September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2957-1: moderate: Security update for openssl
by opensuse-security＠opensuse.org 30 Sep '18

30 Sep '18

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2957-1 Rating: moderate References: #1089039 #1101246 #1101470 #1104789 #1106197 #997043 Cross-References: CVE-2018-0737 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for openssl fixes the following issues: These security issues were fixed: - Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information (bsc#1104789) - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039) These non-security issues were fixed: - Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470) - Fixed path to the engines which are under /lib64 on SLE-12 (bsc#1101246, bsc#997043) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1091=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenssl-devel-1.0.2j-29.1 libopenssl1_0_0-1.0.2j-29.1 libopenssl1_0_0-debuginfo-1.0.2j-29.1 libopenssl1_0_0-hmac-1.0.2j-29.1 openssl-1.0.2j-29.1 openssl-cavs-1.0.2j-29.1 openssl-cavs-debuginfo-1.0.2j-29.1 openssl-debuginfo-1.0.2j-29.1 openssl-debugsource-1.0.2j-29.1 - openSUSE Leap 42.3 (noarch): openssl-doc-1.0.2j-29.1 - openSUSE Leap 42.3 (x86_64): libopenssl-devel-32bit-1.0.2j-29.1 libopenssl1_0_0-32bit-1.0.2j-29.1 libopenssl1_0_0-debuginfo-32bit-1.0.2j-29.1 libopenssl1_0_0-hmac-32bit-1.0.2j-29.1 References: https://www.suse.com/security/cve/CVE-2018-0737.html https://bugzilla.suse.com/1089039 https://bugzilla.suse.com/1101246 https://bugzilla.suse.com/1101470 https://bugzilla.suse.com/1104789 https://bugzilla.suse.com/1106197 https://bugzilla.suse.com/997043

1 0

openSUSE-RU-2018:2954-1: important: Recommended update for kdump
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for kdump ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2954-1 Rating: important References: #1002617 #1058202 #1081646 #1091186 #1101730 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for kdump fixes the following issues: - Block initrd-parse-etc.service until dump is saved (bsc#1091186). - Always copy timezone data into kdumprd (bsc#1081646). - Bail out of kdump_check_net if no default interface is found (bsc#1058202). - fadump: avoid multipath optimizations that break regular boot (bsc#1101730). - cmdline: split kdump cmdline purpose wise (bsc#1101730). - fadump: fix network bring up issue during default boot (bsc#1101730). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1086=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kdump-0.8.16-5.9.1 kdump-debuginfo-0.8.16-5.9.1 kdump-debugsource-0.8.16-5.9.1 References: https://bugzilla.suse.com/1002617 https://bugzilla.suse.com/1058202 https://bugzilla.suse.com/1081646 https://bugzilla.suse.com/1091186 https://bugzilla.suse.com/1101730

1 0

openSUSE-RU-2018:2953-1: moderate: Recommended update for openldap2
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2953-1 Rating: moderate References: #1089640 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openldap2 provides the following fix: - Fix slapd segfaults in mdb_env_reader_dest. (bsc#1089640) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1085=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libldap-2_4-2-2.4.46-lp150.8.3.1 libldap-2_4-2-debuginfo-2.4.46-lp150.8.3.1 openldap2-2.4.46-lp150.8.3.1 openldap2-back-meta-2.4.46-lp150.8.3.1 openldap2-back-meta-debuginfo-2.4.46-lp150.8.3.1 openldap2-back-perl-2.4.46-lp150.8.3.1 openldap2-back-perl-debuginfo-2.4.46-lp150.8.3.1 openldap2-back-sock-2.4.46-lp150.8.3.1 openldap2-back-sock-debuginfo-2.4.46-lp150.8.3.1 openldap2-back-sql-2.4.46-lp150.8.3.1 openldap2-back-sql-debuginfo-2.4.46-lp150.8.3.1 openldap2-client-2.4.46-lp150.8.3.1 openldap2-client-debuginfo-2.4.46-lp150.8.3.1 openldap2-contrib-2.4.46-lp150.8.3.1 openldap2-contrib-debuginfo-2.4.46-lp150.8.3.1 openldap2-debuginfo-2.4.46-lp150.8.3.1 openldap2-debugsource-2.4.46-lp150.8.3.1 openldap2-devel-2.4.46-lp150.8.3.1 openldap2-devel-static-2.4.46-lp150.8.3.1 openldap2-ppolicy-check-password-1.2-lp150.8.3.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp150.8.3.1 - openSUSE Leap 15.0 (x86_64): libldap-2_4-2-32bit-2.4.46-lp150.8.3.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp150.8.3.1 openldap2-devel-32bit-2.4.46-lp150.8.3.1 - openSUSE Leap 15.0 (noarch): libldap-data-2.4.46-lp150.8.3.1 openldap2-doc-2.4.46-lp150.8.3.1 References: https://bugzilla.suse.com/1089640

1 0

openSUSE-RU-2018:2952-1: moderate: Recommended update for snapper
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for snapper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2952-1 Rating: moderate References: #1096208 #1096401 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for snapper fixes the following issues: - Fixed logging during shutdown of snapperd to avoid core dumps. (bsc#1096401) - Fix fails to build with new Boost library due to missing pthread library during link. (bsc#1096208) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1089=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsnapper-devel-0.5.6-lp150.3.6.1 libsnapper4-0.5.6-lp150.3.6.1 libsnapper4-debuginfo-0.5.6-lp150.3.6.1 pam_snapper-0.5.6-lp150.3.6.1 pam_snapper-debuginfo-0.5.6-lp150.3.6.1 snapper-0.5.6-lp150.3.6.1 snapper-debuginfo-0.5.6-lp150.3.6.1 snapper-debugsource-0.5.6-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): snapper-zypp-plugin-0.5.6-lp150.3.6.1 References: https://bugzilla.suse.com/1096208 https://bugzilla.suse.com/1096401

1 0

openSUSE-RU-2018:2951-1: moderate: Recommended update for multiple yast2 packages
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for multiple yast2 packages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2951-1 Rating: moderate References: #1087957 #1099691 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update adds functionality to multiple YaST packages: - Enhance the search function of the QT version of the YaST2 control center (fate#321043, bsc#1099691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1090=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-country-4.0.23-lp150.2.6.1 yast2-country-data-4.0.23-lp150.2.6.1 yast2-kdump-4.0.4-lp150.2.3.1 yast2-nis-client-4.0.3-lp150.2.3.1 yast2-nis-client-debuginfo-4.0.3-lp150.2.3.1 yast2-nis-client-debugsource-4.0.3-lp150.2.3.1 yast2-tune-4.0.1-lp150.2.3.1 yast2-vm-4.0.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): yast2-control-center-4.0.4-lp150.2.3.1 yast2-control-center-debugsource-4.0.4-lp150.2.3.1 yast2-control-center-qt-4.0.4-lp150.2.3.1 yast2-control-center-qt-debuginfo-4.0.4-lp150.2.3.1 yast2-sound-4.0.1-lp150.2.3.1 yast2-sound-debuginfo-4.0.1-lp150.2.3.1 yast2-sound-debugsource-4.0.1-lp150.2.3.1 yast2-squid-4.0.2-lp150.2.3.1 yast2-squid-debuginfo-4.0.2-lp150.2.3.1 yast2-squid-debugsource-4.0.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): yast2-apparmor-4.0.5-lp150.2.3.1 yast2-dhcp-server-4.0.1-lp150.2.3.1 yast2-dns-server-4.0.3-lp150.2.6.1 yast2-fcoe-client-4.0.1-lp150.2.3.1 yast2-firewall-4.0.26-lp150.2.3.1 yast2-iscsi-lio-server-4.0.11-lp150.2.3.1 yast2-mail-4.0.4-lp150.2.3.1 yast2-multipath-4.0.1-lp150.2.3.1 yast2-nfs-common-4.0.1-lp150.2.3.1 yast2-nfs-server-4.0.1-lp150.2.3.1 yast2-nis-server-4.0.1-lp150.2.3.1 yast2-online-update-4.0.1-lp150.2.3.1 yast2-online-update-configuration-4.0.1-lp150.2.3.1 yast2-online-update-frontend-4.0.1-lp150.2.3.1 yast2-proxy-4.0.2-lp150.2.6.1 yast2-rdp-4.0.2-lp150.2.3.1 yast2-samba-server-4.0.2-lp150.2.3.1 yast2-sudo-4.0.0-lp150.2.3.1 yast2-sysconfig-4.0.1-lp150.2.3.1 yast2-tftp-server-4.0.3-lp150.2.3.1 References: https://bugzilla.suse.com/1087957 https://bugzilla.suse.com/1099691

1 0

openSUSE-OU-2018:2950-1: Optional update to add python3-llfuse
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Optional Update: Optional update to add python3-llfuse ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2950-1 Rating: low References: #1095725 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update makes available python-llfuse. The package is required when using the mount subcommand of borg, part of Borg backup. (boo#1095725) Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1084=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1084=1 Package List: - openSUSE Leap 15.0 (x86_64): python-llfuse-debuginfo-1.3.5-lp150.2.1 python-llfuse-debugsource-1.3.5-lp150.2.1 python2-llfuse-1.3.5-lp150.2.1 python2-llfuse-debuginfo-1.3.5-lp150.2.1 python3-llfuse-1.3.5-lp150.2.1 python3-llfuse-debuginfo-1.3.5-lp150.2.1 - openSUSE Leap 15.0 (noarch): python-llfuse-docs-1.3.5-lp150.2.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python2-llfuse-1.3.5-bp150.2.1 python3-llfuse-1.3.5-bp150.2.1 - openSUSE Backports SLE-15 (noarch): python-llfuse-docs-1.3.5-bp150.2.1 References: https://bugzilla.suse.com/1095725

1 0

openSUSE-RU-2018:2949-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2949-1 Rating: moderate References: #1063443 #1084508 #1088830 #1089493 #1102515 #1105163 #1106381 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for grub2 provides the following fixes: - Fix overflow in sector count calculation. (bsc#1105163) - Fix config_directory on btrfs to follow path scheme. (bsc#1063443) - Fix setparams doesn't work as expected in boot-last-label. (bsc#1088830) - Suggest instead of libburnia-tools to not pull in tcl/tk and half of the x11 stack automatically. (bsc#1102515) - Fix broken network interface with random address and same name. (bsc#1084508) - Fix outputting invalid btrfs subvolume path on non btrfs filesystem due to bogus return code handling. (bsc#1106381) - Fix boot issues with iSCSI on s390x (boo#1089493) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1088=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): grub2-2.02-lp150.13.4.1 grub2-branding-upstream-2.02-lp150.13.4.1 grub2-debuginfo-2.02-lp150.13.4.1 grub2-debugsource-2.02-lp150.13.4.1 grub2-i386-pc-2.02-lp150.13.4.1 - openSUSE Leap 15.0 (x86_64): grub2-x86_64-efi-2.02-lp150.13.4.1 grub2-x86_64-xen-2.02-lp150.13.4.1 - openSUSE Leap 15.0 (noarch): grub2-snapper-plugin-2.02-lp150.13.4.1 grub2-systemd-sleep-plugin-2.02-lp150.13.4.1 - openSUSE Leap 15.0 (i586): grub2-i386-efi-2.02-lp150.13.4.1 grub2-i386-xen-2.02-lp150.13.4.1 References: https://bugzilla.suse.com/1063443 https://bugzilla.suse.com/1084508 https://bugzilla.suse.com/1088830 https://bugzilla.suse.com/1089493 https://bugzilla.suse.com/1102515 https://bugzilla.suse.com/1105163 https://bugzilla.suse.com/1106381

1 0

openSUSE-RU-2018:2948-1: moderate: Recommended update for hwdata
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for hwdata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2948-1 Rating: moderate References: #1106523 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hwdata contains updated hardware identification and configuration data (boo#1106523). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1083=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1083=1 Package List: - openSUSE Leap 42.3 (noarch): hwdata-0.314-12.1 - openSUSE Leap 15.0 (noarch): hwdata-0.314-lp150.2.3.1 References: https://bugzilla.suse.com/1106523

1 0

openSUSE-RU-2018:2947-1: important: Recommended update for pidentd
by maintenance＠opensuse.org 29 Sep '18

29 Sep '18

openSUSE Recommended Update: Recommended update for pidentd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2947-1 Rating: important References: #1101107 #1101600 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for pidentd fixes the following issues: - IPv6 support was accidentally dropped when upgrading to 3.0.19. This update reenables IPv6 support. (bsc#1101600) - Drop uname -r of buildhost from binary for reproducible builds (bsc#1101107) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1087=1 Package List: - openSUSE Leap 15.0 (x86_64): pidentd-3.0.19-lp150.3.3.1 pidentd-debuginfo-3.0.19-lp150.3.3.1 pidentd-debugsource-3.0.19-lp150.3.3.1 References: https://bugzilla.suse.com/1101107 https://bugzilla.suse.com/1101600

1 0

openSUSE-RU-2018:2944-1: moderate: Security update for opera
by maintenance＠opensuse.org 28 Sep '18

28 Sep '18

openSUSE Recommended Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2944-1 Rating: moderate References: #1110016 Affected Products: openSUSE Leap 42.3:NonFree openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Opera to version 56.0.3051.31 contains the following changes: - Various bug fixes in the browser engine and the user interface (boo#1110016) - Chromium engine updated to 69.0.3497.100 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3:NonFree: zypper in -t patch openSUSE-2018-1082=1 - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2018-1082=1 Package List: - openSUSE Leap 42.3:NonFree (x86_64): opera-56.0.3051.31-71.1 - openSUSE Leap 15.0:NonFree (x86_64): opera-56.0.3051.31-lp150.2.6.1 References: https://bugzilla.suse.com/1110016

1 0

openSUSE-SU-2018:2943-1: important: Security update for yast2-smt
by opensuse-security＠opensuse.org 28 Sep '18

28 Sep '18

openSUSE Security Update: Security update for yast2-smt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2943-1 Rating: important References: #1097560 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update fixes the following issue in yast2-smt: - Remove cron job rescheduling (bsc#1097560) This update is a requirement for the security update for SMT. Because of that it is tagged as security to ensure that all users, even those that only install security updates, install it. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1081=1 Package List: - openSUSE Leap 42.3 (noarch): yast2-smt-3.0.14-2.3.1 References: https://bugzilla.suse.com/1097560

1 0

openSUSE-SU-2018:2942-1: important: Security update for mgetty
by opensuse-security＠opensuse.org 28 Sep '18

28 Sep '18

openSUSE Security Update: Security update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2942-1 Rating: important References: #1108752 #1108756 #1108757 #1108761 #1108762 Cross-References: CVE-2018-16741 CVE-2018-16742 CVE-2018-16743 CVE-2018-16744 CVE-2018-16745 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for mgetty fixes the following issues: - CVE-2018-16741: The function do_activate() did not properly sanitize shell metacharacters to prevent command injection (bsc#1108752). - CVE-2018-16745: The mail_to parameter was not sanitized, leading to a buffer overflow if long untrusted input reached it (bsc#1108756). - CVE-2018-16744: The mail_to parameter was not sanitized, leading to command injection if untrusted input reached reach it (bsc#1108757). - CVE-2018-16742: Prevent stack-based buffer overflow that could have been triggered via a command-line parameter (bsc#1108762). - CVE-2018-16743: The command-line parameter username wsa passed unsanitized to strcpy(), which could have caused a stack-based buffer overflow (bsc#1108761). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1080=1 Package List: - openSUSE Leap 15.0 (x86_64): g3utils-1.1.37-lp150.2.3.1 g3utils-debuginfo-1.1.37-lp150.2.3.1 mgetty-1.1.37-lp150.2.3.1 mgetty-debuginfo-1.1.37-lp150.2.3.1 mgetty-debugsource-1.1.37-lp150.2.3.1 sendfax-1.1.37-lp150.2.3.1 sendfax-debuginfo-1.1.37-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16741.html https://www.suse.com/security/cve/CVE-2018-16742.html https://www.suse.com/security/cve/CVE-2018-16743.html https://www.suse.com/security/cve/CVE-2018-16744.html https://www.suse.com/security/cve/CVE-2018-16745.html https://bugzilla.suse.com/1108752 https://bugzilla.suse.com/1108756 https://bugzilla.suse.com/1108757 https://bugzilla.suse.com/1108761 https://bugzilla.suse.com/1108762

1 0

openSUSE-SU-2018:2941-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 28 Sep '18

28 Sep '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2941-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1079=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gd-2.2.5-lp150.3.3.1 gd-debuginfo-2.2.5-lp150.3.3.1 gd-debugsource-2.2.5-lp150.3.3.1 gd-devel-2.2.5-lp150.3.3.1 libgd3-2.2.5-lp150.3.3.1 libgd3-debuginfo-2.2.5-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libgd3-32bit-2.2.5-lp150.3.3.1 libgd3-32bit-debuginfo-2.2.5-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434

1 0

openSUSE-SU-2018:2931-1: moderate: Security update for dom4j
by opensuse-security＠opensuse.org 28 Sep '18

28 Sep '18

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2931-1 Rating: moderate References: #1105443 Cross-References: CVE-2018-1000632 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2018-1000632: Prevent XML injection vulnerability that allowed an attacker to tamper with XML documents (bsc#1105443) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1077=1 Package List: - openSUSE Leap 42.3 (noarch): dom4j-1.6.1-31.3.2 dom4j-demo-1.6.1-31.3.2 dom4j-javadoc-1.6.1-31.3.2 dom4j-manual-1.6.1-31.3.2 References: https://www.suse.com/security/cve/CVE-2018-1000632.html https://bugzilla.suse.com/1105443

