lp150.9.3.1 References: https://www.suse.com/security/cve/CVE-2018-14345.html https://bugzilla.suse.com/1099908 https://bugzilla.suse.com/1101450

1 0

openSUSE-SU-2018:2309-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2309-1 Rating: moderate References: #1101288 Cross-References: CVE-2018-13796 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2018-13796: Fix a content spoofing vulnerability with invalid list name messages inside the web UI (boo#1101288). Bug fixes: - update to 2.1.29: * Fixed the listinfo and admin overview pages that were broken - update to 2.1.28: * It is now possible to edit HTML and text templates via the web admin UI in a supported language other than the list's preferred_language. * The Japanese translation has been updated * The German translation has been updated * The Esperanto translation has been updated * The BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE feature added in 2.1.27 was not working. This is fixed. * Escaping of HTML entities for the web UI is now done more selectively. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-861=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-861=1 Package List: - openSUSE Leap 42.3 (x86_64): mailman-2.1.29-2.11.2 mailman-debuginfo-2.1.29-2.11.2 mailman-debugsource-2.1.29-2.11.2 - openSUSE Leap 15.0 (x86_64): mailman-2.1.29-lp150.2.8.1 mailman-debuginfo-2.1.29-lp150.2.8.1 mailman-debugsource-2.1.29-lp150.2.8.1 References: https://www.suse.com/security/cve/CVE-2018-13796.html https://bugzilla.suse.com/1101288

1 0

openSUSE-SU-2018:2308-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2308-1 Rating: moderate References: #1103799 Cross-References: CVE-2018-14912 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cgit fixes the following issues: The following security vulnerability was addressed: - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off (boo#1103799) The following other changes were made: - Update to upstream release 1.2.1 * syntax-highlighting: replace invalid unicode with '?' * ui-repolist: properly sort by age * ui-patch: fix crash when using path limit Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-863=1 Package List: - openSUSE Leap 15.0 (x86_64): cgit-1.2.1-lp150.2.3.1 cgit-debuginfo-1.2.1-lp150.2.3.1 cgit-debugsource-1.2.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14912.html https://bugzilla.suse.com/1103799

1 0

openSUSE-SU-2018:2307-1: moderate: Recommended update for NetworkManager-vpnc
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Recommended update for NetworkManager-vpnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2307-1 Rating: moderate References: #1101147 Cross-References: CVE-2018-10900 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for NetworkManager-vpnc fixes the following issues: Security issue fixed: - CVE-2018-10900: Check configurations that contain newline characters and invalidate them to avoid security attacks (bsc#1101147). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-859=1 Package List: - openSUSE Leap 42.3 (x86_64): NetworkManager-vpnc-1.0.8-7.3.1 NetworkManager-vpnc-debuginfo-1.0.8-7.3.1 NetworkManager-vpnc-debugsource-1.0.8-7.3.1 NetworkManager-vpnc-gnome-1.0.8-7.3.1 NetworkManager-vpnc-gnome-debuginfo-1.0.8-7.3.1 - openSUSE Leap 42.3 (noarch): NetworkManager-vpnc-lang-1.0.8-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-10900.html https://bugzilla.suse.com/1101147

1 0

openSUSE-SU-2018:2306-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 13 Aug '18

