September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2793-1: moderate: Recommended update for pacemaker
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2793-1 Rating: moderate References: #1009076 #1022807 #1028138 #1035822 #1042054 #1053463 #1054389 #1058844 #1059187 #1066710 #1069468 #1070347 #1074039 #1082883 #1090538 #950128 #980341 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 17 recommended fixes can now be installed. Description: This update for pacemaker provides the following fixes: - attrd: Accept connections only after CIB connection is active. - attrd,crmd: Erase attributes at attrd start-up, not first join. - attrd: Ensure node name is broadcast at start-up. - attrd: Make CIB connection function self-contained. - attrd,stonithd: More efficient regular expression parsing. - attrd: Synchronize attributes held only on own node. - attrd,tools: Avoid memory leaks from use of crm_itoa(). - cib: Broadcasts of cib changes should always pass ACLs check. (bsc#1042054) - crmd: Abort transition whenever the quorum is lost. - crmd: Ack pending operations that were cancelled due to rsc deletion. (bsc#1035822) - crmd: Assert when operation can't be created. - crmd: Write faked failures to CIB whenever possible. - crmd: Do not assert if LRM query fails. - crmd: Do not core dump if remote connection does not exist. - crmd: DC should update stonith fail count before aborting transition. - crmd: Do not abort for v2 diff LRM refresh if actions are pending. - crmd: Eliminate size restriction on node state xpath. - crmd: Hard error if remote start fails due to missing key. - crmd: Improve lrmd failure handling. - crmd,libcrmcommon,libcluster,tools: Handle PID as string properly. - crmd,liblrmd,libcrmcommon: Improve remote node disconnection logs. - crmd: Match only executed down events. - crmd: Quorum gain should always cause new transition. - crmd: Return rich error codes from get_lrm_resource(). - crmd: Scale all cib operation timeouts. - crmd: Scale timeouts with the number of remotes too. - crmd: Validate CIB diffs better. - crm_mon: Make CGI bail out on suspicious arguments. - crm_mon: Overcome crm_system_name no longer influenced with argv. - crm_resource: Ensure waiting for all messages before exiting. - crm_resource: Prevent disconnection from crmd during cleanup. - cts: Adjust pacemaker service on startup to prevent triggering StopWhenUnneeded of corosync service. - Doc: Add documentation for new pcmk_delay_base. (bsc#1074039) - extra: Correct ClusterMon metadata. - fencing: Do not print events twice when stonith_admin --verbose is used. - fencing: Fix a memory leak in stonith_admin --env. - iso8601: strftime needs a fully populated struct tm. (bsc#1058844) - libcib: Always use current values when unpacking config. - libcib: Correctly search for v2 patchset changes. - libcib: Ensure xpath result is not empty. - libcib: Get remoteness correctly from node status. - libcluster,libcrmcommon: Improve BZ2 error messages. - libcrmcluster: Improve error checking when updating node name. - libcrmcluster: Use crm_strdup_printf() instead of calloc(). - libcrmcommon: Make sure async connection callback uses negative error codes. - libcrmcommon: Avoid memory leak when the schema transform is not found. - libcrmcommon: Fix a possible infinite loop in buffer_print. - libcrmcommon: Handle schema versions properly. - libcrmcommon: Improve user lookup messages. - libcrmcommon,liblrmd: Improve remote connection messages. - libcrmcommon,liblrmd,lrmd: Improve messages for failed remote sends. - libcrmcommon,liblrmd,lrmd: Validate PCMK_remote_port. - libcrmcommon,liblrmd: Report meaningful async connection errors. - libcrmcommon: Lower watchdog messages when default. - libcrmcommon,lrmd: Use meaningful error codes when sending remote messages. - libcrmcommon: Return meaningful error codes to connection callbacks. - libcrmcommon,tools: Improve XML write error handling. - libcrmservice: Prevent an infinite loop on a bad DBus reply. - libcrmservice: Avoid memory leak on DBus error. - libcrmservice: Follow LSB standard for header block more strictly. - libcrmservice,pacemakerd: Improve privilege dropping. - libcrmservice: Parse LSB long description correctly. - libcrmservices: Avoid assert for HB resource with no parameters. - liblrmd: Make sure the operation of a remote resource returns if the setup of the key fails. (bsc#1053463) - libpe_status: Always log startup-fencing value. - libpe_status: Fix precedence of operation in meta-attributes. - libpe_status: Limit resource type check to primitives. - libpe_status: Make sure monitors are rescheduled, not reloaded. - libpe_status: Properly detect when nodes should suicide. - libpe_status: Recover after failed demote when appropriate. - libpe_status: Use correct default timeout for probes. - libpe_status: Validate no-quorum-policy=suicide correctly. - libservices: Handle systemd service reloading as OK. (bsc#1059187) - logging: Ensure blackbox gets generated on arithmetic error. - lrmd: Always use most recent remote proxy. - lrmd: Do not reject protocol 1.0 clients. (bsc#1009076) - lrmd: Prevent double free after unregistering stonith device for monitoring. (bsc#1035822) - lrmd: Tweak TLS listener messages. - pacemaker_remote: Warn if TLS key can't be read at start-up. - pacemaker.service: Recommend not to limit tasks. (bsc#1028138, bsc#1066710) - PE: Allow all resources to stop prior to probes completing. - PE: Make sure bare metal remotes are probed as now they can run resources. - PE: Correctly implement pe_order_implies_first_printed. - PE: Detailed resource information should include connection