September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2661-1: moderate: Recommended update for lastpass-cli
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for lastpass-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2661-1 Rating: moderate References: #1107384 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lastpass-cli fixes the following issues: - lastpass-cli was unable to verify the peer certificate due to a server-side change (boo#1107384) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-987=1 Package List: - openSUSE Leap 15.0 (x86_64): lastpass-cli-1.3.1-lp150.2.3.1 lastpass-cli-debuginfo-1.3.1-lp150.2.3.1 lastpass-cli-debugsource-1.3.1-lp150.2.3.1 References: https://bugzilla.suse.com/1107384

1 0

openSUSE-RU-2018:2660-1: moderate: Recommended update for perl-Bootloader
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for perl-Bootloader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2660-1 Rating: moderate References: #1033776 #1050349 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for perl-Bootloader fixes the following issues: - Add --get-option to pbl. (bsc#1033776, bsc#1050349) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-982=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): perl-Bootloader-0.921-lp150.3.3.1 perl-Bootloader-YAML-0.921-lp150.3.3.1 References: https://bugzilla.suse.com/1033776 https://bugzilla.suse.com/1050349

1 0

openSUSE-SU-2018:2659-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2659-1 Rating: important References: #1106341 #1107235 Cross-References: CVE-2017-15430 CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 CVE-2018-16079 CVE-2018-16080 CVE-2018-16081 CVE-2018-16082 CVE-2018-16083 CVE-2018-16084 CVE-2018-16085 CVE-2018-16086 CVE-2018-16087 CVE-2018-16088 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for Chromium to version 69.0.3497.81 fixes multiple issues. Security issues fixed (boo#1107235): - CVE-2018-16065: Out of bounds write in V8 - CVE-2018-16066:Out of bounds read in Blink - CVE-2018-16067: Out of bounds read in WebAudio - CVE-2018-16068: Out of bounds write in Mojo - CVE-2018-16069:Out of bounds read in SwiftShader - CVE-2018-16070: Integer overflow in Skia - CVE-2018-16071: Use after free in WebRTC - CVE-2018-16073: Site Isolation bypass after tab restore - CVE-2018-16074: Site Isolation bypass using Blob URLS - Out of bounds read in Little-CMS - CVE-2018-16075: Local file access in Blink - CVE-2018-16076: Out of bounds read in PDFium - CVE-2018-16077: Content security policy bypass in Blink - CVE-2018-16078: Credit card information leak in Autofill - CVE-2018-16079: URL spoof in permission dialogs - CVE-2018-16080: URL spoof in full screen mode - CVE-2018-16081: Local file access in DevTools - CVE-2018-16082: Stack buffer overflow in SwiftShader - CVE-2018-16083: Out of bounds read in WebRTC - CVE-2018-16084: User confirmation bypass in external protocol handling - CVE-2018-16085: Use after free in Memory Instrumentation - CVE-2017-15430: Unsafe navigation in Chromecast (boo#1106341) - CVE-2018-16086: Script injection in New Tab Page - CVE-2018-16087: Multiple download restriction bypass - CVE-2018-16088: User gesture requirement bypass The re2 regular expression library was updated to the current version 2018-09-01. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-979=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): libre2-0-20180901-11.1 libre2-0-debuginfo-20180901-11.1 re2-debugsource-20180901-11.1 re2-devel-20180901-11.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le): libre2-0-20180901-11.2 libre2-0-debuginfo-20180901-11.2 re2-debugsource-20180901-11.2 re2-devel-20180901-11.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-69.0.3497.81-65.1 chromedriver-debuginfo-69.0.3497.81-65.1 chromium-69.0.3497.81-65.1 chromium-debuginfo-69.0.3497.81-65.1 chromium-debugsource-69.0.3497.81-65.1 References: https://www.suse.com/security/cve/CVE-2017-15430.html https://www.suse.com/security/cve/CVE-2018-16065.html https://www.suse.com/security/cve/CVE-2018-16066.html https://www.suse.com/security/cve/CVE-2018-16067.html https://www.suse.com/security/cve/CVE-2018-16068.html https://www.suse.com/security/cve/CVE-2018-16069.html https://www.suse.com/security/cve/CVE-2018-16070.html https://www.suse.com/security/cve/CVE-2018-16071.html https://www.suse.com/security/cve/CVE-2018-16073.html https://www.suse.com/security/cve/CVE-2018-16074.html https://www.suse.com/security/cve/CVE-2018-16075.html https://www.suse.com/security/cve/CVE-2018-16076.html https://www.suse.com/security/cve/CVE-2018-16077.html https://www.suse.com/security/cve/CVE-2018-16078.html https://www.suse.com/security/cve/CVE-2018-16079.html https://www.suse.com/security/cve/CVE-2018-16080.html https://www.suse.com/security/cve/CVE-2018-16081.html https://www.suse.com/security/cve/CVE-2018-16082.html https://www.suse.com/security/cve/CVE-2018-16083.html https://www.suse.com/security/cve/CVE-2018-16084.html https://www.suse.com/security/cve/CVE-2018-16085.html https://www.suse.com/security/cve/CVE-2018-16086.html https://www.suse.com/security/cve/CVE-2018-16087.html https://www.suse.com/security/cve/CVE-2018-16088.html https://bugzilla.suse.com/1106341 https://bugzilla.suse.com/1107235