13 Aug '18

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2306-1 Rating: moderate References: #1074014 #1076861 #1079150 #1087416 #1092885 #1094325 #1094480 #1094725 #1095556 #959329 Cross-References: CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 9 fixes is now available. Description: This update for libvirt fixes the following issues: Security issue fixed: - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka "Memory Disambiguation" (bsc#1092885). Bug fixes: - bsc#1094325: Enable virsh blockresize for XEN guests (FATE#325467). - bsc#1095556: Fix qemu VM creating with --boot uefi due to missing AppArmor profile. - bsc#1094725: Fix `virsh blockresize` to work with Xen qdisks. - bsc#1094480: Fix `virsh list` to list domains with `xl list`. - bsc#1087416: Fix missing video device within guest with default installation by virt-mamanger. - bsc#1079150: Fix libvirt-guests start dependency. - bsc#1076861: Fix locking of lockspace resource '/devcfs/disks/uatidmsvn1-xvda'. - bsc#1074014: Fix KVM live migration when shutting down cluster node. - bsc#959329: Fix wrong state of VMs in virtual manager. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-860=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-18.1 libvirt-admin-3.3.0-18.1 libvirt-admin-debuginfo-3.3.0-18.1 libvirt-client-3.3.0-18.1 libvirt-client-debuginfo-3.3.0-18.1 libvirt-daemon-3.3.0-18.1 libvirt-daemon-config-network-3.3.0-18.1 libvirt-daemon-config-nwfilter-3.3.0-18.1 libvirt-daemon-debuginfo-3.3.0-18.1 libvirt-daemon-driver-interface-3.3.0-18.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-18.1 libvirt-daemon-driver-lxc-3.3.0-18.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-18.1 libvirt-daemon-driver-network-3.3.0-18.1 libvirt-daemon-driver-network-debuginfo-3.3.0-18.1 libvirt-daemon-driver-nodedev-3.3.0-18.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-18.1 libvirt-daemon-driver-nwfilter-3.3.0-18.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-18.1 libvirt-daemon-driver-qemu-3.3.0-18.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-18.1 libvirt-daemon-driver-secret-3.3.0-18.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-3.3.0-18.1 libvirt-daemon-driver-storage-core-3.3.0-18.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-disk-3.3.0-18.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-iscsi-3.3.0-18.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-logical-3.3.0-18.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-mpath-3.3.0-18.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-scsi-3.3.0-18.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-18.1 libvirt-daemon-driver-uml-3.3.0-18.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-18.1 libvirt-daemon-driver-vbox-3.3.0-18.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-18.1 libvirt-daemon-hooks-3.3.0-18.1 libvirt-daemon-lxc-3.3.0-18.1 libvirt-daemon-qemu-3.3.0-18.1 libvirt-daemon-uml-3.3.0-18.1 libvirt-daemon-vbox-3.3.0-18.1 libvirt-debugsource-3.3.0-18.1 libvirt-devel-3.3.0-18.1 libvirt-doc-3.3.0-18.1 libvirt-libs-3.3.0-18.1 libvirt-libs-debuginfo-3.3.0-18.1 libvirt-lock-sanlock-3.3.0-18.1 libvirt-lock-sanlock-debuginfo-3.3.0-18.1 libvirt-nss-3.3.0-18.1 libvirt-nss-debuginfo-3.3.0-18.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-18.1 libvirt-daemon-driver-libxl-3.3.0-18.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-18.1 libvirt-daemon-driver-storage-rbd-3.3.0-18.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-18.1 libvirt-daemon-xen-3.3.0-18.1 libvirt-devel-32bit-3.3.0-18.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1074014 https://bugzilla.suse.com/1076861 https://bugzilla.suse.com/1079150 https://bugzilla.suse.com/1087416 https://bugzilla.suse.com/1092885 https://bugzilla.suse.com/1094325 https://bugzilla.suse.com/1094480 https://bugzilla.suse.com/1094725 https://bugzilla.suse.com/1095556 https://bugzilla.suse.com/959329