1 0

openSUSE-SU-2018:2929-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 28 Sep '18

28 Sep '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2929-1 Rating: moderate References: #1108753 Cross-References: CVE-2018-17082 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2018-17082: The Apache2 component in PHP allowed XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade was mishandled in the php_handler function (bsc#1108753). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1078=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-49.1 apache2-mod_php7-debuginfo-7.0.7-49.1 php7-7.0.7-49.1 php7-bcmath-7.0.7-49.1 php7-bcmath-debuginfo-7.0.7-49.1 php7-bz2-7.0.7-49.1 php7-bz2-debuginfo-7.0.7-49.1 php7-calendar-7.0.7-49.1 php7-calendar-debuginfo-7.0.7-49.1 php7-ctype-7.0.7-49.1 php7-ctype-debuginfo-7.0.7-49.1 php7-curl-7.0.7-49.1 php7-curl-debuginfo-7.0.7-49.1 php7-dba-7.0.7-49.1 php7-dba-debuginfo-7.0.7-49.1 php7-debuginfo-7.0.7-49.1 php7-debugsource-7.0.7-49.1 php7-devel-7.0.7-49.1 php7-dom-7.0.7-49.1 php7-dom-debuginfo-7.0.7-49.1 php7-enchant-7.0.7-49.1 php7-enchant-debuginfo-7.0.7-49.1 php7-exif-7.0.7-49.1 php7-exif-debuginfo-7.0.7-49.1 php7-fastcgi-7.0.7-49.1 php7-fastcgi-debuginfo-7.0.7-49.1 php7-fileinfo-7.0.7-49.1 php7-fileinfo-debuginfo-7.0.7-49.1 php7-firebird-7.0.7-49.1 php7-firebird-debuginfo-7.0.7-49.1 php7-fpm-7.0.7-49.1 php7-fpm-debuginfo-7.0.7-49.1 php7-ftp-7.0.7-49.1 php7-ftp-debuginfo-7.0.7-49.1 php7-gd-7.0.7-49.1 php7-gd-debuginfo-7.0.7-49.1 php7-gettext-7.0.7-49.1 php7-gettext-debuginfo-7.0.7-49.1 php7-gmp-7.0.7-49.1 php7-gmp-debuginfo-7.0.7-49.1 php7-iconv-7.0.7-49.1 php7-iconv-debuginfo-7.0.7-49.1 php7-imap-7.0.7-49.1 php7-imap-debuginfo-7.0.7-49.1 php7-intl-7.0.7-49.1 php7-intl-debuginfo-7.0.7-49.1 php7-json-7.0.7-49.1 php7-json-debuginfo-7.0.7-49.1 php7-ldap-7.0.7-49.1 php7-ldap-debuginfo-7.0.7-49.1 php7-mbstring-7.0.7-49.1 php7-mbstring-debuginfo-7.0.7-49.1 php7-mcrypt-7.0.7-49.1 php7-mcrypt-debuginfo-7.0.7-49.1 php7-mysql-7.0.7-49.1 php7-mysql-debuginfo-7.0.7-49.1 php7-odbc-7.0.7-49.1 php7-odbc-debuginfo-7.0.7-49.1 php7-opcache-7.0.7-49.1 php7-opcache-debuginfo-7.0.7-49.1 php7-openssl-7.0.7-49.1 php7-openssl-debuginfo-7.0.7-49.1 php7-pcntl-7.0.7-49.1 php7-pcntl-debuginfo-7.0.7-49.1 php7-pdo-7.0.7-49.1 php7-pdo-debuginfo-7.0.7-49.1 php7-pgsql-7.0.7-49.1 php7-pgsql-debuginfo-7.0.7-49.1 php7-phar-7.0.7-49.1 php7-phar-debuginfo-7.0.7-49.1 php7-posix-7.0.7-49.1 php7-posix-debuginfo-7.0.7-49.1 php7-pspell-7.0.7-49.1 php7-pspell-debuginfo-7.0.7-49.1 php7-readline-7.0.7-49.1 php7-readline-debuginfo-7.0.7-49.1 php7-shmop-7.0.7-49.1 php7-shmop-debuginfo-7.0.7-49.1 php7-snmp-7.0.7-49.1 php7-snmp-debuginfo-7.0.7-49.1 php7-soap-7.0.7-49.1 php7-soap-debuginfo-7.0.7-49.1 php7-sockets-7.0.7-49.1 php7-sockets-debuginfo-7.0.7-49.1 php7-sqlite-7.0.7-49.1 php7-sqlite-debuginfo-7.0.7-49.1 php7-sysvmsg-7.0.7-49.1 php7-sysvmsg-debuginfo-7.0.7-49.1 php7-sysvsem-7.0.7-49.1 php7-sysvsem-debuginfo-7.0.7-49.1 php7-sysvshm-7.0.7-49.1 php7-sysvshm-debuginfo-7.0.7-49.1 php7-tidy-7.0.7-49.1 php7-tidy-debuginfo-7.0.7-49.1 php7-tokenizer-7.0.7-49.1 php7-tokenizer-debuginfo-7.0.7-49.1 php7-wddx-7.0.7-49.1 php7-wddx-debuginfo-7.0.7-49.1 php7-xmlreader-7.0.7-49.1 php7-xmlreader-debuginfo-7.0.7-49.1 php7-xmlrpc-7.0.7-49.1 php7-xmlrpc-debuginfo-7.0.7-49.1 php7-xmlwriter-7.0.7-49.1 php7-xmlwriter-debuginfo-7.0.7-49.1 php7-xsl-7.0.7-49.1 php7-xsl-debuginfo-7.0.7-49.1 php7-zip-7.0.7-49.1 php7-zip-debuginfo-7.0.7-49.1 php7-zlib-7.0.7-49.1 php7-zlib-debuginfo-7.0.7-49.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-49.1 php7-pear-Archive_Tar-7.0.7-49.1 References: https://www.suse.com/security/cve/CVE-2018-17082.html https://bugzilla.suse.com/1108753

1 0

openSUSE-RU-2018:2927-1: Recommended update for myspell-dictionaries
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for myspell-dictionaries ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2927-1 Rating: low References: #1099508 #1102294 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update brings myspell-dictionaries to version 20180704, providing the following fixes: - Indonesian hyphenation added. - English updates. - Croatian updates. - Bulgarian files converted to UTF8 in order to avoid bugs. (bsc#1102294, bsc#1099508) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1066=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): myspell-dictionaries-20180704-10.1 myspell-lightproof-en-20180704-10.1 myspell-lightproof-hu_HU-20180704-10.1 myspell-lightproof-pt_BR-20180704-10.1 myspell-lightproof-ru_RU-20180704-10.1 - openSUSE Leap 42.3 (noarch): myspell-af_NA-20180704-10.1 myspell-af_ZA-20180704-10.1 myspell-an-20180704-10.1 myspell-an_ES-20180704-10.1 myspell-ar-20180704-10.1 myspell-ar_AE-20180704-10.1 myspell-ar_BH-20180704-10.1 myspell-ar_DZ-20180704-10.1 myspell-ar_EG-20180704-10.1 myspell-ar_IQ-20180704-10.1 myspell-ar_JO-20180704-10.1 myspell-ar_KW-20180704-10.1 myspell-ar_LB-20180704-10.1 myspell-ar_LY-20180704-10.1 myspell-ar_MA-20180704-10.1 myspell-ar_OM-20180704-10.1 myspell-ar_QA-20180704-10.1 myspell-ar_SA-20180704-10.1 myspell-ar_SD-20180704-10.1 myspell-ar_SY-20180704-10.1 myspell-ar_TN-20180704-10.1 myspell-ar_YE-20180704-10.1 myspell-be_BY-20180704-10.1 myspell-bg_BG-20180704-10.1 myspell-bn_BD-20180704-10.1 myspell-bn_IN-20180704-10.1 myspell-bo-20180704-10.1 myspell-bo_CN-20180704-10.1 myspell-bo_IN-20180704-10.1 myspell-br_FR-20180704-10.1 myspell-bs-20180704-10.1 myspell-bs_BA-20180704-10.1 myspell-ca-20180704-10.1 myspell-ca_AD-20180704-10.1 myspell-ca_ES-20180704-10.1 myspell-ca_ES_valencia-20180704-10.1 myspell-ca_FR-20180704-10.1 myspell-ca_IT-20180704-10.1 myspell-cs_CZ-20180704-10.1 myspell-da_DK-20180704-10.1 myspell-de-20180704-10.1 myspell-de_AT-20180704-10.1 myspell-de_CH-20180704-10.1 myspell-de_DE-20180704-10.1 myspell-el_GR-20180704-10.1 myspell-en-20180704-10.1 myspell-en_AU-20180704-10.1 myspell-en_BS-20180704-10.1 myspell-en_BZ-20180704-10.1 myspell-en_CA-20180704-10.1 myspell-en_GB-20180704-10.1 myspell-en_GH-20180704-10.1 myspell-en_IE-20180704-10.1 myspell-en_IN-20180704-10.1 myspell-en_JM-20180704-10.1 myspell-en_MW-20180704-10.1 myspell-en_NA-20180704-10.1 myspell-en_NZ-20180704-10.1 myspell-en_PH-20180704-10.1 myspell-en_TT-20180704-10.1 myspell-en_US-20180704-10.1 myspell-en_ZA-20180704-10.1 myspell-en_ZW-20180704-10.1 myspell-es-20180704-10.1 myspell-es_AR-20180704-10.1 myspell-es_BO-20180704-10.1 myspell-es_CL-20180704-10.1 myspell-es_CO-20180704-10.1 myspell-es_CR-20180704-10.1 myspell-es_CU-20180704-10.1 myspell-es_DO-20180704-10.1 myspell-es_EC-20180704-10.1 myspell-es_ES-20180704-10.1 myspell-es_GT-20180704-10.1 myspell-es_HN-20180704-10.1 myspell-es_MX-20180704-10.1 myspell-es_NI-20180704-10.1 myspell-es_PA-20180704-10.1 myspell-es_PE-20180704-10.1 myspell-es_PR-20180704-10.1 myspell-es_PY-20180704-10.1 myspell-es_SV-20180704-10.1 myspell-es_UY-20180704-10.1 myspell-es_VE-20180704-10.1 myspell-et_EE-20180704-10.1 myspell-fr_BE-20180704-10.1 myspell-fr_CA-20180704-10.1 myspell-fr_CH-20180704-10.1 myspell-fr_FR-20180704-10.1 myspell-fr_LU-20180704-10.1 myspell-fr_MC-20180704-10.1 myspell-gd_GB-20180704-10.1 myspell-gl-20180704-10.1 myspell-gl_ES-20180704-10.1 myspell-gu_IN-20180704-10.1 myspell-gug-20180704-10.1 myspell-gug_PY-20180704-10.1 myspell-he_IL-20180704-10.1 myspell-hi_IN-20180704-10.1 myspell-hr_HR-20180704-10.1 myspell-hu_HU-20180704-10.1 myspell-id-20180704-10.1 myspell-id_ID-20180704-10.1 myspell-is-20180704-10.1 myspell-is_IS-20180704-10.1 myspell-it_IT-20180704-10.1 myspell-kmr_Latn-20180704-10.1 myspell-kmr_Latn_SY-20180704-10.1 myspell-kmr_Latn_TR-20180704-10.1 myspell-lo_LA-20180704-10.1 myspell-lt_LT-20180704-10.1 myspell-lv_LV-20180704-10.1 myspell-nb_NO-20180704-10.1 myspell-ne_NP-20180704-10.1 myspell-nl_BE-20180704-10.1 myspell-nl_NL-20180704-10.1 myspell-nn_NO-20180704-10.1 myspell-no-20180704-10.1 myspell-oc_FR-20180704-10.1 myspell-pl_PL-20180704-10.1 myspell-pt_AO-20180704-10.1 myspell-pt_BR-20180704-10.1 myspell-pt_PT-20180704-10.1 myspell-ro-20180704-10.1 myspell-ro_RO-20180704-10.1 myspell-ru_RU-20180704-10.1 myspell-si_LK-20180704-10.1 myspell-sk_SK-20180704-10.1 myspell-sl_SI-20180704-10.1 myspell-sq_AL-20180704-10.1 myspell-sr-20180704-10.1 myspell-sr_CS-20180704-10.1 myspell-sr_Latn_CS-20180704-10.1 myspell-sr_Latn_RS-20180704-10.1 myspell-sr_RS-20180704-10.1 myspell-sv_FI-20180704-10.1 myspell-sv_SE-20180704-10.1 myspell-sw_TZ-20180704-10.1 myspell-te-20180704-10.1 myspell-te_IN-20180704-10.1 myspell-th_TH-20180704-10.1 myspell-uk_UA-20180704-10.1 myspell-vi-20180704-10.1 myspell-vi_VN-20180704-10.1 myspell-zu_ZA-20180704-10.1 References: https://bugzilla.suse.com/1099508 https://bugzilla.suse.com/1102294