1 0

openSUSE-SU-2018:2658-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2658-1 Rating: important References: #1084603 #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12367 CVE-2018-12371 CVE-2018-5156 CVE-2018-5187 CVE-2018-5188 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.0 fixes the following issues: These security issues were fixed: - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element (bsc#1098998). - CVE-2018-12360: Prevent use-after-free when using focus() (bsc#1098998). - CVE-2018-12361: Prevent integer overflow in SwizzleData (bsc#1098998). - CVE-2018-12362: Prevent integer overflow in SSSE3 scaler (bsc#1098998). - CVE-2018-5156: Prevent media recorder segmentation fault when track type is changed during capture (bsc#1098998). - CVE-2018-12363: Prevent use-after-free when appending DOM nodes (bsc#1098998). - CVE-2018-12364: Prevent CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998). - CVE-2018-12365: Prevent compromised IPC child process listing local filenames (bsc#1098998). - CVE-2018-12371: Prevent integer overflow in Skia library during edge builder allocation (bsc#1098998). - CVE-2018-12366: Prevent invalid data handling during QCMS transformations (bsc#1098998). - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998). - CVE-2018-5187: Various memory safety bugs (bsc#1098998). - CVE-2018-5188: Various memory safety bugs (bsc#1098998). These can not, in general, be exploited through email, but are potential risks in browser or browser-like contexts. These non-security issues were fixed: - Storing of remote content settings fixed (bsc#1084603) - Improved message handling and composing - Improved handling of message templates - Support for OAuth2 and FIDO U2F - Various Calendar improvements - Various fixes and changes to e-mail workflow - Various IMAP fixes - Native desktop notifications Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-994=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-994=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.0-74.1 MozillaThunderbird-buildsymbols-60.0-74.1 MozillaThunderbird-debuginfo-60.0-74.1 MozillaThunderbird-debugsource-60.0-74.1 MozillaThunderbird-translations-common-60.0-74.1 MozillaThunderbird-translations-other-60.0-74.1 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.0-lp150.3.14.1 MozillaThunderbird-buildsymbols-60.0-lp150.3.14.1 MozillaThunderbird-debuginfo-60.0-lp150.3.14.1 MozillaThunderbird-debugsource-60.0-lp150.3.14.1 MozillaThunderbird-translations-common-60.0-lp150.3.14.1 MozillaThunderbird-translations-other-60.0-lp150.3.14.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1084603 https://bugzilla.suse.com/1098998