1 0

openSUSE-RU-2018:2300-1: moderate: Security update for the Linux Kernel
by maintenance＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Recommended Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2300-1 Rating: moderate References: #1051510 #1051979 #1077761 #1086274 #1099858 #1100132 #1101331 #1101669 #1102633 #1102658 #1103917 #1103920 #1103948 #1103949 #1104111 #1104174 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: The openSUSE Leap 15.0 was updated to receive various security and bugfixes. The following non-security bugs were fixed: - acpi / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510). - af_key: Always verify length of provided sadb_key (bsc#1051510). - af_key: fix buffer overread in parse_exthdrs() (bsc#1051510). - af_key: fix buffer overread in verify_address_len() (bsc#1051510). - agp: uninorth: make two functions static (bsc#1051510). - arm: 8715/1: add a private asm/unaligned.h (bsc#1051510). - arm: 8720/1: ensure dump_instr() checks addr_limit (bsc#1051510). - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bsc#1051510). - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bsc#1051510). - arm: 8731/1: Fix csum_partial_copy_from_user() stack mismatch (bsc#1051510). - arm: 8743/1: bL_switcher: add MODULE_LICENSE tag (bsc#1051510). - arm: 8746/1: vfp: Go back to clearing vfp_current_hw_state[] (bsc#1051510). - arm: 8748/1: mm: Define vdso_start, vdso_end as array (bsc#1051510). - arm: 8753/1: decompressor: add a missing parameter to the addruart macro (bsc#1051510). - arm: 8758/1: decompressor: restore r1 and r2 just before jumping to the kernel (bsc#1051510). - arm: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size (bsc#1051510). - arm: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed (bsc#1051510). - arm: 8770/1: kprobes: Prohibit probing on optimized_callback (bsc#1051510). - arm: 8771/1: kprobes: Prohibit kprobes on do_undefinstr (bsc#1051510). - arm: 8772/1: kprobes: Prohibit kprobes on get_user functions (bsc#1051510). - arm: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function (bsc#1051510). - arm: amba: Fix race condition with driver_override (bsc#1051510). - arm: amba: Fix wrong indentation in driver_override_store() (bsc#1051510). - arm: amba: Make driver_override output consistent with other buses (bsc#1051510). - arm: at91: do not select CONFIG_ARM_CPU_SUSPEND for old platforms (bsc#1051510). - arm: avoid faulting on qemu (bsc#1051510). - arm: BUG if jumping to usermode address in kernel mode (bsc#1051510). - arm-ccn: perf: Prevent module unload while PMU is in use (bsc#1051510). - arm: davinci: Add dma_mask to dm365's eDMA device (bsc#1051510). - arm: davinci: board-da830-evm: fix GPIO lookup for MMC/SD (bsc#1051510). - arm: davinci: board-da850-evm: fix GPIO lookup for MMC/SD (bsc#1051510). - arm: davinci: board-da850-evm: fix WP pin polarity for MMC/SD (bsc#1051510). - arm: davinci: board-dm355-evm: fix broken networking (bsc#1051510). - arm: davinci: board-dm646x-evm: pass correct I2C adapter id for VPIF (bsc#1051510). - arm: davinci: board-dm646x-evm: set VPIF capture card name (bsc#1051510). - arm: davinci: board-omapl138-hawk: fix GPIO numbers for MMC/SD lookup (bsc#1051510). - arm: davinci: dm646x: fix timer interrupt generation (bsc#1051510). - arm: davinci: fix mmc entries in dm365's dma_slave_map (bsc#1051510). - arm: davinci: fix the GPIO lookup for omapl138-hawk (bsc#1051510). - arm: davinci: Use platform_device_register_full() to create pdev for dm365's eDMA (bsc#1051510). - arm: DRA722: remove redundant definition of 1.0 device (bsc#1051510). - arm: fix return value of parse_cpu_capacity (bsc#1051510). - arm: kexec: fix failure to boot crash kernel (bsc#1051510). - arm: kexec: fix kdump register saving on panic() (bsc#1051510). - arm: keystone: fix platform_domain_notifier array overrun (bsc#1051510). - arm: kvm: fix building with gcc-8 (bsc#1051510). - arm: multi_v7_defconfig: Replace DRM_RCAR_HDMI by generic bridge options (bsc#1051510). - arm: multi_v7_defconfig: Replace SND_SOC_RSRC_CARD by SND_SIMPLE_SCU_CARD (bsc#1051510). - arm: mvebu: Fix broken PL310_ERRATA_753970 selects (bsc#1051510). - arm: OMAP1: clock: Fix debugfs_create_*() usage (bsc#1051510). - arm: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context (bsc#1051510). - arm: omap2: hide omap3_save_secure_ram on non-OMAP3 builds (bsc#1051510). - arm: OMAP2+: omap_device: drop broken RPM status update from suspend_noirq (bsc#1051510). - arm: OMAP2+: powerdomain: use raw_smp_processor_id() for trace (bsc#1051510). - arm: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt (bsc#1051510). - arm: OMAP3: Fix prm wake interrupt for resume (bsc#1051510). - arm: OMAP3: hwmod_data: add missing module_offs for MMC3 (bsc#1051510). - arm: OMAP3+: PRM: fix of_irq_get() result check (bsc#1051510). - arm: OMAP4+: PRM: fix of_irq_get() result checks (bsc#1051510). - arm: OMAP: Fix dmtimer init for omap1 (bsc#1051510). - arm: OMAP: Fix SRAM W+X mapping (bsc#1051510). - arm: orion5x: Revert commit 4904dbda41c8 (bsc#1051510). - arm: orion: fix orion_ge00_switch_board_info initialization (bsc#1051510). - arm: pxa: select both FB and FB_W100 for eseries (bsc#1051510). - arm: pxa/tosa-bt: add MODULE_LICENSE tag (bsc#1051510). - arm: remove wrong CONFIG_PROC_SYSCTL ifdef (bsc#1051510). - arm: s3c24xx: Fix NAND ECC mode for mini2440 board (bsc#1051510). - arm: shmobile: defconfig: Enable missing PCIE_RCAR dependency (bsc#1051510). - arm: shmobile: defconfig: Replace DRM_RCAR_HDMI by generic bridge options (bsc#1051510). - arm: shmobile: defconfig: Replace SND_SOC_RSRC_CARD by SND_SIMPLE_SCU_CARD (bsc#1051510). - arm: shmobile: defconfig: Replace USB_XHCI_RCAR by USB_XHCI_PLATFORM (bsc#1051510). - arm: shmobile: rcar-gen2: Fix deadlock in regulator quirk (bsc#1051510). - arm: socfpga_defconfig: Remove QSPI Sector 4K size force (bsc#1051510). - arm: spear13xx: Fix dmas cells (bsc#1051510). - arm: sunxi_defconfig: Enable CMA (bsc#1051510). - arm: sunxi: fix the core number of V3s in sunxi README (bsc#1051510). - ata: do not schedule hot plug if it is a sas host (). - audit: fix potential null dereference 'context->module.name' (bsc#1051510). - cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag (bsc#1099858). - cachefiles: Fix refcounting bug in backing-file read monitoring (bsc#1099858). - cachefiles: Wait rather than BUG'ing on "Unexpected object collision" (bsc#1099858). - can: dev: increase bus-off message severity (bsc#1051510). - can: ems_usb: Fix memory leak on ems_usb_disconnect() (bsc#1051510). - can: m_can: change comparison to bitshift when dealing with a mask (bsc#1051510). - clk: at91: fix clk-generated compilation (bsc#1051510). - clk: renesas: cpg-mssr: Stop using printk format %pCr (bsc#1051510). - coccinelle: fix parallel build with CHECK=scripts/coccicheck (bsc#1051510). - crypto: authenc - do not leak pointers to authenc keys (bsc#1051510). - crypto: authencesn - do not leak pointers to authenc keys (bsc#1051510). - crypto: padlock-aes - Fix Nano workaround data corruption (bsc#1051510). - dm: prevent DAX mounts if not supported (bsc#1103917). - doc: Add vendor prefix for Kieback & Peter GmbH (bsc#1051510). - drm/atomic: Make atomic helper track newly assigned planes correctly, v2 (bsc#1051510). - drm/atomic: Make atomic iterators less surprising (bsc#1051510). - fs: allow per-device dax status checking for filesystems (bsc#1103917). - fscache: Allow cancelled operations to be enqueued (bsc#1099858). - fscache: Fix reference overput in fscache_attach_object() error handling (bsc#1099858). - hv_netvsc: Ensure correct teardown message sequence order (). - hv/netvsc: fix handling of fallback to single queue mode (). - hv_netvsc: Fix net device attach on older Windows hosts (). - hv_netvsc: set master device (bsc#1051979). - hv_netvsc: Split netvsc_revoke_buf() and netvsc_teardown_gpadl() (). - hv_netvsc: split sub-channel setup into async and sync (). - hv_netvsc: Use Windows version instead of NVSP version on GPAD teardown (). - ibmasm: do not write out of bounds in read handler (bsc#1051510). - ibmvnic: Remove code to request error information (bsc#1104174). - ibmvnic: Revise RX/TX queue error messages (bsc#1101331). - ibmvnic: Update firmware error reporting with cause string (bsc#1104174). - irqchip: brcmstb-l2: Define an irq_pm_shutdown function (bsc#1051510). - irqchip/gic: Take lock when updating irq type (bsc#1051510). - irqchip/gic-v3: Change pr_debug message to pr_devel (bsc#1051510). - irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry (bsc#1051510). - irqchip/gic-v3: Ignore disabled ITS nodes (bsc#1051510). - irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() (bsc#1051510). - irqchip/qcom: Fix check