1 0

openSUSE-RU-2018:2926-1: Recommended update for myspell-dictionaries
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for myspell-dictionaries ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2926-1 Rating: low References: #1099508 #1102294 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update brings myspell-dictionaries to version 20180704, providing the following fixes: - Indonesian spelling dictionary, thesaurus and hyphenation added. - English updates. - Croatian updates. - Bulgarian files converted to UTF8 in order to avoid bugs. (bsc#1102294, bsc#1099508) - Other smaller updates. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1067=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): myspell-dictionaries-20180704-lp150.2.3.1 myspell-lightproof-en-20180704-lp150.2.3.1 myspell-lightproof-hu_HU-20180704-lp150.2.3.1 myspell-lightproof-pt_BR-20180704-lp150.2.3.1 myspell-lightproof-ru_RU-20180704-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): myspell-af_NA-20180704-lp150.2.3.1 myspell-af_ZA-20180704-lp150.2.3.1 myspell-an-20180704-lp150.2.3.1 myspell-an_ES-20180704-lp150.2.3.1 myspell-ar-20180704-lp150.2.3.1 myspell-ar_AE-20180704-lp150.2.3.1 myspell-ar_BH-20180704-lp150.2.3.1 myspell-ar_DZ-20180704-lp150.2.3.1 myspell-ar_EG-20180704-lp150.2.3.1 myspell-ar_IQ-20180704-lp150.2.3.1 myspell-ar_JO-20180704-lp150.2.3.1 myspell-ar_KW-20180704-lp150.2.3.1 myspell-ar_LB-20180704-lp150.2.3.1 myspell-ar_LY-20180704-lp150.2.3.1 myspell-ar_MA-20180704-lp150.2.3.1 myspell-ar_OM-20180704-lp150.2.3.1 myspell-ar_QA-20180704-lp150.2.3.1 myspell-ar_SA-20180704-lp150.2.3.1 myspell-ar_SD-20180704-lp150.2.3.1 myspell-ar_SY-20180704-lp150.2.3.1 myspell-ar_TN-20180704-lp150.2.3.1 myspell-ar_YE-20180704-lp150.2.3.1 myspell-be_BY-20180704-lp150.2.3.1 myspell-bg_BG-20180704-lp150.2.3.1 myspell-bn_BD-20180704-lp150.2.3.1 myspell-bn_IN-20180704-lp150.2.3.1 myspell-bo-20180704-lp150.2.3.1 myspell-bo_CN-20180704-lp150.2.3.1 myspell-bo_IN-20180704-lp150.2.3.1 myspell-br_FR-20180704-lp150.2.3.1 myspell-bs-20180704-lp150.2.3.1 myspell-bs_BA-20180704-lp150.2.3.1 myspell-ca-20180704-lp150.2.3.1 myspell-ca_AD-20180704-lp150.2.3.1 myspell-ca_ES-20180704-lp150.2.3.1 myspell-ca_ES_valencia-20180704-lp150.2.3.1 myspell-ca_FR-20180704-lp150.2.3.1 myspell-ca_IT-20180704-lp150.2.3.1 myspell-cs_CZ-20180704-lp150.2.3.1 myspell-da_DK-20180704-lp150.2.3.1 myspell-de-20180704-lp150.2.3.1 myspell-de_AT-20180704-lp150.2.3.1 myspell-de_CH-20180704-lp150.2.3.1 myspell-de_DE-20180704-lp150.2.3.1 myspell-el_GR-20180704-lp150.2.3.1 myspell-en-20180704-lp150.2.3.1 myspell-en_AU-20180704-lp150.2.3.1 myspell-en_BS-20180704-lp150.2.3.1 myspell-en_BZ-20180704-lp150.2.3.1 myspell-en_CA-20180704-lp150.2.3.1 myspell-en_GB-20180704-lp150.2.3.1 myspell-en_GH-20180704-lp150.2.3.1 myspell-en_IE-20180704-lp150.2.3.1 myspell-en_IN-20180704-lp150.2.3.1 myspell-en_JM-20180704-lp150.2.3.1 myspell-en_MW-20180704-lp150.2.3.1 myspell-en_NA-20180704-lp150.2.3.1 myspell-en_NZ-20180704-lp150.2.3.1 myspell-en_PH-20180704-lp150.2.3.1 myspell-en_TT-20180704-lp150.2.3.1 myspell-en_US-20180704-lp150.2.3.1 myspell-en_ZA-20180704-lp150.2.3.1 myspell-en_ZW-20180704-lp150.2.3.1 myspell-es-20180704-lp150.2.3.1 myspell-es_AR-20180704-lp150.2.3.1 myspell-es_BO-20180704-lp150.2.3.1 myspell-es_CL-20180704-lp150.2.3.1 myspell-es_CO-20180704-lp150.2.3.1 myspell-es_CR-20180704-lp150.2.3.1 myspell-es_CU-20180704-lp150.2.3.1 myspell-es_DO-20180704-lp150.2.3.1 myspell-es_EC-20180704-lp150.2.3.1 myspell-es_ES-20180704-lp150.2.3.1 myspell-es_GT-20180704-lp150.2.3.1 myspell-es_HN-20180704-lp150.2.3.1 myspell-es_MX-20180704-lp150.2.3.1 myspell-es_NI-20180704-lp150.2.3.1 myspell-es_PA-20180704-lp150.2.3.1 myspell-es_PE-20180704-lp150.2.3.1 myspell-es_PR-20180704-lp150.2.3.1 myspell-es_PY-20180704-lp150.2.3.1 myspell-es_SV-20180704-lp150.2.3.1 myspell-es_UY-20180704-lp150.2.3.1 myspell-es_VE-20180704-lp150.2.3.1 myspell-et_EE-20180704-lp150.2.3.1 myspell-fr_BE-20180704-lp150.2.3.1 myspell-fr_CA-20180704-lp150.2.3.1 myspell-fr_CH-20180704-lp150.2.3.1 myspell-fr_FR-20180704-lp150.2.3.1 myspell-fr_LU-20180704-lp150.2.3.1 myspell-fr_MC-20180704-lp150.2.3.1 myspell-gd_GB-20180704-lp150.2.3.1 myspell-gl-20180704-lp150.2.3.1 myspell-gl_ES-20180704-lp150.2.3.1 myspell-gu_IN-20180704-lp150.2.3.1 myspell-gug-20180704-lp150.2.3.1 myspell-gug_PY-20180704-lp150.2.3.1 myspell-he_IL-20180704-lp150.2.3.1 myspell-hi_IN-20180704-lp150.2.3.1 myspell-hr_HR-20180704-lp150.2.3.1 myspell-hu_HU-20180704-lp150.2.3.1 myspell-id-20180704-lp150.2.3.1 myspell-id_ID-20180704-lp150.2.3.1 myspell-is-20180704-lp150.2.3.1 myspell-is_IS-20180704-lp150.2.3.1 myspell-it_IT-20180704-lp150.2.3.1 myspell-kmr_Latn-20180704-lp150.2.3.1 myspell-kmr_Latn_SY-20180704-lp150.2.3.1 myspell-kmr_Latn_TR-20180704-lp150.2.3.1 myspell-lo_LA-20180704-lp150.2.3.1 myspell-lt_LT-20180704-lp150.2.3.1 myspell-lv_LV-20180704-lp150.2.3.1 myspell-nb_NO-20180704-lp150.2.3.1 myspell-ne_NP-20180704-lp150.2.3.1 myspell-nl_BE-20180704-lp150.2.3.1 myspell-nl_NL-20180704-lp150.2.3.1 myspell-nn_NO-20180704-lp150.2.3.1 myspell-no-20180704-lp150.2.3.1 myspell-oc_FR-20180704-lp150.2.3.1 myspell-pl_PL-20180704-lp150.2.3.1 myspell-pt_AO-20180704-lp150.2.3.1 myspell-pt_BR-20180704-lp150.2.3.1 myspell-pt_PT-20180704-lp150.2.3.1 myspell-ro-20180704-lp150.2.3.1 myspell-ro_RO-20180704-lp150.2.3.1 myspell-ru_RU-20180704-lp150.2.3.1 myspell-si_LK-20180704-lp150.2.3.1 myspell-sk_SK-20180704-lp150.2.3.1 myspell-sl_SI-20180704-lp150.2.3.1 myspell-sq_AL-20180704-lp150.2.3.1 myspell-sr-20180704-lp150.2.3.1 myspell-sr_CS-20180704-lp150.2.3.1 myspell-sr_Latn_CS-20180704-lp150.2.3.1 myspell-sr_Latn_RS-20180704-lp150.2.3.1 myspell-sr_RS-20180704-lp150.2.3.1 myspell-sv_FI-20180704-lp150.2.3.1 myspell-sv_SE-20180704-lp150.2.3.1 myspell-sw_TZ-20180704-lp150.2.3.1 myspell-te-20180704-lp150.2.3.1 myspell-te_IN-20180704-lp150.2.3.1 myspell-th_TH-20180704-lp150.2.3.1 myspell-uk_UA-20180704-lp150.2.3.1 myspell-vi-20180704-lp150.2.3.1 myspell-vi_VN-20180704-lp150.2.3.1 myspell-zu_ZA-20180704-lp150.2.3.1 References: https://bugzilla.suse.com/1099508 https://bugzilla.suse.com/1102294

1 0

openSUSE-RU-2018:2925-1: moderate: Recommended update for zlib
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for zlib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2925-1 Rating: moderate References: #1071321 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for zlib provides the following fixes: - Speedup zlib on power8. (fate#325307) - Add safeguard against negative values in uInt. (boo#1071321) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1070=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libminizip1-1.2.11-lp150.2.3.1 libminizip1-debuginfo-1.2.11-lp150.2.3.1 libz1-1.2.11-lp150.2.3.1 libz1-debuginfo-1.2.11-lp150.2.3.1 minizip-devel-1.2.11-lp150.2.3.1 zlib-debugsource-1.2.11-lp150.2.3.1 zlib-devel-1.2.11-lp150.2.3.1 zlib-devel-static-1.2.11-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libminizip1-32bit-1.2.11-lp150.2.3.1 libminizip1-32bit-debuginfo-1.2.11-lp150.2.3.1 libz1-32bit-1.2.11-lp150.2.3.1 libz1-32bit-debuginfo-1.2.11-lp150.2.3.1 zlib-devel-32bit-1.2.11-lp150.2.3.1 zlib-devel-static-32bit-1.2.11-lp150.2.3.1 References: https://bugzilla.suse.com/1071321

1 0

openSUSE-RU-2018:2924-1: moderate: Recommended update for python-kiwi
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2924-1 Rating: moderate References: #1077096 #1077619 #1092485 #1092531 #1093377 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for python-kiwi provides the following fix: - Follow up fix to keep the permissions on target directory. This fix make sure the permissions are only applied if the target directory exists. (boo#1077619) - Resize partition table after image resize. The command 'kiwi image resize' allows to change the size of a disk image. Depending on the partition table type it is also required to resize the partition table inside of the image to let the file size change become effective. (fate#323874) - Add the possibility of setting some unpartitioned area after the system disk partition into the image, and also simplify the unpartitioned area calculation. (fate#323874) - Support lookup for fstab.append on fstab creation. At the time kiwi creates the fstab with all required fields to boot the system it now also looks for an optional fstab.append file and appends its contents to the fstab file. This allows to setup custom fstab entries for filesystem mounts which are established outside of the kiwi image building process by e.g a service at first boot. (fate#323874) - Fixed truncation of image when writing vhd tag. When writing the vhd tag into a vhdfixed formatted image the image was opened with the wrong open bits 'wb' and thus was truncated at the 64k offset. (boo#1077096) - Comment blocks causes use of high amounts of memory during XSLT processing. (boo#1092485) - Fix the name generation for GCE images. The implementation assumed that GCE images are of a type that use a kiwi generated initrd, looking for image name components based on the boot attribute in the type element. This assumption is not correct, use the name provided in the XML to compose the image name. (boo#1093377) - Fix zypper add lock operations by passing the correct arguments to zypper. - Allow arch attribute for profiles specification. A profile could be relevant only for a specific architecture. There was no way to express that in the XML description so this update makes it possible to represent that. (boo#1092531) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1068=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dracut-kiwi-live-8.33.14-17.1 dracut-kiwi-overlay-8.33.14-17.1 kiwi-boot-requires-8.33.14-17.1 kiwi-man-pages-8.33.14-17.1 kiwi-pxeboot-8.33.14-17.1 kiwi-tools-8.33.14-17.1 kiwi-tools-debuginfo-8.33.14-17.1 python-kiwi-debugsource-8.33.14-17.1 python2-kiwi-8.33.14-17.1 python3-kiwi-8.33.14-17.1 References: https://bugzilla.suse.com/1077096 https://bugzilla.suse.com/1077619 https://bugzilla.suse.com/1092485 https://bugzilla.suse.com/1092531 https://bugzilla.suse.com/1093377

1 0

openSUSE-RU-2018:2923-1: moderate: Recommended update for yast2-installation
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2923-1 Rating: moderate References: #1071745 #1097661 #1099505 #1101879 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-installation fixes the following issues: - Turn off systemd console output at the second stage of an installation (bsc#1099505). - Do not print errors if plymouth is not installed (bsc#1101879) - Do not crash if /etc/os-release is a directory (bsc#1097661) - Delete unneeded content of /mnt/run after installation/update. (bsc#1071745) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1063=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-installation-4.0.70-lp150.2.12.1 References: https://bugzilla.suse.com/1071745 https://bugzilla.suse.com/1097661 https://bugzilla.suse.com/1099505 https://bugzilla.suse.com/1101879

1 0

openSUSE-RU-2018:2922-1: moderate: Recommended update for lsof
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for lsof ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2922-1 Rating: moderate References: #1036304 #1099847 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for lsof provides the following fix: - Enhance -K option with the form "-K i" to direct lsof to ignore tasks. (bsc#1036304) - Add "Provides: backported-option-Ki" to indicate that "-K i" option is supported so libzypp can safely use it. (bsc#1099847) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1062=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): lsof-4.89-7.3.1 lsof-debuginfo-4.89-7.3.1 lsof-debugsource-4.89-7.3.1 References: https://bugzilla.suse.com/1036304 https://bugzilla.suse.com/1099847

1 0

openSUSE-RU-2018:2921-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2921-1 Rating: moderate References: #1107769 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for virtualbox fixes the following issues: - Autostarting of VirtualBox VMs would fail at boot time (boo#1107769 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1065=1 Package List: - openSUSE Leap 15.0 (x86_64): python3-virtualbox-5.2.18-lp150.4.17.1 python3-virtualbox-debuginfo-5.2.18-lp150.4.17.1 virtualbox-5.2.18-lp150.4.17.1 virtualbox-debuginfo-5.2.18-lp150.4.17.1 virtualbox-debugsource-5.2.18-lp150.4.17.1 virtualbox-devel-5.2.18-lp150.4.17.1 virtualbox-guest-kmp-default-5.2.18_k4.12.14_lp150.12.16-lp150.4.17.1 virtualbox-guest-kmp-default-debuginfo-5.2.18_k4.12.14_lp150.12.16-lp150.4.17.1 virtualbox-guest-tools-5.2.18-lp150.4.17.1 virtualbox-guest-tools-debuginfo-5.2.18-lp150.4.17.1 virtualbox-guest-x11-5.2.18-lp150.4.17.1 virtualbox-guest-x11-debuginfo-5.2.18-lp150.4.17.1 virtualbox-host-kmp-default-5.2.18_k4.12.14_lp150.12.16-lp150.4.17.1 virtualbox-host-kmp-default-debuginfo-5.2.18_k4.12.14_lp150.12.16-lp150.4.17.1 virtualbox-qt-5.2.18-lp150.4.17.1 virtualbox-qt-debuginfo-5.2.18-lp150.4.17.1 virtualbox-vnc-5.2.18-lp150.4.17.1 virtualbox-websrv-5.2.18-lp150.4.17.1 virtualbox-websrv-debuginfo-5.2.18-lp150.4.17.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-5.2.18-lp150.4.17.1 virtualbox-guest-source-5.2.18-lp150.4.17.1 virtualbox-host-source-5.2.18-lp150.4.17.1 References: https://bugzilla.suse.com/1107769

1 0

openSUSE-RU-2018:2920-1: moderate: Recommended update for mozjs52
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for mozjs52 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2920-1 Rating: moderate References: #1082720 #1093033 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mozjs52 provides the following fixes: - Fix building failing on PowerPC due to memory constraints. - Fix build errors on ppc64 (BE). (boo#1093033) - Fix armv6 build by fixing armv6 detection. - Use system zlib instead of the bundled one to avoid potential problems when trying to use system zlib while mozjs52-devel is installed. (boo#1082720) - Drop unused dependency on zip. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1074=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmozjs-52-52.6.0-lp150.2.3.1 libmozjs-52-debuginfo-52.6.0-lp150.2.3.1 mozjs52-52.6.0-lp150.2.3.1 mozjs52-debuginfo-52.6.0-lp150.2.3.1 mozjs52-debugsource-52.6.0-lp150.2.3.1 mozjs52-devel-52.6.0-lp150.2.3.1 References: https://bugzilla.suse.com/1082720 https://bugzilla.suse.com/1093033

1 0

openSUSE-RU-2018:2918-1: moderate: Recommended update for autoyast2
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2918-1 Rating: moderate References: #1095113 #1098794 #1104655 #1105711 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for autoyast2 provides the following fixes: - AutoInstallRules: Fix a crash while merging profiles. (boo#1105711) - AutoInstallRules: Increase the default maxdepth for not crashing with a big software package list. (boo#1104655) - Installation/Update: Do not call registration if module yast2-registration is not available in inst-sys. (boo#1098794) - Autoyast configuration module: Report XML errors while reading an Autoyast configuration file. (boo#1098794) - Added additional search keys to desktop file. (fate#321043) - Show AutoYaST configuration file errors just once. (boo#1095113) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1075=1 Package List: - openSUSE Leap 15.0 (noarch): autoyast2-4.0.61-lp150.2.6.1 autoyast2-installation-4.0.61-lp150.2.6.1 References: https://bugzilla.suse.com/1095113 https://bugzilla.suse.com/1098794 https://bugzilla.suse.com/1104655 https://bugzilla.suse.com/1105711

1 0

openSUSE-RU-2018:2917-1: important: Recommended update for icewm
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for icewm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2917-1 Rating: important References: #1096917 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for icewm fixes the following issues: - Renamed icewm-session.desktop to icewm.desktop to fix a upgrade issue (bsc#1096917). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1064=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): icewm-1.4.2-lp150.6.3.1 icewm-debuginfo-1.4.2-lp150.6.3.1 icewm-debugsource-1.4.2-lp150.6.3.1 icewm-default-1.4.2-lp150.6.3.1 icewm-default-debuginfo-1.4.2-lp150.6.3.1 icewm-lite-1.4.2-lp150.6.3.1 icewm-lite-debuginfo-1.4.2-lp150.6.3.1 - openSUSE Leap 15.0 (noarch): icewm-config-upstream-1.4.2-lp150.6.3.1 icewm-lang-1.4.2-lp150.6.3.1 References: https://bugzilla.suse.com/1096917

1 0

openSUSE-RU-2018:2915-1: moderate: Recommended update for ucode-intel
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2915-1 Rating: moderate References: #1104479 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ucode-intel 2018007a fixes the following issues: No change except clarify the licensing and redistributable state. (bsc#1104479) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1069=1 Package List: - openSUSE Leap 15.0 (x86_64): ucode-intel-20180807a-lp150.2.10.1 References: https://bugzilla.suse.com/1104479

1 0

openSUSE-RU-2018:2914-1: moderate: Recommended update for firewalld-rpcbind-helper
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for firewalld-rpcbind-helper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2914-1 Rating: moderate References: #1096064 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for firewalld-rpcbind-helper fixes the following issues: - Fix error when running in python3 context, because of a missing decode() call. (bsc#1096064) - Don't raise Exceptions when one of the target sysconfig files isn't installed. (bsc#1096064) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1072=1 Package List: - openSUSE Leap 15.0 (noarch): firewalld-rpcbind-helper-0.1-lp150.3.3.1 References: https://bugzilla.suse.com/1096064

1 0

openSUSE-RU-2018:2913-1: moderate: Recommended update for yast2-update
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for yast2-update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2913-1 Rating: moderate References: #1079034 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-update provides the following fix: - Do not show wrong fstype "Windows Data Partition" for partition which are suggested for upgrade. (bsc#1079034) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1071=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-update-4.0.18-lp150.2.6.1 yast2-update-FACTORY-4.0.18-lp150.2.6.1 References: https://bugzilla.suse.com/1079034

1 0

openSUSE-RU-2018:2912-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2912-1 Rating: moderate References: #1084379 #1087848 #1090568 #1099018 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for nvme-cli fixes the following issues: - Retry discovery log if the generation counter changes. (bsc#1087848) - Fix passing "host_traddr" for all transports (bsc#1084379) - Write ctrl_loss_tmo to fabrics device on connect. (bsc#1084379) - write keep-alive-timeout to fabrics device on connect. (bsc#1090568) - Add get_log LSP & LSO fields from 1.3 spec. (bsc#1099018) - Add option '--ctrl-loss-tmo' to 'connect-all' sub-command. (bsc#1084379) - Implement nvme_get_log13 (bsc#1099018) - Add support of unsigned long long to json (bsc#1099018) - Add support of RAE (bsc#1099018) - Add minimal ana-log page support (bsc#1099018) - Add ana_log documentation (bsc#1099018) - Fix double free in list_subsys (bsc#1099018) - Log error in case of failure in get_nvme_subsystem (bsc#1099018) - Move print function to nvme-print.c (bsc#1099018) - Show partial results if controller fails (bsc#1099018) - Add ctrl-loss-tmo to connect-all command (bsc#1084379) - Add device name argument and print ANA state. (bsc#1099018) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1076=1 Package List: - openSUSE Leap 15.0 (x86_64): nvme-cli-1.5-lp150.6.3.1 nvme-cli-debuginfo-1.5-lp150.6.3.1 nvme-cli-debugsource-1.5-lp150.6.3.1 References: https://bugzilla.suse.com/1084379 https://bugzilla.suse.com/1087848 https://bugzilla.suse.com/1090568 https://bugzilla.suse.com/1099018