1 0

openSUSE-RU-2018:2657-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2657-1 Rating: moderate References: #1089761 #1090944 #1101040 #1103910 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for systemd fixes the following issues: - cryptsetup: Add support for sector-size= option. (fate#325634) - resolved: Apply epoch to system time from PID 1. (bsc#1103910) - core/service: Rework the hold-off time over message. - core: Don't freeze OnCalendar= timer units when the clock goes back a lot. (bsc#1090944) - man: SystemMaxUse= clarification in journald.conf(5). (bsc#1101040) - Add udev.no-partlabel-links kernel command-line option. This option can be used to disable the generation of the by-partlabel symlinks regardless of the name used. (bsc#1089761) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-981=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-56.1 libsystemd0-debuginfo-228-56.1 libsystemd0-mini-228-56.1 libsystemd0-mini-debuginfo-228-56.1 libudev-devel-228-56.1 libudev-mini-devel-228-56.1 libudev-mini1-228-56.1 libudev-mini1-debuginfo-228-56.1 libudev1-228-56.1 libudev1-debuginfo-228-56.1 nss-myhostname-228-56.1 nss-myhostname-debuginfo-228-56.1 nss-mymachines-228-56.1 nss-mymachines-debuginfo-228-56.1 systemd-228-56.1 systemd-debuginfo-228-56.1 systemd-debugsource-228-56.1 systemd-devel-228-56.1 systemd-logger-228-56.1 systemd-mini-228-56.1 systemd-mini-debuginfo-228-56.1 systemd-mini-debugsource-228-56.1 systemd-mini-devel-228-56.1 systemd-mini-sysvinit-228-56.1 systemd-sysvinit-228-56.1 udev-228-56.1 udev-debuginfo-228-56.1 udev-mini-228-56.1 udev-mini-debuginfo-228-56.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-56.1 libsystemd0-debuginfo-32bit-228-56.1 libudev1-32bit-228-56.1 libudev1-debuginfo-32bit-228-56.1 nss-myhostname-32bit-228-56.1 nss-myhostname-debuginfo-32bit-228-56.1 systemd-32bit-228-56.1 systemd-debuginfo-32bit-228-56.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-56.1 systemd-mini-bash-completion-228-56.1 References: https://bugzilla.suse.com/1089761 https://bugzilla.suse.com/1090944 https://bugzilla.suse.com/1101040 https://bugzilla.suse.com/1103910

1 0

openSUSE-RU-2018:2656-1: moderate: Recommended update for permissions
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2656-1 Rating: moderate References: #1101420 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for permissions fixes the following issues: - add whitelisting for the spice-gtk setuid binary (bsc#1101420) for improved usability. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-983=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): permissions-20180125-lp150.2.3.1 permissions-debuginfo-20180125-lp150.2.3.1 permissions-debugsource-20180125-lp150.2.3.1 References: https://bugzilla.suse.com/1101420

1 0

openSUSE-RU-2018:2655-1: moderate: Recommended update for openvswitch