for spurious interrupts (bsc#1051510). - irqchip/qcom: Fix u32 comparison with value less than zero (bsc#1051510). - iwlwifi: add more card IDs for 9000 series (bsc#1051510). - kabi protect bdev_dax_supported (bsc#1103917). - kabi protect structy ata_host (git-fixes). - kabi/severities: do not complain on hisi_sas internal changes (). - kbuild: add '-fno-stack-check' to kernel build options (bsc#1051510). - kbuild: Handle builtin dtb file names containing hyphens (bsc#1051510). - kbuild: pkg: use --transform option to prefix paths in tar (bsc#1051510). - kconfig: display recursive dependency resolution hint just once (bsc#1051510). - kmemleak: add scheduling point to kmemleak_scan() (bsc#1051510). - kvm: SVM: Add pause filter threshold (). - kvm: SVM: Implement pause loop exit logic in SVM (). - kvm: VMX: Bring the common code to header file (). - kvm: VMX: Fix the module parameters for vmx (). - kvm: VMX: Remove ple_window_actual_max (). - libata: add refcounting to ata_host (git-fixes). - libata: ensure host is free'd on error exit paths (git-fixes). - libnvdimm, dimm: fix dpa reservation vs uninitialized label area (git-fixes). - linvdimm, pmem: Preserve read-only setting for pmem devices (git-fixes). - MAINTAINERS: review Renesas DT bindings as well (bsc#1051510). - mfd: cros_ec: Fail early if we cannot identify the EC (bsc#1051510). - mfd: fsl-imx25: Clean up irq settings during removal (bsc#1051510). - mfd: mxs-lradc: Fix error handling in mxs_lradc_probe() (bsc#1051510). - misc: pci_endpoint_test: Avoid triggering a BUG() (bsc#1051510). - mm/kmemleak.c: make cond_resched() rate-limiting more efficient (bsc#1051510). - nohz: Fix local_timer_softirq_pending() (bsc#1051510). - nvme: ensure forward progress during Admin passthru (git-fixes). - nvme-fabrics: Ignore nr_io_queues option for discovery controllers (bsc#1102633). - nvme: fixup crash on failed discovery (bsc#1103920). - nvme.h: fixup ANA group descriptor format (bsc#1104111). - nvme: use hw qid in trace events (bsc#1102633). - pinctrl: intel: Add Intel Lewisburg GPIO support (). - pinctrl: nand: meson-gxl: fix missing data pins (bsc#1051510). - pmem: only set QUEUE_FLAG_DAX for fsdax mode (bsc#1103917). - sc16is7xx: Check for an error when the clock is enabled (bsc#1051510). - sched/fair: Consider RT/IRQ pressure in capacity_spare_wake() (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Fix find_idlest_group() when local group is not allowed (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Fix usage of find_idlest_group() when no groups are allowed (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Fix usage of find_idlest_group() when the local group is idlest (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Move select_task_rq_fair() slow-path into its own function (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Remove impossible condition from find_idlest_group_cpu() (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Remove unnecessary comparison with -1 (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Spare idle load balancing on nohz_full CPUs (bnc#1101669 optimise numa balancing for fast migrate). - sched/fair: Use 'unsigned long' for utilization, consistently (bnc#1101669 optimise numa balancing for fast migrate). - scsi: ata: enhance the definition of SET MAX feature field value (). - scsi: hisi_sas: add an mechanism to do reset work synchronously (). - scsi: hisi_sas: add check of device in hisi_sas_task_exec() (). - scsi: hisi_sas: add internal abort dev in some places (). - scsi: hisi_sas: Add LED feature for v3 hw (). - scsi: hisi_sas: add RAS feature for v3 hw (). - scsi: hisi_sas: add readl poll timeout helper wrappers (). - scsi: hisi_sas: Add some checks to avoid free'ing a sas_task twice (). - scsi: hisi_sas: add some print to enhance debugging (). - scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command (). - scsi: hisi_sas: add v2 hw port AXI error handling support (). - scsi: hisi_sas: add v3 hw MODULE_DEVICE_TABLE() (). - scsi: hisi_sas: add v3 hw suspend and resume (). - scsi: hisi_sas: allocate slot buffer earlier (). - scsi: hisi_sas: Change common allocation mode of device id (). - scsi: hisi_sas: Change frame type for SET MAX commands (). - scsi: hisi_sas: change ncq process for v3 hw (). - scsi: hisi_sas: change slot index allocation mode (). - scsi: hisi_sas: check