1 0

openSUSE-RU-2018:2911-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2911-1 Rating: moderate References: #1095942 #1102013 #1103530 #1104154 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Prepend current directory when path is just filename. (bsc#1095942) - Only do reverse DNS lookup on IPs for salt-ssh. (bsc#1104154) - Add support for Python 3.7 and Tornado 5.0. - Decode file contents for python2. (bsc#1102013, bsc#1103530) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1073=1 Package List: - openSUSE Leap 15.0 (x86_64): python2-salt-2018.3.0-lp150.3.9.1 python3-salt-2018.3.0-lp150.3.9.1 salt-2018.3.0-lp150.3.9.1 salt-api-2018.3.0-lp150.3.9.1 salt-cloud-2018.3.0-lp150.3.9.1 salt-doc-2018.3.0-lp150.3.9.1 salt-master-2018.3.0-lp150.3.9.1 salt-minion-2018.3.0-lp150.3.9.1 salt-proxy-2018.3.0-lp150.3.9.1 salt-ssh-2018.3.0-lp150.3.9.1 salt-syndic-2018.3.0-lp150.3.9.1 - openSUSE Leap 15.0 (noarch): salt-bash-completion-2018.3.0-lp150.3.9.1 salt-fish-completion-2018.3.0-lp150.3.9.1 salt-zsh-completion-2018.3.0-lp150.3.9.1 References: https://bugzilla.suse.com/1095942 https://bugzilla.suse.com/1102013 https://bugzilla.suse.com/1103530 https://bugzilla.suse.com/1104154

1 0

openSUSE-RU-2018:2905-1: moderate: Recommended update for mate-screensaver
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for mate-screensaver ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2905-1 Rating: moderate References: #1098985 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-screensaver fixes the following issues: - Fixes more GdkScreen related deprecations (boo#1098985) - lock-plug: Only scale lock-screen widgets on older versions of GTK+ - Update translations. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1059=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1059=1 Package List: - openSUSE Leap 15.0 (x86_64): mate-screensaver-1.20.2-lp150.2.3.1 mate-screensaver-debuginfo-1.20.2-lp150.2.3.1 mate-screensaver-debugsource-1.20.2-lp150.2.3.1 mate-screensaver-devel-1.20.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): mate-screensaver-lang-1.20.2-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mate-screensaver-1.20.2-bp150.2.3.1 mate-screensaver-debuginfo-1.20.2-bp150.2.3.1 mate-screensaver-debugsource-1.20.2-bp150.2.3.1 mate-screensaver-devel-1.20.2-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): mate-screensaver-lang-1.20.2-bp150.2.3.1 References: https://bugzilla.suse.com/1098985

1 0

openSUSE-RU-2018:2901-1: moderate: Recommended update for ovmf
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2901-1 Rating: moderate References: #1099193 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ovmf fixes the following issues: - The installer may have failed on guest with AMD Secure Encrypted Virtualization (SEV) enabled (boo#1099193) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1060=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.6.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.6.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.6.1 References: https://bugzilla.suse.com/1099193

1 0

openSUSE-RU-2018:2897-1: moderate: Recommended update for yast2-snapper
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for yast2-snapper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2897-1 Rating: moderate References: #956955 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-snapper fixes the following issues: - Fixes a bug where restoring of a file was not possible (bsc#956955) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1058=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-snapper-3.2.1-4.3.1 References: https://bugzilla.suse.com/956955

1 0

openSUSE-SU-2018:2895-1: moderate: Security update for ant
by opensuse-security＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Security Update: Security update for ant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2895-1 Rating: moderate References: #1100053 Cross-References: CVE-2018-10886 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1057=1 Package List: - openSUSE Leap 15.0 (noarch): ant-1.9.10-lp150.2.3.1 ant-antlr-1.9.10-lp150.2.3.1 ant-apache-bcel-1.9.10-lp150.2.3.1 ant-apache-bsf-1.9.10-lp150.2.3.1 ant-apache-log4j-1.9.10-lp150.2.3.1 ant-apache-oro-1.9.10-lp150.2.3.1 ant-apache-regexp-1.9.10-lp150.2.3.1 ant-apache-resolver-1.9.10-lp150.2.3.1 ant-apache-xalan2-1.9.10-lp150.2.3.1 ant-commons-logging-1.9.10-lp150.2.3.1 ant-commons-net-1.9.10-lp150.2.3.1 ant-javamail-1.9.10-lp150.2.3.1 ant-jdepend-1.9.10-lp150.2.3.1 ant-jmf-1.9.10-lp150.2.3.1 ant-jsch-1.9.10-lp150.2.3.1 ant-junit-1.9.10-lp150.2.3.1 ant-manual-1.9.10-lp150.2.3.1 ant-scripts-1.9.10-lp150.2.3.1 ant-swing-1.9.10-lp150.2.3.1 ant-testutil-1.9.10-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10886.html https://bugzilla.suse.com/1100053

1 0

openSUSE-SU-2018:2885-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 26 Sep '18

26 Sep '18

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2885-1 Rating: moderate References: #1106914 Cross-References: CVE-2018-16588 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadow fixes the following security issue: - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 (bsc#1106914) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1055=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): shadow-4.2.1-20.1 shadow-debuginfo-4.2.1-20.1 shadow-debugsource-4.2.1-20.1 References: https://www.suse.com/security/cve/CVE-2018-16588.html https://bugzilla.suse.com/1106914

1 0

openSUSE-SU-2018:2881-1: important: Security update for libzypp, zypper
by opensuse-security＠opensuse.org 26 Sep '18

26 Sep '18

openSUSE Security Update: Security update for libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2881-1 Rating: important References: #1036304 #1049825 #1070851 #1076192 #1088705 #1091624 #1092413 #1096803 #1099847 #1100028 #1101349 #1102429 Cross-References: CVE-2018-7685 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 11 fixes is now available. Description: This update for libzypp, zypper fixes the following issues: Update libzypp to version 16.17.20: Security issues fixed: - PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685) - PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685) Other bugs fixed: - lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304) - Handle http error 502 Bad Gateway in curl backend (bsc#1070851) - RepoManager: Explicitly request repo2solv to generate application pseudo packages. - libzypp-devel should not require cmake (bsc#1101349) - HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803) - Avoid zombie tar processes (bsc#1076192) Update to zypper to version 1.13.45: Other bugs fixed: - XML <install-summary> attribute `packages-to-change` added (bsc#1102429) - man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028) - Prevent nested calls to exit() if aborted by a signal (bsc#1092413) - ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413) - Fix: zypper bash completion expands non-existing options (bsc#1049825) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1054=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libzypp-16.17.20-27.1 libzypp-debuginfo-16.17.20-27.1 libzypp-debugsource-16.17.20-27.1 libzypp-devel-16.17.20-27.1 libzypp-devel-doc-16.17.20-27.1 zypper-1.13.45-20.1 zypper-debuginfo-1.13.45-20.1 zypper-debugsource-1.13.45-20.1 - openSUSE Leap 42.3 (noarch): zypper-aptitude-1.13.45-20.1 zypper-log-1.13.45-20.1 References: https://www.suse.com/security/cve/CVE-2018-7685.html https://bugzilla.suse.com/1036304 https://bugzilla.suse.com/1049825 https://bugzilla.suse.com/1070851 https://bugzilla.suse.com/1076192 https://bugzilla.suse.com/1088705 https://bugzilla.suse.com/1091624 https://bugzilla.suse.com/1092413 https://bugzilla.suse.com/1096803 https://bugzilla.suse.com/1099847 https://bugzilla.suse.com/1100028 https://bugzilla.suse.com/1101349 https://bugzilla.suse.com/1102429

1 0

openSUSE-SU-2018:2880-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 26 Sep '18

26 Sep '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2880-1 Rating: moderate References: #1074186 #1092480 #983440 Cross-References: CVE-2016-5319 CVE-2017-17942 CVE-2018-10779 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-10779: Fixed a heap-based buffer overflow in TIFFWriteScanline() in tif_write.c (bsc#1092480) - CVE-2017-17942: Fixed a heap-based buffer overflow in the function PackBitsEncode in tif_packbits.c. (bsc#1074186) - CVE-2016-5319: Fixed a beap-based buffer overflow in bmp2tiff (bsc#983440) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1056=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-34.1 libtiff5-4.0.9-34.1 libtiff5-debuginfo-4.0.9-34.1 tiff-4.0.9-34.1 tiff-debuginfo-4.0.9-34.1 tiff-debugsource-4.0.9-34.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-34.1 libtiff5-32bit-4.0.9-34.1 libtiff5-debuginfo-32bit-4.0.9-34.1 References: https://www.suse.com/security/cve/CVE-2016-5319.html https://www.suse.com/security/cve/CVE-2017-17942.html https://www.suse.com/security/cve/CVE-2018-10779.html https://bugzilla.suse.com/1074186 https://bugzilla.suse.com/1092480 https://bugzilla.suse.com/983440

1 0

openSUSE-SU-2018:2859-1: moderate: Security update for php5-smarty3
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for php5-smarty3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2859-1 Rating: moderate References: #1108741 Cross-References: CVE-2018-16381 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5-smarty3 fixes the following issues: - CVE-2018-16381: Prevent traversal vulnerability due to insufficient template code sanitization that allowed attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files (bsc#1108741). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1052=1 Package List: - openSUSE Leap 42.3 (noarch): php5-smarty3-3.1.33-5.5.1 php5-smarty3-doc-3.1.33-5.5.1 References: https://www.suse.com/security/cve/CVE-2018-16381.html https://bugzilla.suse.com/1108741

1 0

openSUSE-SU-2018:2856-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2856-1 Rating: moderate References: #1016715 #1104826 Cross-References: CVE-2016-4975 CVE-2016-8743 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715) - CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the "Location" or other outbound header key or value. (bsc#1104826) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1046=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-28.1 apache2-debuginfo-2.4.23-28.1 apache2-debugsource-2.4.23-28.1 apache2-devel-2.4.23-28.1 apache2-event-2.4.23-28.1 apache2-event-debuginfo-2.4.23-28.1 apache2-example-pages-2.4.23-28.1 apache2-prefork-2.4.23-28.1 apache2-prefork-debuginfo-2.4.23-28.1 apache2-utils-2.4.23-28.1 apache2-utils-debuginfo-2.4.23-28.1 apache2-worker-2.4.23-28.1 apache2-worker-debuginfo-2.4.23-28.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-28.1 References: https://www.suse.com/security/cve/CVE-2016-4975.html https://www.suse.com/security/cve/CVE-2016-8743.html https://bugzilla.suse.com/1016715 https://bugzilla.suse.com/1104826

1 0

openSUSE-SU-2018:2855-1: moderate: Security update for nodejs8
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2855-1 Rating: moderate References: #1097158 #1097748 #1105019 Cross-References: CVE-2018-0732 CVE-2018-12115 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nodejs8 to version 8.11.4 fixes the following issues: Security issues fixed: - CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer (bsc#1105019) - Upgrade to OpenSSL 1.0.2p, which fixed: - CVE-2018-0732: Client denial-of-service due to large DH parameter (bsc#1097158) - ECDSA key extraction via local side-channel Other changes made: - Recommend same major version npm package (bsc#1097748) - Fix parallel/test-tls-passphrase.js test to continue to function with older versions of OpenSSL library. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1047=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): nodejs8-8.11.4-lp150.2.6.1 nodejs8-debuginfo-8.11.4-lp150.2.6.1 nodejs8-debugsource-8.11.4-lp150.2.6.1 nodejs8-devel-8.11.4-lp150.2.6.1 npm8-8.11.4-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): nodejs8-docs-8.11.4-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-12115.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097748 https://bugzilla.suse.com/1105019

1 0

openSUSE-SU-2018:2854-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2854-1 Rating: moderate References: #1047002 #1105437 #1105459 #1105460 Cross-References: CVE-2017-10790 CVE-2018-10844 CVE-2018-10845 CVE-2018-10846 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - CVE-2018-10846: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery (bsc#1105460) - CVE-2018-10845: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant (bsc#1105459) - CVE-2018-10844: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls (bsc#1105437) - CVE-2017-10790: The _asn1_check_identifier function in Libtasn1 caused a NULL pointer dereference and crash (bsc#1047002) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1049=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnutls-3.3.27-2.3.1 gnutls-debuginfo-3.3.27-2.3.1 gnutls-debugsource-3.3.27-2.3.1 libgnutls-devel-3.3.27-2.3.1 libgnutls-openssl-devel-3.3.27-2.3.1 libgnutls-openssl27-3.3.27-2.3.1 libgnutls-openssl27-debuginfo-3.3.27-2.3.1 libgnutls28-3.3.27-2.3.1 libgnutls28-debuginfo-3.3.27-2.3.1 libgnutlsxx-devel-3.3.27-2.3.1 libgnutlsxx28-3.3.27-2.3.1 libgnutlsxx28-debuginfo-3.3.27-2.3.1 - openSUSE Leap 42.3 (x86_64): libgnutls-devel-32bit-3.3.27-2.3.1 libgnutls28-32bit-3.3.27-2.3.1 libgnutls28-debuginfo-32bit-3.3.27-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-10790.html https://www.suse.com/security/cve/CVE-2018-10844.html https://www.suse.com/security/cve/CVE-2018-10845.html https://www.suse.com/security/cve/CVE-2018-10846.html https://bugzilla.suse.com/1047002 https://bugzilla.suse.com/1105437 https://bugzilla.suse.com/1105459 https://bugzilla.suse.com/1105460

1 0

openSUSE-SU-2018:2852-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2852-1 Rating: moderate References: #1106914 Cross-References: CVE-2018-16588 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadow fixes the following security issue: - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 (bsc#1106914) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1051=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): shadow-4.5-lp150.6.3.1 shadow-debuginfo-4.5-lp150.6.3.1 shadow-debugsource-4.5-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-16588.html https://bugzilla.suse.com/1106914

1 0

openSUSE-SU-2018:2851-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2851-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1048=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-27.1 gd-debuginfo-2.1.0-27.1 gd-debugsource-2.1.0-27.1 gd-devel-2.1.0-27.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-27.1 gd-debuginfo-32bit-2.1.0-27.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434

1 0

openSUSE-SU-2018:2849-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2849-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1050=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.12.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.12.1 php7-7.2.5-lp150.2.12.1 php7-bcmath-7.2.5-lp150.2.12.1 php7-bcmath-debuginfo-7.2.5-lp150.2.12.1 php7-bz2-7.2.5-lp150.2.12.1 php7-bz2-debuginfo-7.2.5-lp150.2.12.1 php7-calendar-7.2.5-lp150.2.12.1 php7-calendar-debuginfo-7.2.5-lp150.2.12.1 php7-ctype-7.2.5-lp150.2.12.1 php7-ctype-debuginfo-7.2.5-lp150.2.12.1 php7-curl-7.2.5-lp150.2.12.1 php7-curl-debuginfo-7.2.5-lp150.2.12.1 php7-dba-7.2.5-lp150.2.12.1 php7-dba-debuginfo-7.2.5-lp150.2.12.1 php7-debuginfo-7.2.5-lp150.2.12.1 php7-debugsource-7.2.5-lp150.2.12.1 php7-devel-7.2.5-lp150.2.12.1 php7-dom-7.2.5-lp150.2.12.1 php7-dom-debuginfo-7.2.5-lp150.2.12.1 php7-embed-7.2.5-lp150.2.12.1 php7-embed-debuginfo-7.2.5-lp150.2.12.1 php7-enchant-7.2.5-lp150.2.12.1 php7-enchant-debuginfo-7.2.5-lp150.2.12.1 php7-exif-7.2.5-lp150.2.12.1 php7-exif-debuginfo-7.2.5-lp150.2.12.1 php7-fastcgi-7.2.5-lp150.2.12.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.12.1 php7-fileinfo-7.2.5-lp150.2.12.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.12.1 php7-firebird-7.2.5-lp150.2.12.1 php7-firebird-debuginfo-7.2.5-lp150.2.12.1 php7-fpm-7.2.5-lp150.2.12.1 php7-fpm-debuginfo-7.2.5-lp150.2.12.1 php7-ftp-7.2.5-lp150.2.12.1 php7-ftp-debuginfo-7.2.5-lp150.2.12.1 php7-gd-7.2.5-lp150.2.12.1 php7-gd-debuginfo-7.2.5-lp150.2.12.1 php7-gettext-7.2.5-lp150.2.12.1 php7-gettext-debuginfo-7.2.5-lp150.2.12.1 php7-gmp-7.2.5-lp150.2.12.1 php7-gmp-debuginfo-7.2.5-lp150.2.12.1 php7-iconv-7.2.5-lp150.2.12.1 php7-iconv-debuginfo-7.2.5-lp150.2.12.1 php7-intl-7.2.5-lp150.2.12.1 php7-intl-debuginfo-7.2.5-lp150.2.12.1 php7-json-7.2.5-lp150.2.12.1 php7-json-debuginfo-7.2.5-lp150.2.12.1 php7-ldap-7.2.5-lp150.2.12.1 php7-ldap-debuginfo-7.2.5-lp150.2.12.1 php7-mbstring-7.2.5-lp150.2.12.1 php7-mbstring-debuginfo-7.2.5-lp150.2.12.1 php7-mysql-7.2.5-lp150.2.12.1 php7-mysql-debuginfo-7.2.5-lp150.2.12.1 php7-odbc-7.2.5-lp150.2.12.1 php7-odbc-debuginfo-7.2.5-lp150.2.12.1 php7-opcache-7.2.5-lp150.2.12.1 php7-opcache-debuginfo-7.2.5-lp150.2.12.1 php7-openssl-7.2.5-lp150.2.12.1 php7-openssl-debuginfo-7.2.5-lp150.2.12.1 php7-pcntl-7.2.5-lp150.2.12.1 php7-pcntl-debuginfo-7.2.5-lp150.2.12.1 php7-pdo-7.2.5-lp150.2.12.1 php7-pdo-debuginfo-7.2.5-lp150.2.12.1 php7-pgsql-7.2.5-lp150.2.12.1 php7-pgsql-debuginfo-7.2.5-lp150.2.12.1 php7-phar-7.2.5-lp150.2.12.1 php7-phar-debuginfo-7.2.5-lp150.2.12.1 php7-posix-7.2.5-lp150.2.12.1 php7-posix-debuginfo-7.2.5-lp150.2.12.1 php7-readline-7.2.5-lp150.2.12.1 php7-readline-debuginfo-7.2.5-lp150.2.12.1 php7-shmop-7.2.5-lp150.2.12.1 php7-shmop-debuginfo-7.2.5-lp150.2.12.1 php7-snmp-7.2.5-lp150.2.12.1 php7-snmp-debuginfo-7.2.5-lp150.2.12.1 php7-soap-7.2.5-lp150.2.12.1 php7-soap-debuginfo-7.2.5-lp150.2.12.1 php7-sockets-7.2.5-lp150.2.12.1 php7-sockets-debuginfo-7.2.5-lp150.2.12.1 php7-sodium-7.2.5-lp150.2.12.1 php7-sodium-debuginfo-7.2.5-lp150.2.12.1 php7-sqlite-7.2.5-lp150.2.12.1 php7-sqlite-debuginfo-7.2.5-lp150.2.12.1 php7-sysvmsg-7.2.5-lp150.2.12.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.12.1 php7-sysvsem-7.2.5-lp150.2.12.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.12.1 php7-sysvshm-7.2.5-lp150.2.12.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.12.1 php7-tidy-7.2.5-lp150.2.12.1 php7-tidy-debuginfo-7.2.5-lp150.2.12.1 php7-tokenizer-7.2.5-lp150.2.12.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.12.1 php7-wddx-7.2.5-lp150.2.12.1 php7-wddx-debuginfo-7.2.5-lp150.2.12.1 php7-xmlreader-7.2.5-lp150.2.12.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.12.1 php7-xmlrpc-7.2.5-lp150.2.12.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.12.1 php7-xmlwriter-7.2.5-lp150.2.12.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.12.1 php7-xsl-7.2.5-lp150.2.12.1 php7-xsl-debuginfo-7.2.5-lp150.2.12.1 php7-zip-7.2.5-lp150.2.12.1 php7-zip-debuginfo-7.2.5-lp150.2.12.1 php7-zlib-7.2.5-lp150.2.12.1 php7-zlib-debuginfo-7.2.5-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.12.1 php7-pear-Archive_Tar-7.2.5-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434