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for openvswitch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2655-1 Rating: moderate References: #1094234 #1098630 #1104049 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for openvswitch provides version 2.8.4 and fixes the following issues: - Fix permissions when running the logrotate script. (bsc#1104049) - Fix dbus timeout due to deadlock in systemd dependencies. (bsc#1098630) - dpif-netdev: Free packets on TUNNEL_PUSH if may_steal. . netdev-dpdk: Fix check for "net_nfp" driver. - netdev-dpdk: Don't use PMD driver if not configured successfully. - netdev-dpdk: Remove use of rte_mempool_ops_get_count. - conntrack-tcp: Handle tcp session reuse. - tunnel: Make tun_key_to_attr aware of tunnel type. - Configurable Link State Change (LSC) detection mode. - netdev-dpdk: Don't enable scatter for jumbo RX support for nfp. - faq: Document DPDK version maintenance. - Avoid crash in OvS while transmitting fragmented packets over tunnel. - compat: Fix upstream 4.4.119 kernel. - ovs-vsctl: Fix segfault when attempting to del-port from parent bridge. - ofproto-dpif-xlate: Fix segmentation fault caused by tun_table. - odp-util: Remove unnecessary TOS ECN bits rewrite for tunnels. - datapath: Prevent panic. - netdev-dpdk: Free mempool only when no in-use mbufs. - python: Fix a double encoding attempt on an Unicode string. - ofproto-dpif: Init ukey->dump_seq to zero. - nsh: Add unit test for double NSH encap and decap. - xlate: Correct handling of double encap() actions. - tc: Change filter error to debug once. - lib/tc: Handle error parsing action in nl_parse_single_action. - ovn: Fix tunnel id overflow. - ofp-actions: Correct execution of encap/decap actions in action set. - ovsdb-idl.at: Fix test failed. (writing large data via IDL with unicode) - netdev-dpdk: Limit rate of DPDK logs. - netdev-dpdk: Remove 'error' from non error log. - odp-util: Print eth() for Ethernet flows if packet_type is absent. - python: Fix decoding error when the received data is larger than 4096. - datapath-windows: Fix hash creation on ct mark. - tunnel: Fix deletion of datapath tunnel ports in case of reconfiguration. - tests: Make packet-type-aware.at hash independent. - Use openvswitch user/group for the log directory. - Add support for RedHat distributions. All SUSE macros are now conditional and the spec file has been adapted based on the upstream one. (fate#324537) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-990=1 Package List: - openSUSE Leap 15.0 (noarch): openvswitch-doc-2.8.4-lp150.5.3.1 python2-openvswitch-2.8.4-lp150.5.3.1 python2-openvswitch-test-2.8.4-lp150.5.3.1 python3-openvswitch-2.8.4-lp150.5.3.1 python3-openvswitch-test-2.8.4-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): libopenvswitch-2_8-0-2.8.4-lp150.5.3.1 libopenvswitch-2_8-0-debuginfo-2.8.4-lp150.5.3.1 openvswitch-2.8.4-lp150.5.3.1 openvswitch-debuginfo-2.8.4-lp150.5.3.1 openvswitch-debugsource-2.8.4-lp150.5.3.1 openvswitch-devel-2.8.4-lp150.5.3.1 openvswitch-ovn-central-2.8.4-lp150.5.3.1 openvswitch-ovn-central-debuginfo-2.8.4-lp150.5.3.1 openvswitch-ovn-common-2.8.4-lp150.5.3.1 openvswitch-ovn-common-debuginfo-2.8.4-lp150.5.3.1 openvswitch-ovn-docker-2.8.4-lp150.5.3.1 openvswitch-ovn-host-2.8.4-lp150.5.3.1 openvswitch-ovn-host-debuginfo-2.8.4-lp150.5.3.1 openvswitch-ovn-vtep-2.8.4-lp150.5.3.1 openvswitch-ovn-vtep-debuginfo-2.8.4-lp150.5.3.1 openvswitch-pki-2.8.4-lp150.5.3.1 openvswitch-test-2.8.4-lp150.5.3.1 openvswitch-test-debuginfo-2.8.4-lp150.5.3.1 openvswitch-vtep-2.8.4-lp150.5.3.1 openvswitch-vtep-debuginfo-2.8.4-lp150.5.3.1 References: https://bugzilla.suse.com/1094234 https://bugzilla.suse.com/1098630 https://bugzilla.suse.com/1104049