host frozen before calling "done" function (). - scsi: hisi_sas: check IPTT is valid before using it for v3 hw (). - scsi: hisi_sas: check sas_dev gone earlier in hisi_sas_abort_task() (). - scsi: hisi_sas: Code cleanup and minor bug fixes (). - scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw (). - scsi: hisi_sas: consolidate command check in hisi_sas_get_ata_protocol() (). - scsi: hisi_sas: Create a scsi_host_template per HW module (). - scsi: hisi_sas: delete timer when removing hisi_sas driver (). - scsi: hisi_sas: do link reset for some CHL_INT2 ints (). - scsi: hisi_sas: Do not lock DQ for complete task sending (). - scsi: hisi_sas: dt-bindings: add an property of signal attenuation (). - scsi: hisi_sas: fix a bug in hisi_sas_dev_gone() (). - scsi: hisi_sas: fix a typo in hisi_sas_task_prep() (). - scsi: hisi_sas: fix dma_unmap_sg() parameter (). - scsi: hisi_sas: fix PI memory size (). - scsi: hisi_sas: fix return value of hisi_sas_task_prep() (). - scsi: hisi_sas: Fix return value when get_free_slot() failed (). - scsi: hisi_sas: fix SAS_QUEUE_FULL problem while running IO (). - scsi: hisi_sas: fix the issue of link rate inconsistency (). - scsi: hisi_sas: fix the issue of setting linkrate register (). - scsi: hisi_sas: improve int_chnl_int_v2_hw() consistency with v3 hw (). - scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot (). - scsi: hisi_sas: increase timer expire of internal abort task (). - scsi: hisi_sas: Init disks after controller reset (). - scsi: hisi_sas: initialize dq spinlock before use (). - scsi: hisi_sas: Introduce hisi_sas_phy_set_linkrate() (). - scsi: hisi_sas: judge result of internal abort (). - scsi: hisi_sas: make local symbol host_attrs static (). - scsi: hisi_sas: make return type of prep functions void (). - scsi: hisi_sas: make SAS address of SATA disks unique (). - scsi: hisi_sas: Mark PHY as in reset for nexus reset (). - scsi: hisi_sas: modify hisi_sas_dev_gone() for reset (). - scsi: hisi_sas: modify some register config for hip08 (). - scsi: hisi_sas: optimise port id refresh function (). - scsi: hisi_sas: optimise the usage of DQ locking (). - scsi: hisi_sas: print device id for errors (). - scsi: hisi_sas: re-add the lldd_port_deformed() (). - scsi: hisi_sas: relocate clearing ITCT and freeing device (). - scsi: hisi_sas: relocate smp sg map (). - scsi: hisi_sas: Remove depends on HAS_DMA in case of platform dependency (). - scsi: hisi_sas: remove redundant handling to event95 for v3 (). - scsi: hisi_sas: remove some unneeded structure members (). - scsi: hisi_sas: remove unused variable hisi_sas_devices.running_req (). - scsi: hisi_sas: Reset disks when discovered (). - scsi: hisi_sas: some optimizations of host controller reset (). - scsi: hisi_sas: stop controller timer for reset (). - scsi: hisi_sas: support the property of signal attenuation for v2 hw (). - scsi: hisi_sas: Terminate STP reject quickly for v2 hw (). - scsi: hisi_sas: Try wait commands before before controller reset (). - scsi: hisi_sas: update PHY linkrate after a controller reset (). - scsi: hisi_sas: update RAS feature for later revision of v3 HW (). - scsi: hisi_sas: use an general way to delay PHY work (). - scsi: hisi_sas: Use device lock to protect slot alloc/free (). - scsi: hisi_sas: use dma_zalloc_coherent() (). - scsi: hisi_sas: workaround a v3 hw hilink bug (). - scsi: libsas: defer ata device eh commands to libata (). - scsi: lpfc: Add Buffer overflow check, when nvme_info larger than PAGE_SIZE (bsc#1102658). - scsi: lpfc: Correct LCB ACCept payload (bsc#1102658). - scsi: lpfc: devloss timeout race condition caused null pointer reference (bsc#1102658). - scsi: lpfc: Fix abort error path for NVMET (bsc#1102658). - scsi: lpfc: Fix driver crash when re-registering NVME rports (bsc#1102658). - scsi: lpfc: Fix driver not setting dpp bits correctly in doorbell word (bsc#1102658). - scsi: lpfc: Fix ELS abort on SLI-3 adapters (bsc#1102658). - scsi: lpfc: Fix list corruption on the completion queue (bsc#1102658). - scsi: lpfc: Fix NVME Target crash in defer rcv logic (bsc#1102658). - scsi: lpfc: Fix panic if driver unloaded when port is offline (bsc#1102658). - scsi: lpfc: Fix sysfs Speed value on CNA ports (bsc#1102658). - scsi: lpfc: Limit tracking of tgt queue depth in fast path (bsc#1102658). - scsi: lpfc: Make PBDE optimizations configurable (bsc#1102658). - scsi: lpfc: Remove lpfc_enable_pbde as module parameter (bsc#1102658). - scsi: lpfc: Revise copyright for new company language (bsc#1102658). - scsi: lpfc: Support duration field in Link Cable Beacon V1 command (bsc#1102658). - scsi: lpfc: update driver version to 12.0.0.5 (bsc#1102658). - scsi: lpfc: update driver version to 12.0.0.6 (bsc#1102658). - scsi: qla2xxx: Avoid double completion of abort command (git-fixes). - scsi: qla2xxx: Fix driver unload by shutting down chip (git-fixes). - scsi: qla2xxx: Fix NPIV deletion by calling wait_for_sess_deletion (git-fixes). - scsi: qla2xxx: Fix NULL pointer dereference for fcport search (git-fixes). - scsi: qla2xxx: Fix unintialized List head crash (git-fixes). - scsi: qla2xxx: Return error when TMF returns (git-fixes). - scsi: smartpqi: add in new supported controllers (bsc#1086274). - scsi: smartpqi: add inspur advantech ids (bsc#1086274). - scsi: smartpqi: bump driver version to 1.1.4-130 (bsc#1086274). - scsi: smartpqi: fix critical ARM issue reading PQI index registers (bsc#1086274). - scsi: smartpqi: improve error checking for sync requests (bsc#1086274). - scsi: smartpqi: improve handling for sync requests (bsc#1086274). - scsi: smartpqi: update driver version (bsc#1086274). - scsi: smartpqi: workaround fw bug for oq deletion (bsc#1086274). - sctp: fix the issue that pathmtu may be set lower than MINSEGMENT (git-fixes). - sctp: introduce sctp_dst_mtu (git-fixes). - sr: pass down correctly sized SCSI sense buffer (git-fixes). - staging: ks7010: Use constants from ieee80211_eid instead of literal ints (bsc#1051510). - staging: speakup: fix wraparound in uaccess length check (bsc#1051510). - sysrq : fix Show Regs call trace on ARM (bsc#1051510). - typec: tcpm: Fix a msecs vs jiffies bug (bsc#1100132). - Update patches.arch/KVM-PPC-Check-if-IOMMU-page-is-contained-in-the-pinn.patch (bsc#1077761, git-fixes, bsc#1103948, bsc#1103949). - x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 (binutils_2.31). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-858=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-devel-4.12.14-lp150.12.13.1 kernel-docs-4.12.14-lp150.12.13.1 kernel-docs-html-4.12.14-lp150.12.13.1 kernel-macros-4.12.14-lp150.12.13.1 kernel-source-4.12.14-lp150.12.13.1 kernel-source-vanilla-4.12.14-lp150.12.13.1 - openSUSE Leap 15.0 (x86_64): kernel-debug-4.12.14-lp150.12.13.1 kernel-debug-base-4.12.14-lp150.12.13.1 kernel-debug-base-debuginfo-4.12.14-lp150.12.13.1 kernel-debug-debuginfo-4.12.14-lp150.12.13.1 kernel-debug-debugsource-4.12.14-lp150.12.13.1 kernel-debug-devel-4.12.14-lp150.12.13.1 kernel-debug-devel-debuginfo-4.12.14-lp150.12.13.1 kernel-default-4.12.14-lp150.12.13.1 kernel-default-base-4.12.14-lp150.12.13.1 kernel-default-base-debuginfo-4.12.14-lp150.12.13.1 kernel-default-debuginfo-4.12.14-lp150.12.13.1 kernel-default-debugsource-4.12.14-lp150.12.13.1 kernel-default-devel-4.12.14-lp150.12.13.1 kernel-default-devel-debuginfo-4.12.14-lp150.12.13.1 kernel-kvmsmall-4.12.14-lp150.12.13.1 kernel-kvmsmall-base-4.12.14-lp150.12.13.1 kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.13.1 kernel-kvmsmall-debuginfo-4.12.14-lp150.12.13.1 kernel-kvmsmall-debugsource-4.12.14-lp150.12.13.1 kernel-kvmsmall-devel-4.12.14-lp150.12.13.1 kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.13.1 kernel-obs-build-4.12.14-lp150.12.13.1 kernel-obs-build-debugsource-4.12.14-lp150.12.13.1 kernel-obs-qa-4.12.14-lp150.12.13.1 kernel-syms-4.12.14-lp150.12.13.1 kernel-vanilla-4.12.14-lp150.12.13.1 kernel-vanilla-base-4.12.14-lp150.12.13.1 kernel-vanilla-base-debuginfo-4.12.14-lp150.12.13.1 kernel-vanilla-debuginfo-4.12.14-lp150.12.13.1 kernel-vanilla-debugsource-4.12.14-lp150.12.13.1 kernel-vanilla-devel-4.12.14-lp150.12.13.1 kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.13.1 References: https://bugzilla.suse.com/1051510 https://bugzilla.suse.com/1051979 https://bugzilla.suse.com/1077761 https://bugzilla.suse.com/1086274 https://bugzilla.suse.com/1099858 https://bugzilla.suse.com/1100132 https://bugzilla.suse.com/1101331 https://bugzilla.suse.com/1101669 https://bugzilla.suse.com/1102633 https://bugzilla.suse.com/1102658 https://bugzilla.suse.com/1103917 https://bugzilla.suse.com/1103920 https://bugzilla.suse.com/1103948 https://bugzilla.suse.com/1103949 https://bugzilla.suse.com/1104111 https://bugzilla.suse.com/1104174