1 0

openSUSE-SU-2018:2833-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2833-1 Rating: low References: #1108282 #1108283 Cross-References: CVE-2018-16749 CVE-2018-16750 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following security issue: - CVE-2018-16750: Prevent memory leak in the formatIPTCfromBuffer function (bsc#1108283). An earlier update added a change that also fixed this issues that was unknown at the time of release: - CVE-2018-16749: Added missing NULL check in ReadOneJNGImage that allowed an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file (bsc#1108282). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1045=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-108.1 GraphicsMagick-debuginfo-1.3.25-108.1 GraphicsMagick-debugsource-1.3.25-108.1 GraphicsMagick-devel-1.3.25-108.1 libGraphicsMagick++-Q16-12-1.3.25-108.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-108.1 libGraphicsMagick++-devel-1.3.25-108.1 libGraphicsMagick-Q16-3-1.3.25-108.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-108.1 libGraphicsMagick3-config-1.3.25-108.1 libGraphicsMagickWand-Q16-2-1.3.25-108.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-108.1 perl-GraphicsMagick-1.3.25-108.1 perl-GraphicsMagick-debuginfo-1.3.25-108.1 References: https://www.suse.com/security/cve/CVE-2018-16749.html https://www.suse.com/security/cve/CVE-2018-16750.html https://bugzilla.suse.com/1108282 https://bugzilla.suse.com/1108283

1 0

openSUSE-SU-2018:2827-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2827-1 Rating: moderate References: #1108480 Cross-References: CVE-2016-3822 CVE-2018-16554 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jhead fixes the following security issues: - CVE-2016-3822: jhead remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data (bsc#1108480). - CVE-2018-16554: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling (bsc#1108480). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1044=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1044=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1044=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): jhead-3.00-11.1 jhead-debuginfo-3.00-11.1 jhead-debugsource-3.00-11.1 - openSUSE Leap 15.0 (x86_64): jhead-3.00-lp150.3.3.1 jhead-debuginfo-3.00-lp150.3.3.1 jhead-debugsource-3.00-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): jhead-3.00-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2016-3822.html https://www.suse.com/security/cve/CVE-2018-16554.html https://bugzilla.suse.com/1108480

1 0

openSUSE-SU-2018:2820-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2820-1 Rating: moderate References: #1096291 Cross-References: CVE-2018-1000180 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following security issue: - CVE-2018-1000180: Fixed flaw in the Low-level interface to RSA key pair generator. RSA Key Pairs generated in low-level API with added certainty may had less M-R tests than expected (bsc#1096291). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1043=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.60-23.10.1 bouncycastle-javadoc-1.60-23.10.1 References: https://www.suse.com/security/cve/CVE-2018-1000180.html https://bugzilla.suse.com/1096291

1 0

openSUSE-SU-2018:2819-1: moderate: Security update for liblouis
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for liblouis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2819-1 Rating: moderate References: #1095189 #1095825 #1095826 #1095827 #1095945 #1097103 Cross-References: CVE-2018-11440 CVE-2018-11577 CVE-2018-11683 CVE-2018-11684 CVE-2018-11685 CVE-2018-12085 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for liblouis fixes the following issues: Security issues fixed: - CVE-2018-11440: Fixed a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (bsc#1095189) - CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c (bsc#1095945) - CVE-2018-11683: Fixed a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (different vulnerability than CVE-2018-11440) (bsc#1095827) - CVE-2018-11684: Fixed stack-based buffer overflow in the function includeFile() in compileTranslationTable.c (bsc#1095826) - CVE-2018-11685: Fixed a stack-based buffer overflow in the function compileHyphenation() in compileTranslationTable.c (bsc#1095825) - CVE-2018-12085: Fixed a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (different vulnerability than CVE-2018-11440) (bsc#1097103) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1039=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): liblouis-data-2.6.4-9.1 liblouis-debugsource-2.6.4-9.1 liblouis-devel-2.6.4-9.1 liblouis-doc-2.6.4-9.1 liblouis-tools-2.6.4-9.1 liblouis-tools-debuginfo-2.6.4-9.1 liblouis9-2.6.4-9.1 liblouis9-debuginfo-2.6.4-9.1 python-louis-2.6.4-9.1 References: https://www.suse.com/security/cve/CVE-2018-11440.html https://www.suse.com/security/cve/CVE-2018-11577.html https://www.suse.com/security/cve/CVE-2018-11683.html https://www.suse.com/security/cve/CVE-2018-11684.html https://www.suse.com/security/cve/CVE-2018-11685.html https://www.suse.com/security/cve/CVE-2018-12085.html https://bugzilla.suse.com/1095189 https://bugzilla.suse.com/1095825 https://bugzilla.suse.com/1095826 https://bugzilla.suse.com/1095827 https://bugzilla.suse.com/1095945 https://bugzilla.suse.com/1097103

1 0

openSUSE-SU-2018:2818-1: moderate: Security update for gdm
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2818-1 Rating: moderate References: #1081947 #1103093 #1103737 Cross-References: CVE-2018-14424 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gdm provides the following fixes: This security issue was fixed: - CVE-2018-14424: The daemon in GDM did not properly unexport display objects from its D-Bus interface when they are destroyed, which allowed a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution (bsc#1103737) These non-security issues were fixed: - Enable pam_keyinit module (bsc#1081947) - Fix a build race in SLE (bsc#1103093) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1037=1 Package List: - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.3.1 gdm-debuginfo-3.26.2.1-lp150.11.3.1 gdm-debugsource-3.26.2.1-lp150.11.3.1 gdm-devel-3.26.2.1-lp150.11.3.1 libgdm1-3.26.2.1-lp150.11.3.1 libgdm1-debuginfo-3.26.2.1-lp150.11.3.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.3.1 - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.3.1 gdm-lang-3.26.2.1-lp150.11.3.1 gdmflexiserver-3.26.2.1-lp150.11.3.1 References: https://www.suse.com/security/cve/CVE-2018-14424.html https://bugzilla.suse.com/1081947 https://bugzilla.suse.com/1103093 https://bugzilla.suse.com/1103737

1 0

openSUSE-SU-2018:2817-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2817-1 Rating: moderate References: #1107343 #1109363 Cross-References: CVE-2018-12383 CVE-2018-12385 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Mozilla Firefox to version 60.2.1esr fixes the following issues: Security issues fixed (MFSA 2018-23): - CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (boo#1109363) - CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (boo#1107343) Bugx fixed: - Fixed a startup crash affecting users migrating from older ESR releases Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1042=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1042=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.2.1-112.1 MozillaFirefox-branding-upstream-60.2.1-112.1 MozillaFirefox-buildsymbols-60.2.1-112.1 MozillaFirefox-debuginfo-60.2.1-112.1 MozillaFirefox-debugsource-60.2.1-112.1 MozillaFirefox-devel-60.2.1-112.1 MozillaFirefox-translations-common-60.2.1-112.1 MozillaFirefox-translations-other-60.2.1-112.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.2.1-lp150.3.17.1 MozillaFirefox-branding-upstream-60.2.1-lp150.3.17.1 MozillaFirefox-buildsymbols-60.2.1-lp150.3.17.1 MozillaFirefox-debuginfo-60.2.1-lp150.3.17.1 MozillaFirefox-debugsource-60.2.1-lp150.3.17.1 MozillaFirefox-devel-60.2.1-lp150.3.17.1 MozillaFirefox-translations-common-60.2.1-lp150.3.17.1 MozillaFirefox-translations-other-60.2.1-lp150.3.17.1 References: https://www.suse.com/security/cve/CVE-2018-12383.html https://www.suse.com/security/cve/CVE-2018-12385.html https://bugzilla.suse.com/1107343 https://bugzilla.suse.com/1109363

1 0

openSUSE-SU-2018:2816-1: moderate: Security update for nodejs6
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2816-1 Rating: moderate References: #1097158 #1097748 #1105019 Cross-References: CVE-2018-0732 CVE-2018-12115 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nodejs6 to version 6.14.4 fixes the following issues: Security issues fixed: CVE-2018-12115: Fixed an out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (bsc#1105019) CVE-2018-0732: Upgrade to OpenSSL 1.0.2p, fixing a client DoS due to large DH parameter (bsc#1097158) Other issues fixed: - Recommend same major version npm package (bsc#1097748) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1041=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs6-6.14.4-15.1 nodejs6-debuginfo-6.14.4-15.1 nodejs6-debugsource-6.14.4-15.1 nodejs6-devel-6.14.4-15.1 npm6-6.14.4-15.1 - openSUSE Leap 42.3 (noarch): nodejs6-docs-6.14.4-15.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-12115.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097748 https://bugzilla.suse.com/1105019

1 0

openSUSE-SU-2018:2813-1: important: Security update for openslp
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for openslp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2813-1 Rating: important References: #1090638 Cross-References: CVE-2017-17833 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openslp fixes the following issues: - CVE-2017-17833: Prevent heap-related memory corruption issue which may have manifested itself as a denial-of-service or a remote code-execution vulnerability (bsc#1090638) - Prevent out of bounds reads in message parsing This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1040=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): openslp-2.0.0-18.7.1 openslp-debuginfo-2.0.0-18.7.1 openslp-debugsource-2.0.0-18.7.1 openslp-devel-2.0.0-18.7.1 openslp-server-2.0.0-18.7.1 openslp-server-debuginfo-2.0.0-18.7.1 - openSUSE Leap 42.3 (x86_64): openslp-32bit-2.0.0-18.7.1 openslp-debuginfo-32bit-2.0.0-18.7.1 References: https://www.suse.com/security/cve/CVE-2017-17833.html https://bugzilla.suse.com/1090638

1 0

openSUSE-SU-2018:2811-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2811-1 Rating: moderate References: #1102003 #1102004 #1102005 #1102007 #1105592 #1106855 #1106858 Cross-References: CVE-2018-14434 CVE-2018-14435 CVE-2018-14436 CVE-2018-14437 CVE-2018-16323 CVE-2018-16329 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS (bsc#1106858) - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM file that has a negative pixel value. If the affected code was used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data (bsc#1106855) - CVE-2018-14434: Fixed a memory leak for a colormap in WriteMPCImage (bsc#1102003) - CVE-2018-14435: Fixed a memory leak in DecodeImage in coders/pcd.c (bsc#1102007) - CVE-2018-14436: Fixed a memory leak in ReadMIFFImage in coders/miff.c (bsc#1102005) - CVE-2018-14437: Fixed a memory leak in parse8BIM in coders/meta.c (bsc#1102004) - Disable PS, PS2, PS3, XPS and PDF coders in default policy.xml (bsc#1105592) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1038=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-67.1 ImageMagick-debuginfo-6.8.8.1-67.1 ImageMagick-debugsource-6.8.8.1-67.1 ImageMagick-devel-6.8.8.1-67.1 ImageMagick-extra-6.8.8.1-67.1 ImageMagick-extra-debuginfo-6.8.8.1-67.1 libMagick++-6_Q16-3-6.8.8.1-67.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-67.1 libMagick++-devel-6.8.8.1-67.1 libMagickCore-6_Q16-1-6.8.8.1-67.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-67.1 libMagickWand-6_Q16-1-6.8.8.1-67.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-67.1 perl-PerlMagick-6.8.8.1-67.1 perl-PerlMagick-debuginfo-6.8.8.1-67.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-67.1 libMagick++-6_Q16-3-32bit-6.8.8.1-67.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-67.1 libMagick++-devel-32bit-6.8.8.1-67.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-67.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-67.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-67.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-67.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-67.1 References: https://www.suse.com/security/cve/CVE-2018-14434.html https://www.suse.com/security/cve/CVE-2018-14435.html https://www.suse.com/security/cve/CVE-2018-14436.html https://www.suse.com/security/cve/CVE-2018-14437.html https://www.suse.com/security/cve/CVE-2018-16323.html https://www.suse.com/security/cve/CVE-2018-16329.html https://bugzilla.suse.com/1102003 https://bugzilla.suse.com/1102004 https://bugzilla.suse.com/1102005 https://bugzilla.suse.com/1102007 https://bugzilla.suse.com/1105592 https://bugzilla.suse.com/1106855 https://bugzilla.suse.com/1106858

1 0

openSUSE-SU-2018:2801-2: moderate: Security update for obs-service-refresh_patches
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for obs-service-refresh_patches ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2801-2 Rating: moderate References: #1108189 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for obs-service-refresh_patches fixes the following security issue: - An attacker creating a specially formated archive could have tricked the service in deleting directories that shouldn't be deleted (boo#1108189) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1029=1 Package List: - openSUSE Backports SLE-15 (noarch): obs-service-refresh_patches-0.3.9+git.1537184752.d624424-bp150.3.3.1 References: https://bugzilla.suse.com/1108189

1 0

openSUSE-OU-2018:2644-2: moderate: Optional update to add gn
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Optional Update: Optional update to add gn ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2644-2 Rating: moderate References: #1107442 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds gn, a build dependency for an upcoming Chromium update. Gn is a a meta-build system that generates build files for Ninja. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-974=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): gn-0.1463-bp150.2.1 References: https://bugzilla.suse.com/1107442

1 0

openSUSE-SU-2018:2810-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2810-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-883=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python-aubio-debugsource-0.4.6-bp150.3.3.1 python2-aubio-0.4.6-bp150.3.3.1 python2-aubio-debuginfo-0.4.6-bp150.3.3.1 python3-aubio-0.4.6-bp150.3.3.1 python3-aubio-debuginfo-0.4.6-bp150.3.3.1 - openSUSE Backports SLE-15 (x86_64): aubio-tools-0.4.6-bp150.3.3.1 libaubio-devel-0.4.6-bp150.3.3.1 libaubio5-0.4.6-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364