1 0

openSUSE-RU-2018:2654-1: moderate: Recommended update for collectl
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for collectl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2654-1 Rating: moderate References: #1106366 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for collectl fixes the following issues: - The collectl daemon did not start reliably (boo#1106366) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-978=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-978=1 Package List: - openSUSE Leap 42.3 (noarch): collectl-4.0.2-7.3.1 - openSUSE Leap 15.0 (noarch): collectl-4.1.3-lp150.3.3.1 References: https://bugzilla.suse.com/1106366

1 0

openSUSE-SU-2018:2648-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 07 Sep '18

07 Sep '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2648-1 Rating: moderate References: #1105466 Cross-References: CVE-2017-9118 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-976=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-46.1 apache2-mod_php7-debuginfo-7.0.7-46.1 php7-7.0.7-46.1 php7-bcmath-7.0.7-46.1 php7-bcmath-debuginfo-7.0.7-46.1 php7-bz2-7.0.7-46.1 php7-bz2-debuginfo-7.0.7-46.1 php7-calendar-7.0.7-46.1 php7-calendar-debuginfo-7.0.7-46.1 php7-ctype-7.0.7-46.1 php7-ctype-debuginfo-7.0.7-46.1 php7-curl-7.0.7-46.1 php7-curl-debuginfo-7.0.7-46.1 php7-dba-7.0.7-46.1 php7-dba-debuginfo-7.0.7-46.1 php7-debuginfo-7.0.7-46.1 php7-debugsource-7.0.7-46.1 php7-devel-7.0.7-46.1 php7-dom-7.0.7-46.1 php7-dom-debuginfo-7.0.7-46.1 php7-enchant-7.0.7-46.1 php7-enchant-debuginfo-7.0.7-46.1 php7-exif-7.0.7-46.1 php7-exif-debuginfo-7.0.7-46.1 php7-fastcgi-7.0.7-46.1 php7-fastcgi-debuginfo-7.0.7-46.1 php7-fileinfo-7.0.7-46.1 php7-fileinfo-debuginfo-7.0.7-46.1 php7-firebird-7.0.7-46.1 php7-firebird-debuginfo-7.0.7-46.1 php7-fpm-7.0.7-46.1 php7-fpm-debuginfo-7.0.7-46.1 php7-ftp-7.0.7-46.1 php7-ftp-debuginfo-7.0.7-46.1 php7-gd-7.0.7-46.1 php7-gd-debuginfo-7.0.7-46.1 php7-gettext-7.0.7-46.1 php7-gettext-debuginfo-7.0.7-46.1 php7-gmp-7.0.7-46.1 php7-gmp-debuginfo-7.0.7-46.1 php7-iconv-7.0.7-46.1 php7-iconv-debuginfo-7.0.7-46.1 php7-imap-7.0.7-46.1 php7-imap-debuginfo-7.0.7-46.1 php7-intl-7.0.7-46.1 php7-intl-debuginfo-7.0.7-46.1 php7-json-7.0.7-46.1 php7-json-debuginfo-7.0.7-46.1 php7-ldap-7.0.7-46.1 php7-ldap-debuginfo-7.0.7-46.1 php7-mbstring-7.0.7-46.1 php7-mbstring-debuginfo-7.0.7-46.1 php7-mcrypt-7.0.7-46.1 php7-mcrypt-debuginfo-7.0.7-46.1 php7-mysql-7.0.7-46.1 php7-mysql-debuginfo-7.0.7-46.1 php7-odbc-7.0.7-46.1 php7-odbc-debuginfo-7.0.7-46.1 php7-opcache-7.0.7-46.1 php7-opcache-debuginfo-7.0.7-46.1 php7-openssl-7.0.7-46.1 php7-openssl-debuginfo-7.0.7-46.1 php7-pcntl-7.0.7-46.1 php7-pcntl-debuginfo-7.0.7-46.1 php7-pdo-7.0.7-46.1 php7-pdo-debuginfo-7.0.7-46.1 php7-pgsql-7.0.7-46.1 php7-pgsql-debuginfo-7.0.7-46.1 php7-phar-7.0.7-46.1 php7-phar-debuginfo-7.0.7-46.1 php7-posix-7.0.7-46.1 php7-posix-debuginfo-7.0.7-46.1 php7-pspell-7.0.7-46.1 php7-pspell-debuginfo-7.0.7-46.1 php7-readline-7.0.7-46.1 php7-readline-debuginfo-7.0.7-46.1 php7-shmop-7.0.7-46.1 php7-shmop-debuginfo-7.0.7-46.1 php7-snmp-7.0.7-46.1 php7-snmp-debuginfo-7.0.7-46.1 php7-soap-7.0.7-46.1 php7-soap-debuginfo-7.0.7-46.1 php7-sockets-7.0.7-46.1 php7-sockets-debuginfo-7.0.7-46.1 php7-sqlite-7.0.7-46.1 php7-sqlite-debuginfo-7.0.7-46.1 php7-sysvmsg-7.0.7-46.1 php7-sysvmsg-debuginfo-7.0.7-46.1 php7-sysvsem-7.0.7-46.1 php7-sysvsem-debuginfo-7.0.7-46.1 php7-sysvshm-7.0.7-46.1 php7-sysvshm-debuginfo-7.0.7-46.1 php7-tidy-7.0.7-46.1 php7-tidy-debuginfo-7.0.7-46.1 php7-tokenizer-7.0.7-46.1 php7-tokenizer-debuginfo-7.0.7-46.1 php7-wddx-7.0.7-46.1 php7-wddx-debuginfo-7.0.7-46.1 php7-xmlreader-7.0.7-46.1 php7-xmlreader-debuginfo-7.0.7-46.1 php7-xmlrpc-7.0.7-46.1 php7-xmlrpc-debuginfo-7.0.7-46.1 php7-xmlwriter-7.0.7-46.1 php7-xmlwriter-debuginfo-7.0.7-46.1 php7-xsl-7.0.7-46.1 php7-xsl-debuginfo-7.0.7-46.1 php7-zip-7.0.7-46.1 php7-zip-debuginfo-7.0.7-46.1 php7-zlib-7.0.7-46.1 php7-zlib-debuginfo-7.0.7-46.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-46.1 php7-pear-Archive_Tar-7.0.7-46.1 References: https://www.suse.com/security/cve/CVE-2017-9118.html https://bugzilla.suse.com/1105466

1 0

openSUSE-SU-2018:2645-1: moderate: Security update for apache-pdfbox
by opensuse-security＠opensuse.org 07 Sep '18

07 Sep '18

openSUSE Security Update: Security update for apache-pdfbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2645-1 Rating: moderate References: #1099721 Cross-References: CVE-2018-8036 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-pdfbox fixes the following issues: Security issue fixed: - CVE-2018-8036: Fix infinite loop while parsing files that leads to an out of memory issue (bsc#1099721). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-975=1 Package List: - openSUSE Leap 15.0 (noarch): apache-pdfbox-1.8.12-lp150.4.3.1 apache-pdfbox-javadoc-1.8.12-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-8036.html https://bugzilla.suse.com/1099721

1 0