1 0

openSUSE-SU-2018:2296-1: moderate: Security update for libsoup
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libsoup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2296-1 Rating: moderate References: #1052916 #1086036 #1100097 Cross-References: CVE-2017-2885 CVE-2018-12910 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libsoup fixes the following issues: Security issue fixed: - CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097). - CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916). Bug fixes: - bsc#1086036: translation-update-upstream commented out for Leap This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-856=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsoup-2_4-1-2.62.2-8.1 libsoup-2_4-1-debuginfo-2.62.2-8.1 libsoup-debugsource-2.62.2-8.1 libsoup-devel-2.62.2-8.1 typelib-1_0-Soup-2_4-2.62.2-8.1 - openSUSE Leap 42.3 (noarch): libsoup-lang-2.62.2-8.1 - openSUSE Leap 42.3 (x86_64): libsoup-2_4-1-32bit-2.62.2-8.1 libsoup-2_4-1-debuginfo-32bit-2.62.2-8.1 libsoup-devel-32bit-2.62.2-8.1 References: https://www.suse.com/security/cve/CVE-2017-2885.html https://www.suse.com/security/cve/CVE-2018-12910.html https://bugzilla.suse.com/1052916 https://bugzilla.suse.com/1086036 https://bugzilla.suse.com/1100097

1 0

openSUSE-SU-2018:2295-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2295-1 Rating: important References: #1101667 Cross-References: CVE-2018-3005 CVE-2018-3055 CVE-2018-3085 CVE-2018-3086 CVE-2018-3087 CVE-2018-3088 CVE-2018-3089 CVE-2018-3090 CVE-2018-3091 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for virtualbox to version 5.2.16 fixes the following issues: The following security vulnerabilities were fixed (boo#1101667): - CVE-2018-3005: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. - CVE-2018-3055: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2018-3085: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2018-3086: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3087: Fixed an easily exploitable vulnerability that allowed unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3088: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3089: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3090: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2018-3091: Fixed an easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The following bugs were fixed: - OVF: case insensitive comparison of manifest attribute values, to improve compatibility Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-853=1 Package List: - openSUSE Leap 15.0 (x86_64): python3-virtualbox-5.2.16-lp150.4.9.1 python3-virtualbox-debuginfo-5.2.16-lp150.4.9.1 virtualbox-5.2.16-lp150.4.9.1 virtualbox-debuginfo-5.2.16-lp150.4.9.1 virtualbox-debugsource-5.2.16-lp150.4.9.1 virtualbox-devel-5.2.16-lp150.4.9.1 virtualbox-guest-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-guest-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-guest-tools-5.2.16-lp150.4.9.1 virtualbox-guest-tools-debuginfo-5.2.16-lp150.4.9.1 virtualbox-guest-x11-5.2.16-lp150.4.9.1 virtualbox-guest-x11-debuginfo-5.2.16-lp150.4.9.1 virtualbox-host-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-host-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1 virtualbox-qt-5.2.16-lp150.4.9.1 virtualbox-qt-debuginfo-5.2.16-lp150.4.9.1 virtualbox-vnc-5.2.16-lp150.4.9.1 virtualbox-websrv-5.2.16-lp150.4.9.1 virtualbox-websrv-debuginfo-5.2.16-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-5.2.16-lp150.4.9.1 virtualbox-guest-source-5.2.16-lp150.4.9.1 virtualbox-host-source-5.2.16-lp150.4.9.1 References: https://www.suse.com/security/cve/CVE-2018-3005.html https://www.suse.com/security/cve/CVE-2018-3055.html https://www.suse.com/security/cve/CVE-2018-3085.html https://www.suse.com/security/cve/CVE-2018-3086.html https://www.suse.com/security/cve/CVE-2018-3087.html https://www.suse.com/security/cve/CVE-2018-3088.html https://www.suse.com/security/cve/CVE-2018-3089.html https://www.suse.com/security/cve/CVE-2018-3090.html https://www.suse.com/security/cve/CVE-2018-3091.html https://bugzilla.suse.com/1101667

1 0

openSUSE-SU-2018:2294-1: Security update for libcdio
by opensuse-security＠opensuse.org 10 Aug '18

10 Aug '18

openSUSE Security Update: Security update for libcdio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2294-1 Rating: low References: #1082821 #1082877 Cross-References: CVE-2017-18199 CVE-2017-18201 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libcdio fixes the following issues: The following security vulnerabilities were addressed: - CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c (bsc#1082821) - CVE-2017-18201: Fixed a double free vulnerability in get_cdtext_generic() in _cdio_generic.c (bsc#1082877) - Fixed several memory leaks (bsc#1082821) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-857=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libcdio++0-0.94-lp150.5.3.1 libcdio++0-debuginfo-0.94-lp150.5.3.1 libcdio-debugsource-0.94-lp150.5.3.1 libcdio-devel-0.94-lp150.5.3.1 libcdio16-0.94-lp150.5.3.1 libcdio16-debuginfo-0.94-lp150.5.3.1 libiso9660-10-0.94-lp150.5.3.1 libiso9660-10-debuginfo-0.94-lp150.5.3.1 libudf0-0.94-lp150.5.3.1 libudf0-debuginfo-0.94-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): cdio-utils-0.94-lp150.5.3.1 cdio-utils-debuginfo-0.94-lp150.5.3.1 cdio-utils-debugsource-0.94-lp150.5.3.1 libcdio++0-32bit-0.94-lp150.5.3.1 libcdio++0-32bit-debuginfo-0.94-lp150.5.3.1 libcdio16-32bit-0.94-lp150.5.3.1 libcdio16-32bit-debuginfo-0.94-lp150.5.3.1 libiso9660-10-32bit-0.94-lp150.5.3.1 libiso9660-10-32bit-debuginfo-0.94-lp150.5.3.1 libudf0-32bit-0.94-lp150.5.3.1 libudf0-32bit-debuginfo-0.94-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-18199.html https://www.suse.com/security/cve/CVE-2017-18201.html https://bugzilla.suse.com/1082821 https://bugzilla.suse.com/1082877

1 0