1 0

openSUSE-SU-2018:2723-2: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2723-2 Rating: low References: #1092241 #1100348 #1105869 Cross-References: CVE-2018-13300 CVE-2018-15822 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ffmpeg-4 to version 4.0.2 fixes the following issues: These security issues were fixed: - CVE-2018-15822: The flv_write_packet function did not check for an empty audio packet, leading to an assertion failure and DoS (bsc#1105869). - CVE-2018-13300: An improper argument passed to the avpriv_request_sample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure (bsc#1100348). These non-security issues were fixed: - Enable webvtt encoders and decoders (boo#1092241). - Build codec2 encoder and decoder, add libcodec2 to enable_decoders and enable_encoders. - Enable mpeg 1 and 2 encoders. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1004=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): ffmpeg-4-debugsource-4.0.2-bp150.3.3.1 ffmpeg-4-libavcodec-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libavdevice-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libavfilter-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libavformat-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libavresample-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libavutil-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libpostproc-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libswresample-devel-4.0.2-bp150.3.3.1 ffmpeg-4-libswscale-devel-4.0.2-bp150.3.3.1 ffmpeg-4-private-devel-4.0.2-bp150.3.3.1 libavcodec58-4.0.2-bp150.3.3.1 libavcodec58-debuginfo-4.0.2-bp150.3.3.1 libavdevice58-4.0.2-bp150.3.3.1 libavdevice58-debuginfo-4.0.2-bp150.3.3.1 libavfilter7-4.0.2-bp150.3.3.1 libavfilter7-debuginfo-4.0.2-bp150.3.3.1 libavformat58-4.0.2-bp150.3.3.1 libavformat58-debuginfo-4.0.2-bp150.3.3.1 libavresample4-4.0.2-bp150.3.3.1 libavresample4-debuginfo-4.0.2-bp150.3.3.1 libavutil56-4.0.2-bp150.3.3.1 libavutil56-debuginfo-4.0.2-bp150.3.3.1 libpostproc55-4.0.2-bp150.3.3.1 libpostproc55-debuginfo-4.0.2-bp150.3.3.1 libswresample3-4.0.2-bp150.3.3.1 libswresample3-debuginfo-4.0.2-bp150.3.3.1 libswscale5-4.0.2-bp150.3.3.1 libswscale5-debuginfo-4.0.2-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libavcodec58-64bit-4.0.2-bp150.3.3.1 libavcodec58-64bit-debuginfo-4.0.2-bp150.3.3.1 libavdevice58-64bit-4.0.2-bp150.3.3.1 libavdevice58-64bit-debuginfo-4.0.2-bp150.3.3.1 libavfilter7-64bit-4.0.2-bp150.3.3.1 libavfilter7-64bit-debuginfo-4.0.2-bp150.3.3.1 libavformat58-64bit-4.0.2-bp150.3.3.1 libavformat58-64bit-debuginfo-4.0.2-bp150.3.3.1 libavresample4-64bit-4.0.2-bp150.3.3.1 libavresample4-64bit-debuginfo-4.0.2-bp150.3.3.1 libavutil56-64bit-4.0.2-bp150.3.3.1 libavutil56-64bit-debuginfo-4.0.2-bp150.3.3.1 libpostproc55-64bit-4.0.2-bp150.3.3.1 libpostproc55-64bit-debuginfo-4.0.2-bp150.3.3.1 libswresample3-64bit-4.0.2-bp150.3.3.1 libswresample3-64bit-debuginfo-4.0.2-bp150.3.3.1 libswscale5-64bit-4.0.2-bp150.3.3.1 libswscale5-64bit-debuginfo-4.0.2-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-13300.html https://www.suse.com/security/cve/CVE-2018-15822.html https://bugzilla.suse.com/1092241 https://bugzilla.suse.com/1100348 https://bugzilla.suse.com/1105869

1 0

openSUSE-SU-2018:2809-1: important: Security update for python-Django1
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for python-Django1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2809-1 Rating: important References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django1 to version 1.11.15 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-884=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-Django1-1.11.15-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680

1 0

openSUSE-RU-2018:2430-2: moderate: Recommended update for screenfetch
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for screenfetch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2430-2 Rating: moderate References: #1103527 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for screenfetch to version 3.8.0 fixes the following issues: - Recommend lsb-release as it is needed for correct detection of distribution (boo#1103527) - Require bc to avoid error on startup - Additional Intel GPU checks - document `-w' command in README.mkdn - document `-w' command in manpage - show CPU temperature Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-912=1 Package List: - openSUSE Backports SLE-15 (noarch): screenfetch-3.8.0-bp150.3.5.1 References: https://bugzilla.suse.com/1103527

1 0

openSUSE-SU-2018:2797-2: critical: Security update for hylafax+
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2797-2 Rating: critical References: #1109084 Cross-References: CVE-2018-17141 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hylafax+ fixes the following issues: Security issues fixed in 5.6.1: - CVE-2018-17141: multiple vulnerabilities affecting fax page reception in JPEG format Specially crafted input may have allowed remote execution of arbitrary code (boo#1109084) Additionally, this update also contains all upstream corrections and bugfixes in the 5.6.1 version, including: - fix RFC2047 encoding by notify - add jobcontrol PageSize feature - don't wait forever after +FRH:3 - fix faxmail transition between a message and external types - avoid pagehandling from introducing some unnecessary EOM signals - improve proxy connection error handling and logging - add initial ModemGroup limits feature - pass the user's uid onto the session log file for sent faxes - improve job waits to minimize triggers - add ProxyTaglineFormat and ProxyTSI features Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1027=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): hylafax+-5.6.1-bp150.4.3.1 hylafax+-client-5.6.1-bp150.4.3.1 hylafax+-client-debuginfo-5.6.1-bp150.4.3.1 hylafax+-debuginfo-5.6.1-bp150.4.3.1 hylafax+-debugsource-5.6.1-bp150.4.3.1 libfaxutil5_6_1-5.6.1-bp150.4.3.1 libfaxutil5_6_1-debuginfo-5.6.1-bp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-17141.html https://bugzilla.suse.com/1109084

1 0

openSUSE-SU-2018:2664-2: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2664-2 Rating: important References: #1106341 #1107235 Cross-References: CVE-2017-15430 CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 CVE-2018-16079 CVE-2018-16080 CVE-2018-16081 CVE-2018-16082 CVE-2018-16083 CVE-2018-16084 CVE-2018-16085 CVE-2018-16086 CVE-2018-16087 CVE-2018-16088 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for Chromium to version 69.0.3497.81 fixes multiple issues. Security issues fixed (boo#1107235): - CVE-2018-16065: Out of bounds write in V8 - CVE-2018-16066:Out of bounds read in Blink - CVE-2018-16067: Out of bounds read in WebAudio - CVE-2018-16068: Out of bounds write in Mojo - CVE-2018-16069:Out of bounds read in SwiftShader - CVE-2018-16070: Integer overflow in Skia - CVE-2018-16071: Use after free in WebRTC - CVE-2018-16073: Site Isolation bypass after tab restore - CVE-2018-16074: Site Isolation bypass using Blob URLS - Out of bounds read in Little-CMS - CVE-2018-16075: Local file access in Blink - CVE-2018-16076: Out of bounds read in PDFium - CVE-2018-16077: Content security policy bypass in Blink - CVE-2018-16078: Credit card information leak in Autofill - CVE-2018-16079: URL spoof in permission dialogs - CVE-2018-16080: URL spoof in full screen mode - CVE-2018-16081: Local file access in DevTools - CVE-2018-16082: Stack buffer overflow in SwiftShader - CVE-2018-16083: Out of bounds read in WebRTC - CVE-2018-16084: User confirmation bypass in external protocol handling - CVE-2018-16085: Use after free in Memory Instrumentation - CVE-2017-15430: Unsafe navigation in Chromecast (boo#1106341) - CVE-2018-16086: Script injection in New Tab Page - CVE-2018-16087: Multiple download restriction bypass - CVE-2018-16088: User gesture requirement bypass The re2 regular expression library was updated to the current version 2018-09-01. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-979=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libre2-0-20180901-bp150.3.3.1 libre2-0-debuginfo-20180901-bp150.3.3.1 re2-debugsource-20180901-bp150.3.3.1 re2-devel-20180901-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-69.0.3497.81-bp150.2.4.1 chromedriver-debuginfo-69.0.3497.81-bp150.2.4.1 chromium-69.0.3497.81-bp150.2.4.1 chromium-debuginfo-69.0.3497.81-bp150.2.4.1 chromium-debugsource-69.0.3497.81-bp150.2.4.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libre2-0-64bit-20180901-bp150.3.3.1 libre2-0-64bit-debuginfo-20180901-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-15430.html https://www.suse.com/security/cve/CVE-2018-16065.html https://www.suse.com/security/cve/CVE-2018-16066.html https://www.suse.com/security/cve/CVE-2018-16067.html https://www.suse.com/security/cve/CVE-2018-16068.html https://www.suse.com/security/cve/CVE-2018-16069.html https://www.suse.com/security/cve/CVE-2018-16070.html https://www.suse.com/security/cve/CVE-2018-16071.html https://www.suse.com/security/cve/CVE-2018-16073.html https://www.suse.com/security/cve/CVE-2018-16074.html https://www.suse.com/security/cve/CVE-2018-16075.html https://www.suse.com/security/cve/CVE-2018-16076.html https://www.suse.com/security/cve/CVE-2018-16077.html https://www.suse.com/security/cve/CVE-2018-16078.html https://www.suse.com/security/cve/CVE-2018-16079.html https://www.suse.com/security/cve/CVE-2018-16080.html https://www.suse.com/security/cve/CVE-2018-16081.html https://www.suse.com/security/cve/CVE-2018-16082.html https://www.suse.com/security/cve/CVE-2018-16083.html https://www.suse.com/security/cve/CVE-2018-16084.html https://www.suse.com/security/cve/CVE-2018-16085.html https://www.suse.com/security/cve/CVE-2018-16086.html https://www.suse.com/security/cve/CVE-2018-16087.html https://www.suse.com/security/cve/CVE-2018-16088.html https://bugzilla.suse.com/1106341 https://bugzilla.suse.com/1107235

1 0

openSUSE-RU-2018:2614-2: moderate: Recommended update for transactional-update
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for transactional-update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2614-2 Rating: moderate References: #1104452 #1105992 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for transactional-update fixes the following issues: The following bugs were fixed in 2.6: - /var/lib/zypp might have been reported as not being a directory, create if not available (boo#1104452) - zypper output was not parsed with sufficient robustness (boo#1105992) The following functionality was added or updated: - --interactive and --non-interactive options to change the default interactivity for zypper calls. - Add kured reboot support - trancactional-update-helper was replaced by zypper options Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-963=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): transactional-update-2.6-bp150.2.3.1 transactional-update-debuginfo-2.6-bp150.2.3.1 transactional-update-debugsource-2.6-bp150.2.3.1 References: https://bugzilla.suse.com/1104452 https://bugzilla.suse.com/1105992

1 0

openSUSE-SU-2018:2516-2: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2516-2 Rating: important References: #1105592 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - Disable PS, PS2, PS3 and PDF coders by default, remove gs calls from delegates.mgk (boo#1105592) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-937=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.3.1 GraphicsMagick-debuginfo-1.3.29-bp150.2.3.1 GraphicsMagick-debugsource-1.3.29-bp150.2.3.1 GraphicsMagick-devel-1.3.29-bp150.2.3.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.3.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-bp150.2.3.1 libGraphicsMagick++-devel-1.3.29-bp150.2.3.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-bp150.2.3.1 libGraphicsMagick3-config-1.3.29-bp150.2.3.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-bp150.2.3.1 perl-GraphicsMagick-1.3.29-bp150.2.3.1 perl-GraphicsMagick-debuginfo-1.3.29-bp150.2.3.1 References: https://bugzilla.suse.com/1105592

1 0

openSUSE-SU-2018:2742-2: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2742-2 Rating: low References: #1107604 #1107609 Cross-References: CVE-2018-16644 CVE-2018-16645 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1020=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.6.1 GraphicsMagick-debuginfo-1.3.29-bp150.2.6.1 GraphicsMagick-debugsource-1.3.29-bp150.2.6.1 GraphicsMagick-devel-1.3.29-bp150.2.6.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.6.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-bp150.2.6.1 libGraphicsMagick++-devel-1.3.29-bp150.2.6.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.6.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-bp150.2.6.1 libGraphicsMagick3-config-1.3.29-bp150.2.6.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.6.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-bp150.2.6.1 perl-GraphicsMagick-1.3.29-bp150.2.6.1 perl-GraphicsMagick-debuginfo-1.3.29-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-16645.html https://bugzilla.suse.com/1107604 https://bugzilla.suse.com/1107609

1 0

openSUSE-SU-2018:2728-2: moderate: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2728-2 Rating: moderate References: #1108114 #1108175 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.92 fixes the following issues: Security issues fixed ((boo#1108114): - Function signature mismatch in WebAssembly - URL Spoofing in Omnibox The following tracked packaging issues were fixed: - the chromium package incorrectly provied swiftshader resolvables (boo#1108175) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1005=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-69.0.3497.92-bp150.2.7.1 chromedriver-debuginfo-69.0.3497.92-bp150.2.7.1 chromium-69.0.3497.92-bp150.2.7.1 chromium-debuginfo-69.0.3497.92-bp150.2.7.1 chromium-debugsource-69.0.3497.92-bp150.2.7.1 References: https://bugzilla.suse.com/1108114 https://bugzilla.suse.com/1108175

1 0

openSUSE-RU-2018:2435-2: Recommended update for powerline
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for powerline ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2435-2 Rating: low References: #1101303 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for powerline fixes the following issues: - powerline intitializaton was not working correctly in vim (boo#10101303) - add correct systemd service for powerline Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-913=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): powerline-2.6-bp150.3.3.1 powerline-debuginfo-2.6-bp150.3.3.1 powerline-debugsource-2.6-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): powerline-docs-2.6-bp150.3.3.1 powerline-fonts-2.6-bp150.3.3.1 tmux-powerline-2.6-bp150.3.3.1 vim-plugin-powerline-2.6-bp150.3.3.1 References: https://bugzilla.suse.com/1101303

1 0

openSUSE-RU-2018:2616-2: moderate: Recommended update for guake
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for guake ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2616-2 Rating: moderate References: #1102963 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for guake fixes the following issues: - guake package did not specify the python3-gobject-Gdk dependency and would fail on start (boo#1102963) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-961=1 Package List: - openSUSE Backports SLE-15 (noarch): guake-3.2.1-bp150.3.4.1 References: https://bugzilla.suse.com/1102963

1 0

openSUSE-RU-2018:2611-2: moderate: Recommended update for terminator
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for terminator ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2611-2 Rating: moderate References: #1105830 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for terminator fixes the following issues: - terminator did not correctly specify run-time dependency on python-cairo (boo#1105830) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-962=1 Package List: - openSUSE Backports SLE-15 (noarch): terminator-1.91-bp150.3.3.1 terminator-lang-1.91-bp150.3.3.1 References: https://bugzilla.suse.com/1105830

1 0

openSUSE-SU-2018:2733-2: moderate: Security update for okular
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for okular ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2733-2 Rating: moderate References: #1107591 Cross-References: CVE-2018-1000801 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for okular fixes the following security issue: - CVE-2018-1000801: Prevent directory traversal vulnerability in function unpackDocumentArchive could have resulted in arbitrary file creation via a specially crafted Okular archive (bsc#1107591). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1006=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): okular-17.12.3-bp150.3.3.1 okular-debuginfo-17.12.3-bp150.3.3.1 okular-debugsource-17.12.3-bp150.3.3.1 okular-devel-17.12.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): okular-lang-17.12.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000801.html https://bugzilla.suse.com/1107591

1 0

openSUSE-RU-2018:2802-2: moderate: Recommended update for youtube-dl
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for youtube-dl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2802-2 Rating: moderate References: #1108712 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for youtube-dl fixes the following issues: - fixes for a number of video sites, including: ARD Mediathek Beta, chrunchyroll, YouTube, IMDB and others (boo#1108712) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1028=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-youtube-dl-2018.09.08-bp150.3.3.1 python3-youtube-dl-2018.09.08-bp150.3.3.1 youtube-dl-2018.09.08-bp150.3.3.1 References: https://bugzilla.suse.com/1108712

1 0

openSUSE-RU-2018:2808-1: moderate: Recommended update for bleachbit
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for bleachbit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2808-1 Rating: moderate References: #1104093 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bleachbit fixes the following issues: - Add missing runtime dependency on python-xml (boo#1104093). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-881=1 Package List: - openSUSE Backports SLE-15 (noarch): bleachbit-2.0-bp150.3.3.1 bleachbit-lang-2.0-bp150.3.3.1 References: https://bugzilla.suse.com/1104093

1 0

openSUSE-SU-2018:2807-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2807-1 Rating: important References: #1020631 #1062195 #1076907 #1077291 #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-5156 CVE-2018-5188 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr (boo#1098998). Security issues fixed with MFSA 2018-16 (boo#1098998): * CVE-2018-12359: Buffer overflow using computed size of canvas element * CVE-2018-12360: Use-after-free when using focus() * CVE-2018-12362: Integer overflow in SSSE3 scaler * CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture * CVE-2018-12363: Use-after-free when appending DOM nodes * CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins * CVE-2018-12365: Compromised IPC child process can list local filenames * CVE-2018-12366: Invalid data handling during QCMS transformations * CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Localizations finally included again (boo#1062195) Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with Update to Seamonkey 2.49.2 * Gecko 52.6esr (including security relevant fixes) (boo#1077291) * fix issue in Composer * With some themes, the menulist- and history-dropmarker didn't show * Scrollbars didn't show the buttons * WebRTC has been disabled by default. It needs an add-on to enable it per site * The active title bar was not visually emphasized Correct requires and provides handling (boo#1076907) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-873=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): seamonkey-2.49.4-bp150.3.3.1 seamonkey-debuginfo-2.49.4-bp150.3.3.1 seamonkey-debugsource-2.49.4-bp150.3.3.1 seamonkey-translations-common-2.49.4-bp150.3.3.1 seamonkey-translations-other-2.49.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1020631 https://bugzilla.suse.com/1062195 https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1077291 https://bugzilla.suse.com/1098998

1 0

openSUSE-RU-2018:2710-2: moderate: Recommended update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2710-2 Rating: moderate References: #1107771 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply fixes the following issues (boo#1107771): Package: gnuhealth - Adding a dummy executable called 'gnuhealth' with some help text Package: proteus - Update to version 4.2.4 - this update provides fixes for several bugs Package: tryton - Update to version 4.2.17 - this update provides fixes for several bugs Package: trytond - Update to version 4.2.15 - this update provides fixes for several bugs Package: trytond_purchase - Update to version 4.2.6 - this update provides fixes for several bugs Package: trytond_stock_supply - Update to version 4.2.2 - this update provides fixes for several bugs Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1000=1 Package List: - openSUSE Backports SLE-15 (noarch): gnuhealth-3.2.10-bp150.3.3.1 proteus-4.2.4-bp150.2.3.1 tryton-4.2.17-bp150.2.3.1 trytond-4.2.15-bp150.2.3.1 trytond_purchase-4.2.6-bp150.3.3.1 trytond_stock_supply-4.2.2-bp150.3.3.1 References: https://bugzilla.suse.com/1107771

1 0

openSUSE-RU-2018:2661-2: moderate: Recommended update for lastpass-cli
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for lastpass-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2661-2 Rating: moderate References: #1107384 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lastpass-cli fixes the following issues: - lastpass-cli was unable to verify the peer certificate due to a server-side change (boo#1107384) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-987=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): lastpass-cli-1.3.1-bp150.3.3.1 References: https://bugzilla.suse.com/1107384

1 0

openSUSE-RU-2018:2558-2: moderate: Recommended update for datovka, libisds
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for datovka, libisds ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2558-2 Rating: moderate References: #1104620 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for datovka, libisds provides continued functionality with the Czech e-gov communication system (bsc#1104620) Changes in datovka (updated to 4.10.3): - UI changes and fixes - Improved keyboard-based control of main and other dialogue windows. - Improved handling of ISDS error codes - Improved handling of unknown message types Changes in libisds (updated to 0.10.8): - Various memory leaks fixed - Recognise EV8 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-944=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): datovka-4.10.3-bp150.3.3.1 libisds-debugsource-0.10.8-bp150.3.3.1 libisds-devel-0.10.8-bp150.3.3.1 libisds5-0.10.8-bp150.3.3.1 libisds5-debuginfo-0.10.8-bp150.3.3.1 References: https://bugzilla.suse.com/1104620

1 0

openSUSE-RU-2018:2417-2: moderate: Recommended update for libebml
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for libebml ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2417-2 Rating: moderate References: #1104354 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libebml fixes the following issues: Updates libebml to version 1.3.6 Fixes boo#1104354 memory leaks and other issues with undefined behaviour Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-897=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libebml-debugsource-1.3.6-bp150.3.3.1 libebml-devel-1.3.6-bp150.3.3.1 libebml4-1.3.6-bp150.3.3.1 libebml4-debuginfo-1.3.6-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libebml4-64bit-1.3.6-bp150.3.3.1 libebml4-64bit-debuginfo-1.3.6-bp150.3.3.1 References: https://bugzilla.suse.com/1104354

1 0

openSUSE-SU-2018:2525-2: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2525-2 Rating: moderate References: #1105726 Cross-References: CVE-2018-15605 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.3 addresses multiple issues. Security issues fixed: - CVE-2018-15605: vulnerability in the file import feature allowed cross-site scripting via importing a specially-crafted file (PMASA-2018-5, boo#1105726) This update also contains a number of upstream bug fixes in the UI and behavior. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-939=1 Package List: - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.8.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15605.html https://bugzilla.suse.com/1105726

1 0

openSUSE-SU-2018:2521-2: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2521-2 Rating: moderate References: #1105598 Cross-References: CVE-2018-3780 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. (boo#1105598) Other bugs fixed: - Fix highlighting of the upload drop zone - Apply ldapUserFilter on members of group - Make the DELETION of groups match greedy on the groupID - Add parent index to share table - Log full exception in cron instead of only the message - Properly lock the target file on dav upload when not using part files - LDAP backup server should not be queried when auth fails - Fix filenames in sharing integration tests - Lower log level for quota manipulation cases - Let user set avatar in nextcloud if LDAP provides invalid image data - Improved logging of smb connection errors - Allow admin to disable fetching of avatars as well as a specific attribute - Allow to disable encryption - Update message shown when unsharing a file - Fixed English grammatical error on Settings page. - Request a valid property for DAV opendir - Allow updating the token on session regeneration - Prevent lock values from going negative with memcache backend - Correctly handle users with numeric user ids - Correctly parse the subject parameters for link (un)shares of calendars - Fix "parsing" of email-addresses in comments and chat messages - Sanitize parameters in createSessionToken() while logging - Also retry rename operation on InvalidArgumentException - Improve url detection in comments - Only bind to ldap if configuration for the first server is set - Use download manager from PDF.js to download the file - Fix trying to load removed scripts - Only pull for new messages if the session is allowed to be kept alive - Always push object data - Add prioritization for Talk Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-936=1 Package List: - openSUSE Backports SLE-15 (noarch): nextcloud-13.0.5-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1105598

1 0

openSUSE-RU-2018:2490-2: moderate: Recommended update for python-websocket-client
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for python-websocket-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2490-2 Rating: moderate References: #1076519 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-websocket-client fixes the following issues: - The library did not contain a CA bundle and the system CAs had to be manually specified. Make it use the systems ca bundle file by default (boo#1076519) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-916=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-websocket-client-0.44.0-bp150.2.3.1 python3-websocket-client-0.44.0-bp150.2.3.1 References: https://bugzilla.suse.com/1076519

1 0

openSUSE-SU-2018:2806-1: important: Security update for nemo-extensions
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for nemo-extensions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2806-1 Rating: important References: #1084703 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for nemo-extensions fixes the following issues: The following security vulnerability was fixed: - Prevent unprivileged users from adding other users to sambashare (boo#1084703) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-882=1 Package List: - openSUSE Backports SLE-15 (x86_64): nemo-extension-dropbox-3.6.0-bp150.2.3.1 nemo-extension-fileroller-3.6.0-bp150.2.3.1 nemo-extension-gtkhash-3.6.0-bp150.2.3.1 nemo-extension-image-converter-3.6.0-bp150.2.3.1 nemo-extension-preview-3.6.0-bp150.2.3.1 nemo-extension-repairer-3.6.0-bp150.2.3.1 nemo-extension-seahorse-3.6.0-bp150.2.3.1 nemo-extension-share-3.6.0-bp150.2.3.1 python-nemo-3.6.0-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): nemo-extension-audio-tab-3.6.0-bp150.2.3.1 nemo-extension-compare-3.6.0-bp150.2.3.1 nemo-extension-emblems-3.6.0-bp150.2.3.1 nemo-extension-pastebin-3.6.0-bp150.2.3.1 nemo-extension-rabbitvcs-3.6.0-bp150.2.3.1 nemo-extension-terminal-3.6.0-bp150.2.3.1 References: https://bugzilla.suse.com/1084703

1 0

openSUSE-RU-2018:2505-2: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2505-2 Rating: moderate References: #1099674 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update brings spec-cleaner to version 1.1.1, including following fixes and improvements: * Fix help message not working * Make libexecdir opt-in rather than opt-out * Account for LICENCE string not just LICENSE * Warn about direct qmake/meson usage * Use https when mentioning bugzilla in header * Use tuples on some places rather than lists Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-918=1 Package List: - openSUSE Backports SLE-15 (noarch): spec-cleaner-1.1.1-bp150.2.3.1 spec-cleaner-format_spec_file-1.1.1-bp150.2.3.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2018:2526-2: moderate: Recommended update for minetest
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for minetest ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2526-2 Rating: moderate References: #1103904 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for minetest fixes the following issues: - Update to version 0.4.17.1 (bsc#1103904) Many improvements and bug fixes. Please visit the official Wiki page of minetest to see the full changelog: https://dev.minetest.net/Changelog#0.4.17_.E2.86.92_0.4.17.1 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-940=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): minetest-0.4.17.1-bp150.2.3.1 minetest-debuginfo-0.4.17.1-bp150.2.3.1 minetest-debugsource-0.4.17.1-bp150.2.3.1 minetestserver-0.4.17.1-bp150.2.3.1 minetestserver-debuginfo-0.4.17.1-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): minetest-data-0.4.17.1-bp150.2.3.1 minetest-game-0.4.17-bp150.3.3.1 minetest-lang-0.4.17.1-bp150.2.3.1 References: https://bugzilla.suse.com/1103904

1 0

openSUSE-OU-2018:2506-2: moderate: Optional update for sddm
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Optional Update: Optional update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2506-2 Rating: moderate References: #1105342 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update for sddm adds the following functionality: * Honor PAM's ambient supplemental groups (boo#1105342) Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-921=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): sddm-0.17.0-bp150.4.3.1 sddm-branding-openSUSE-0.17.0-bp150.4.3.1 sddm-branding-upstream-0.17.0-bp150.4.3.1 sddm-debuginfo-0.17.0-bp150.4.3.1 sddm-debugsource-0.17.0-bp150.4.3.1 References: https://bugzilla.suse.com/1105342

1 0

openSUSE-SU-2018:2488-2: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2488-2 Rating: moderate References: #1102680 Cross-References: CVE-2018-14574 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware (boo#1102680) The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the regex lookup on MariaDB - Fixed a regression where django.template.Template crashed if the template_string argument is lazy - Fixed __regex and __iregex lookups with MySQL - Fixed admin check crash when using a query expression in ModelAdmin.ordering - Fixed admin changelist crash when using a query expression without asc() or desc() in the page’s ordering - Fixed a regression that broke custom template filters that use decorators - Fixed detection of custom URL converters in included pattern - Fixed a regression that added an unnecessary subquery to the GROUP BY clause on MySQL when using a RawSQL annotation - Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+ - Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable - Corrected the import paths that inspectdb generates for django.contrib.postgres fields - Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed - Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-914=1 Package List: - openSUSE Backports SLE-15 (noarch): python3-Django-2.0.8-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-14574.html https://bugzilla.suse.com/1102680

1 0

openSUSE-OU-2018:2805-1: Optional update for python-configargparse
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Optional Update: Optional update for python-configargparse ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:2805-1 Rating: low References: #1106259 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for python-configargparse provides the following changes: - Provide both Python2 and Python3 versions (boo#1106259) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-960=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-configargparse-0.10.0-bp150.3.3.1 python3-configargparse-0.10.0-bp150.3.3.1 References: https://bugzilla.suse.com/1106259

1 0

openSUSE-RU-2018:2619-2: moderate: Recommended update for KDE Plasma
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for KDE Plasma ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2619-2 Rating: moderate References: #1105686 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for KDE Plasma to 5.12.6 contains a number of bug fixes (boo#1105686). Changes in breeze-gtk: - GTK scrollbar behavior to have warp turned off by default Changes in discover: - notifier may have listed more security updates than total updates - make it possible to launch installed applications Changes in kde-user-manager: - Enable anti-aliasing for user avatars Changes in khotkeys5: - Remove verbose debugging statement Changes in kinfocenter5: - Update kinfocenter docbook to 5 Changes in kscreen5: - Desktop scaling was applied twice in Scale Display preview Changes in kscreenlocker: - Minor translation updates Changes in ksysguard5: - Fix leak of pipe FDs in MD RAID code Changes in kwin5: - Do not save kwinrulesrc on every window opening/closing - Update seat's timestamp after waking up screen through double tap Changes in libksysguard5: - Center more column headings Changes in milou5: - Check changed file name before reloading configuration Changes in plasma-nm: - Unquote remote when importing OpenVPN connections Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-970=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): discover-5.12.6-bp150.3.3.1 discover-debuginfo-5.12.6-bp150.3.3.1 discover-debugsource-5.12.6-bp150.3.3.1 discover-plasmoid-5.12.6-bp150.3.3.1 discover-plasmoid-debuginfo-5.12.6-bp150.3.3.1 kde-user-manager-5.12.6-bp150.3.3.1 kde-user-manager-debuginfo-5.12.6-bp150.3.3.1 kde-user-manager-debugsource-5.12.6-bp150.3.3.1 khotkeys5-5.12.6-bp150.3.3.1 khotkeys5-debuginfo-5.12.6-bp150.3.3.1 khotkeys5-debugsource-5.12.6-bp150.3.3.1 khotkeys5-devel-5.12.6-bp150.3.3.1 kinfocenter5-5.12.6-bp150.3.3.1 kinfocenter5-debuginfo-5.12.6-bp150.3.3.1 kinfocenter5-debugsource-5.12.6-bp150.3.3.1 kscreen5-5.12.6-bp150.3.3.1 kscreen5-debuginfo-5.12.6-bp150.3.3.1 kscreen5-debugsource-5.12.6-bp150.3.3.1 kscreenlocker-5.12.6-bp150.3.3.1 kscreenlocker-debuginfo-5.12.6-bp150.3.3.1 kscreenlocker-debugsource-5.12.6-bp150.3.3.1 kscreenlocker-devel-5.12.6-bp150.3.3.1 kwin5-5.12.6-bp150.3.3.1 kwin5-debuginfo-5.12.6-bp150.3.3.1 kwin5-debugsource-5.12.6-bp150.3.3.1 kwin5-devel-5.12.6-bp150.3.3.1 libKScreenLocker5-5.12.6-bp150.3.3.1 libKScreenLocker5-debuginfo-5.12.6-bp150.3.3.1 libksysguard5-5.12.6-bp150.3.3.1 libksysguard5-debuginfo-5.12.6-bp150.3.3.1 libksysguard5-debugsource-5.12.6-bp150.3.3.1 libksysguard5-devel-5.12.6-bp150.3.3.1 libksysguard5-helper-5.12.6-bp150.3.3.1 libksysguard5-helper-debuginfo-5.12.6-bp150.3.3.1 metatheme-breeze-common-5.12.6-bp150.3.3.1 milou5-5.12.6-bp150.3.3.1 milou5-debuginfo-5.12.6-bp150.3.3.1 milou5-debugsource-5.12.6-bp150.3.3.1 plasma5-integration-debugsource-5.12.6-bp150.3.3.1 plasma5-integration-plugin-5.12.6-bp150.3.3.1 plasma5-integration-plugin-debuginfo-5.12.6-bp150.3.3.1 plasma5-workspace-5.12.6-bp150.3.3.1 plasma5-workspace-debuginfo-5.12.6-bp150.3.3.1 plasma5-workspace-debugsource-5.12.6-bp150.3.3.1 plasma5-workspace-devel-5.12.6-bp150.3.3.1 plasma5-workspace-libs-5.12.6-bp150.3.3.1 plasma5-workspace-libs-debuginfo-5.12.6-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le x86_64): ksysguard5-5.12.6-bp150.3.3.1 ksysguard5-debuginfo-5.12.6-bp150.3.3.1 ksysguard5-debugsource-5.12.6-bp150.3.3.1 plasma5-desktop-5.12.6-bp150.3.3.1 plasma5-desktop-debuginfo-5.12.6-bp150.3.3.1 plasma5-desktop-debugsource-5.12.6-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libksysguard5-64bit-5.12.6-bp150.3.3.1 libksysguard5-64bit-debuginfo-5.12.6-bp150.3.3.1 libksysguard5-devel-64bit-5.12.6-bp150.3.3.1 plasma5-workspace-libs-64bit-5.12.6-bp150.3.3.1 plasma5-workspace-libs-64bit-debuginfo-5.12.6-bp150.3.3.1 - openSUSE Backports SLE-15 (x86_64): plasma-nm5-5.12.6-bp150.3.3.1 plasma-nm5-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-debugsource-5.12.6-bp150.3.3.1 plasma-nm5-fortisslvpn-5.12.6-bp150.3.3.1 plasma-nm5-fortisslvpn-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-iodine-5.12.6-bp150.3.3.1 plasma-nm5-iodine-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-l2tp-5.12.6-bp150.3.3.1 plasma-nm5-l2tp-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-openconnect-5.12.6-bp150.3.3.1 plasma-nm5-openconnect-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-openswan-5.12.6-bp150.3.3.1 plasma-nm5-openswan-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-openvpn-5.12.6-bp150.3.3.1 plasma-nm5-openvpn-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-pptp-5.12.6-bp150.3.3.1 plasma-nm5-pptp-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-ssh-5.12.6-bp150.3.3.1 plasma-nm5-ssh-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-sstp-5.12.6-bp150.3.3.1 plasma-nm5-sstp-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-strongswan-5.12.6-bp150.3.3.1 plasma-nm5-strongswan-debuginfo-5.12.6-bp150.3.3.1 plasma-nm5-vpnc-5.12.6-bp150.3.3.1 plasma-nm5-vpnc-debuginfo-5.12.6-bp150.3.3.1 plasma5-addons-5.12.6-bp150.3.3.1 plasma5-addons-debuginfo-5.12.6-bp150.3.3.1 plasma5-addons-debugsource-5.12.6-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): discover-lang-5.12.6-bp150.3.3.1 gtk2-metatheme-breeze-5.12.6-bp150.3.3.1 gtk3-metatheme-breeze-5.12.6-bp150.3.3.1 kde-user-manager-lang-5.12.6-bp150.3.3.1 khotkeys5-lang-5.12.6-bp150.3.3.1 kinfocenter5-lang-5.12.6-bp150.3.3.1 kscreen5-lang-5.12.6-bp150.3.3.1 kscreenlocker-lang-5.12.6-bp150.3.3.1 ksysguard5-lang-5.12.6-bp150.3.3.1 kwin5-lang-5.12.6-bp150.3.3.1 libksysguard5-lang-5.12.6-bp150.3.3.1 milou5-lang-5.12.6-bp150.3.3.1 plasma-nm5-lang-5.12.6-bp150.3.3.1 plasma5-addons-lang-5.12.6-bp150.3.3.1 plasma5-desktop-lang-5.12.6-bp150.3.3.1 plasma5-integration-plugin-lang-5.12.6-bp150.3.3.1 plasma5-session-5.12.6-bp150.3.3.1 plasma5-session-wayland-5.12.6-bp150.3.3.1 plasma5-workspace-lang-5.12.6-bp150.3.3.1 References: https://bugzilla.suse.com/1105686

1 0

openSUSE-RU-2018:2432-2: moderate: Recommended update for linphoneqt
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for linphoneqt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2432-2 Rating: moderate References: #1095273 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for linphoneqt fixes the following issues: - some UI elements (buttons, tabs) did not render correctly (boo#1095273) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-905=1 Package List: - openSUSE Backports SLE-15 (x86_64): linphone-4.1.1-bp150.2.3.1 linphone-debuginfo-4.1.1-bp150.2.3.1 linphoneqt-debugsource-4.1.1-bp150.2.3.1 References: https://bugzilla.suse.com/1095273

1 0

openSUSE-RU-2018:2726-2: moderate: Recommended update for tor
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for tor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2726-2 Rating: moderate References: #1094283 #1107847 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tor fixes the following issues: - version update to 0.3.4.8, as the 0.3.2 series is reaching EOL (boo#1107847) - improvements for running in low-power and embedded environments - preliminary changes for new bandwidth measurement system - refine anti-denial-of-service code - controller support and other improvements for v3 onion services This update also contains improved protections against DoS on directory authorities, but due to the nature of the TOR network it is assumed that no directory authorities run the distributed package (boo#1094283). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1013=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): tor-0.3.4.8-bp150.3.3.1 tor-debuginfo-0.3.4.8-bp150.3.3.1 tor-debugsource-0.3.4.8-bp150.3.3.1 References: https://bugzilla.suse.com/1094283 https://bugzilla.suse.com/1107847

1 0

openSUSE-RU-2018:2804-1: moderate: Recommended update for Photini
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for Photini ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2804-1 Rating: moderate References: #1103804 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Photini fixes the following issues: - Add missing runtime dependency on python3-requests (boo#1103804) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-880=1 Package List: - openSUSE Backports SLE-15 (noarch): Photini-2018.5.0-bp150.3.3.1 References: https://bugzilla.suse.com/1103804

1 0

openSUSE-RU-2018:2514-2: Recommended update for kde-l10n
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for kde-l10n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2514-2 Rating: low References: #1103027 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kde-l10n fixes the following issue: * boo#1103027: Kopete was missing localization Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-928=1 Package List: - openSUSE Backports SLE-15 (noarch): kde-l10n-ar-17.08.3-bp150.3.3.1 kde-l10n-ast-17.08.3-bp150.3.3.1 kde-l10n-bg-17.08.3-bp150.3.3.1 kde-l10n-bs-17.08.3-bp150.3.3.1 kde-l10n-ca-17.08.3-bp150.3.3.1 kde-l10n-caValencia-17.08.3-bp150.3.3.1 kde-l10n-cs-17.08.3-bp150.3.3.1 kde-l10n-da-17.08.3-bp150.3.3.1 kde-l10n-da-data-17.08.3-bp150.3.3.1 kde-l10n-da-doc-17.08.3-bp150.3.3.1 kde-l10n-de-17.08.3-bp150.3.3.1 kde-l10n-de-data-17.08.3-bp150.3.3.1 kde-l10n-de-doc-17.08.3-bp150.3.3.1 kde-l10n-el-17.08.3-bp150.3.3.1 kde-l10n-en_GB-17.08.3-bp150.3.3.1 kde-l10n-en_GB-data-17.08.3-bp150.3.3.1 kde-l10n-en_GB-doc-17.08.3-bp150.3.3.1 kde-l10n-eo-17.08.3-bp150.3.3.1 kde-l10n-es-17.08.3-bp150.3.3.1 kde-l10n-es-data-17.08.3-bp150.3.3.1 kde-l10n-es-doc-17.08.3-bp150.3.3.1 kde-l10n-et-17.08.3-bp150.3.3.1 kde-l10n-et-data-17.08.3-bp150.3.3.1 kde-l10n-et-doc-17.08.3-bp150.3.3.1 kde-l10n-eu-17.08.3-bp150.3.3.1 kde-l10n-fa-17.08.3-bp150.3.3.1 kde-l10n-fi-17.08.3-bp150.3.3.1 kde-l10n-fr-17.08.3-bp150.3.3.1 kde-l10n-fr-data-17.08.3-bp150.3.3.1 kde-l10n-fr-doc-17.08.3-bp150.3.3.1 kde-l10n-ga-17.08.3-bp150.3.3.1 kde-l10n-gl-17.08.3-bp150.3.3.1 kde-l10n-he-17.08.3-bp150.3.3.1 kde-l10n-hi-17.08.3-bp150.3.3.1 kde-l10n-hr-17.08.3-bp150.3.3.1 kde-l10n-hu-17.08.3-bp150.3.3.1 kde-l10n-ia-17.08.3-bp150.3.3.1 kde-l10n-id-17.08.3-bp150.3.3.1 kde-l10n-is-17.08.3-bp150.3.3.1 kde-l10n-it-17.08.3-bp150.3.3.1 kde-l10n-it-data-17.08.3-bp150.3.3.1 kde-l10n-it-doc-17.08.3-bp150.3.3.1 kde-l10n-ja-17.08.3-bp150.3.3.1 kde-l10n-kk-17.08.3-bp150.3.3.1 kde-l10n-km-17.08.3-bp150.3.3.1 kde-l10n-ko-17.08.3-bp150.3.3.1 kde-l10n-lt-17.08.3-bp150.3.3.1 kde-l10n-lv-17.08.3-bp150.3.3.1 kde-l10n-mr-17.08.3-bp150.3.3.1 kde-l10n-nb-17.08.3-bp150.3.3.1 kde-l10n-nds-17.08.3-bp150.3.3.1 kde-l10n-nl-17.08.3-bp150.3.3.1 kde-l10n-nl-data-17.08.3-bp150.3.3.1 kde-l10n-nl-doc-17.08.3-bp150.3.3.1 kde-l10n-nn-17.08.3-bp150.3.3.1 kde-l10n-pa-17.08.3-bp150.3.3.1 kde-l10n-pl-17.08.3-bp150.3.3.1 kde-l10n-pl-data-17.08.3-bp150.3.3.1 kde-l10n-pl-doc-17.08.3-bp150.3.3.1 kde-l10n-pt-17.08.3-bp150.3.3.1 kde-l10n-pt_BR-17.08.3-bp150.3.3.1 kde-l10n-pt_BR-data-17.08.3-bp150.3.3.1 kde-l10n-pt_BR-doc-17.08.3-bp150.3.3.1 kde-l10n-ro-17.08.3-bp150.3.3.1 kde-l10n-ru-17.08.3-bp150.3.3.1 kde-l10n-ru-data-17.08.3-bp150.3.3.1 kde-l10n-ru-doc-17.08.3-bp150.3.3.1 kde-l10n-sk-17.08.3-bp150.3.3.1 kde-l10n-sl-17.08.3-bp150.3.3.1 kde-l10n-sr-17.08.3-bp150.3.3.1 kde-l10n-sv-17.08.3-bp150.3.3.1 kde-l10n-sv-data-17.08.3-bp150.3.3.1 kde-l10n-sv-doc-17.08.3-bp150.3.3.1 kde-l10n-tr-17.08.3-bp150.3.3.1 kde-l10n-ug-17.08.3-bp150.3.3.1 kde-l10n-uk-17.08.3-bp150.3.3.1 kde-l10n-uk-data-17.08.3-bp150.3.3.1 kde-l10n-uk-doc-17.08.3-bp150.3.3.1 kde-l10n-wa-17.08.3-bp150.3.3.1 kde-l10n-zh_CN-17.08.3-bp150.3.3.1 kde-l10n-zh_TW-17.08.3-bp150.3.3.1 References: https://bugzilla.suse.com/1103027

1 0

openSUSE-RU-2018:2654-2: moderate: Recommended update for collectl
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for collectl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2654-2 Rating: moderate References: #1106366 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for collectl fixes the following issues: - The collectl daemon did not start reliably (boo#1106366) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-978=1 Package List: - openSUSE Backports SLE-15 (noarch): collectl-4.1.3-bp150.3.3.1 References: https://bugzilla.suse.com/1106366

1 0

openSUSE-SU-2018:2754-2: moderate: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2754-2 Rating: moderate References: #1108774 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.100 fixes the following issues: - Security relevant fixes from internal audits, fuzzing and other initiatives (boo#boo#1108774) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1021=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-69.0.3497.100-bp150.2.10.1 chromedriver-debuginfo-69.0.3497.100-bp150.2.10.1 chromium-69.0.3497.100-bp150.2.10.1 chromium-debuginfo-69.0.3497.100-bp150.2.10.1 chromium-debugsource-69.0.3497.100-bp150.2.10.1 References: https://bugzilla.suse.com/1108774

1 0

openSUSE-RU-2018:2803-1: moderate: Recommended update for fence-agents
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for fence-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2803-1 Rating: moderate References: #1025149 #1049852 #1074000 #1096412 #1097260 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for fence-agents provides the following fix: - fence_compute: Add support for keystone v3 authentication. (boo#1074000, boo#1097260, boo#1096412) - Downgrade some agent-specific dependencies to recommends (boo#1025149) - fencing: include timestamps when logging to STDERR and debug file (boo#1049852) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1036=1 Package List: - openSUSE Leap 42.3 (x86_64): fence-agents-4.0.25+git.1485179354.eb43835-2.6.1 fence-agents-debuginfo-4.0.25+git.1485179354.eb43835-2.6.1 fence-agents-debugsource-4.0.25+git.1485179354.eb43835-2.6.1 fence-agents-devel-4.0.25+git.1485179354.eb43835-2.6.1 References: https://bugzilla.suse.com/1025149 https://bugzilla.suse.com/1049852 https://bugzilla.suse.com/1074000 https://bugzilla.suse.com/1096412 https://bugzilla.suse.com/1097260

1 0

openSUSE-RU-2018:2802-1: moderate: Recommended update for youtube-dl
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for youtube-dl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2802-1 Rating: moderate References: #1108712 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for youtube-dl fixes the following issues: - fixes for a number of video sites, including: ARD Mediathek Beta, chrunchyroll, YouTube, IMDB and others (boo#1108712) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1028=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1028=1 Package List: - openSUSE Leap 42.3 (noarch): python-youtube-dl-2018.09.08-2.3.1 python3-youtube-dl-2018.09.08-2.3.1 youtube-dl-2018.09.08-2.3.1 - openSUSE Leap 15.0 (noarch): python2-youtube-dl-2018.09.08-lp150.2.3.1 python3-youtube-dl-2018.09.08-lp150.2.3.1 youtube-dl-2018.09.08-lp150.2.3.1 References: https://bugzilla.suse.com/1108712

1 0

openSUSE-SU-2018:2801-1: moderate: Security update for obs-service-refresh_patches
by opensuse-security＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Security Update: Security update for obs-service-refresh_patches ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2801-1 Rating: moderate References: #1108189 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for obs-service-refresh_patches fixes the following security issue: - An attacker creating a specially formated archive could have tricked the service in deleting directories that shouldn't be deleted (boo#1108189) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1029=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1029=1 Package List: - openSUSE Leap 42.3 (noarch): obs-service-refresh_patches-0.3.9+git.1537184752.d624424-9.3.1 - openSUSE Leap 15.0 (noarch): obs-service-refresh_patches-0.3.9+git.1537184752.d624424-lp150.2.3.1 References: https://bugzilla.suse.com/1108189

1 0

openSUSE-RU-2018:2800-1: moderate: Recommended update for systemd-rpm-macros
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2800-1 Rating: moderate References: #1104176 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for systemd-rpm-macros fixes the following issues: - Make sure %systemd_post() is called during package removal, and also make it more useful by restoring its original implementation. (boo#1104176) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1034=1 Package List: - openSUSE Leap 42.3 (noarch): systemd-rpm-macros-3-12.1 References: https://bugzilla.suse.com/1104176

1 0

openSUSE-RU-2018:2799-1: moderate: Recommended update for gnome-control-center
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for gnome-control-center ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2799-1 Rating: moderate References: #1078968 #1079320 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gnome-control-center fixes the following issues: - Bugfix: Only manage Wi-Fi devices managed by NetworkManager (boo#1079320) - user-accounts: Remove implicit language setting when a new user navigating the user panel at the first time. (boo#1078968) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1035=1 Package List: - openSUSE Leap 15.0 (noarch): gnome-control-center-lang-3.26.2-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): gnome-control-center-3.26.2-lp150.5.3.1 gnome-control-center-color-3.26.2-lp150.5.3.1 gnome-control-center-debuginfo-3.26.2-lp150.5.3.1 gnome-control-center-debugsource-3.26.2-lp150.5.3.1 gnome-control-center-devel-3.26.2-lp150.5.3.1 gnome-control-center-goa-3.26.2-lp150.5.3.1 gnome-control-center-user-faces-3.26.2-lp150.5.3.1 References: https://bugzilla.suse.com/1078968 https://bugzilla.suse.com/1079320

1 0

openSUSE-RU-2018:2798-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2798-1 Rating: moderate References: #1092384 #1096744 #1101668 #1102935 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for resource-agents provides the following fixes: - Implements the reload operation on the SAPInstance RA. (boo#1096744) - Include the enq_server and enq_replicator on the default service list to be monitored for the new S/4 HANA Enq. Services 2. (boo#1092384) - Improved SAPInstance START profile detection, avoiding the need of setting the START_PROFILE parameter. (boo#1096744) - CTDB: Fix initial probe. (boo#1102935) - CTDB: Fix incorrect db corruption reports. (boo#1101668, boo#1102935) - CTDB: Fix OCF_RESKEY_ctdb_recovery_lock validation. (boo#1102935) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1033=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ldirectord-4.0.1+git.1495055229.643177f1-12.1 resource-agents-4.0.1+git.1495055229.643177f1-12.1 resource-agents-debuginfo-4.0.1+git.1495055229.643177f1-12.1 resource-agents-debugsource-4.0.1+git.1495055229.643177f1-12.1 - openSUSE Leap 42.3 (noarch): monitoring-plugins-metadata-4.0.1+git.1495055229.643177f1-12.1 References: https://bugzilla.suse.com/1092384 https://bugzilla.suse.com/1096744 https://bugzilla.suse.com/1101668 https://bugzilla.suse.com/1102935

1 0

openSUSE-SU-2018:2797-1: critical: Security update for hylafax+
by opensuse-security＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2797-1 Rating: critical References: #1109084 Cross-References: CVE-2018-17141 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hylafax+ fixes the following issues: Security issues fixed in 5.6.1: - CVE-2018-17141: multiple vulnerabilities affecting fax page reception in JPEG format Specially crafted input may have allowed remote execution of arbitrary code (boo#1109084) Additionally, this update also contains all upstream corrections and bugfixes in the 5.6.1 version, including: - fix RFC2047 encoding by notify - add jobcontrol PageSize feature - don't wait forever after +FRH:3 - fix faxmail transition between a message and external types - avoid pagehandling from introducing some unnecessary EOM signals - improve proxy connection error handling and logging - add initial ModemGroup limits feature - pass the user's uid onto the session log file for sent faxes - improve job waits to minimize triggers - add ProxyTaglineFormat and ProxyTSI features Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1027=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1027=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): hylafax+-5.6.1-15.1 hylafax+-client-5.6.1-15.1 hylafax+-client-debuginfo-5.6.1-15.1 hylafax+-debuginfo-5.6.1-15.1 hylafax+-debugsource-5.6.1-15.1 libfaxutil5_6_1-5.6.1-15.1 libfaxutil5_6_1-debuginfo-5.6.1-15.1 - openSUSE Leap 15.0 (x86_64): hylafax+-5.6.1-lp150.5.6.1 hylafax+-client-5.6.1-lp150.5.6.1 hylafax+-client-debuginfo-5.6.1-lp150.5.6.1 hylafax+-debuginfo-5.6.1-lp150.5.6.1 hylafax+-debugsource-5.6.1-lp150.5.6.1 libfaxutil5_6_1-5.6.1-lp150.5.6.1 libfaxutil5_6_1-debuginfo-5.6.1-lp150.5.6.1 References: https://www.suse.com/security/cve/CVE-2018-17141.html https://bugzilla.suse.com/1109084

1 0

openSUSE-RU-2018:2794-1: moderate: Recommended update for python-M2Crypto
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for python-M2Crypto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2794-1 Rating: moderate References: #1072973 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-M2Crypto provides version 0.29.0 and brings many fixes and improvements. For a detailed description, please refer to the changelog. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1032=1 Package List: - openSUSE Leap 42.3 (noarch): python-M2Crypto-doc-0.29.0-12.4.1 - openSUSE Leap 42.3 (x86_64): python-M2Crypto-0.29.0-12.4.1 python-M2Crypto-debuginfo-0.29.0-12.4.1 python-M2Crypto-debugsource-0.29.0-12.4.1 python3-M2Crypto-0.29.0-12.4.1 python3-M2Crypto-debuginfo-0.29.0-12.4.1 References: https://bugzilla.suse.com/1072973

1 0