resource state. - PE: Do not re-add a node's default score for each location constraint. - PE: Ensure stop operations occur after stopped remote connections have been brought up. - PE: Ensure unrecoverable remote nodes are fenced even if no resources can run on them. - PE: Exclude resources and nodes from the symmetric_default constraint in some circumstances. - PE: Flag resources that are acting as remote nodes. - PE: Ignore optional unfencing events and report the fencing type. - PE: Improved logging of reasons for stop/restart actions. - pengine: Avoid fence loop for remote nodes. - pengine: Fix a null pointer dereference when unpacking tickets. - pengine: Detect proper clone name at startup. - pengine: Do not ignore permanent master scores at startup. - pengine: Do not keep unique instances on same node. - pengine: Schedule reload and restart in separate transition. - pengine: Handle resource migrating behind a migrating remote connection. - pengine: If ignoring failure, also ignore migration-threshold. - pengine: Improve messages when assigning resources to nodes. - pengine: Make sure calculated resource scores are consistent on different architectures. (bsc#1054389) - pengine: Fix a memory leak when writing graph to file. - pengine: Re-enable unrecoverable remote fencing. - pengine: Reset loss-policy from fence to stop if no fencing. - pengine,tools,libpe_status: Avoid unnecessary use of pe_find_current. - pengine: Use newer Pacemaker Remote terminology. - pengine: Validate more function arguments. - pengine: Fix swapped warning message arguments leading to segfault. (bsc#1090538) - PE: Only allowed nodes need to be considered when ordering resource startup after all recovery. - PE: Only re-trigger unfencing on nodes that ran operations with the old parameters. - PE: Remote connection resources are safe to require only quorum. - PE: Resources are allowed to stop before their state is known everywhere. - PE: Restore the ability to send the transition graph via the disk if it gets too big. - PE: Unfencing: Correctly detect changes to device definitions. - portability: The difference of time_t values is given by difftime(). - RA: ClusterMon: Correctly handle "update" parameter. - RA: NodeUtilization RA is now shipped by resource-agents package. (bsc#1070347) - remote: Allow cluster and remote LRM API versions to diverge. (bsc#1009076) - spec: Make sure shadow package is installed before adding user and group. - spec: Prevent overwriting existing sysconfig files by conditionally running %fillup_only. (bsc#1022807, bsc#980341) - stonith-ng: Add pcmk_delay_base as static base-delay. (bsc#1074039) - stonith-ng: Advertise pcmk_on_action via metadata. - stonith-ng: Avoid double-free of pending-ops in free_device. - stonith-ng: Make fencing-device reappear properly after reenabling. - systemd: Add TasksMax comment to pacemaker_remote unit. (bsc#1028138, bsc#1066710) - systemd unit files: Enable TasksMax=infinity. (bsc#1028138, bsc#1066710) - systemd unit files: Restore DBus dependency. - TE: Don't bump counters when action or synapse is invalid. - tools: Add version options for cibsecret. - tools: Allow crm_resource to be called without arguments. - tools: allow crm_resource to operate on anonymous clones in unknown states. - tools: Do not fail if already at the latest schema in cibadmin --upgrade. - tools: Differentiate trace log level for RAs. - tools: Do not expect reply to failed send. - tools: Ensure the crm_resource data set is initialized. - tools: Ensure that crm_resource works if no command is specified. - tools: Implement clean-up dry-run correctly. - tools: Improve crm_master and crm_standby option handling. - tools: Improve crm_resource help. (bsc#950128) - tools: Add missing break statement in attrd_updater. - tools: Re-enable crm_resource --lifetime option. (bsc#950128) - tools: Set meta_timeout env when crm_resource --force-* executes RA. - tools: Set the correct OCF_RESOURCE_INSTANCE env when crm_resource --force-* executes RA. - tools: Fix a use-after-free error in crm_diff. - tools: Warn if crm_resource --wait is called in mixed-version cluster. - Prevent notify actions from causing --wait to hang. - Install /etc/pacemaker directory for storing authkey file. (bsc#1082883) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro. (bsc#1069468) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1031=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpacemaker-devel-1.1.16-4.3.1 libpacemaker3-1.1.16-4.3.1 libpacemaker3-debuginfo-1.1.16-4.3.1 pacemaker-1.1.16-4.3.1 pacemaker-cli-1.1.16-4.3.1 pacemaker-cli-debuginfo-1.1.16-4.3.1 pacemaker-cts-1.1.16-4.3.1 pacemaker-cts-debuginfo-1.1.16-4.3.1 pacemaker-debuginfo-1.1.16-4.3.1 pacemaker-debugsource-1.1.16-4.3.1 pacemaker-remote-1.1.16-4.3.1 pacemaker-remote-debuginfo-1.1.16-4.3.1 References: https://bugzilla.suse.com/1009076 https://bugzilla.suse.com/1022807 https://bugzilla.suse.com/1028138 https://bugzilla.suse.com/1035822 https://bugzilla.suse.com/1042054 https://bugzilla.suse.com/1053463 https://bugzilla.suse.com/1054389 https://bugzilla.suse.com/1058844 https://bugzilla.suse.com/1059187 https://bugzilla.suse.com/1066710 https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/1070347 https://bugzilla.suse.com/1074039 https://bugzilla.suse.com/1082883 https://bugzilla.suse.com/1090538 https://bugzilla.suse.com/950128 https://bugzilla.suse.com/980341

1 0

openSUSE-SU-2018:2790-1: moderate: Security update for pango
by opensuse-security＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Security Update: Security update for pango ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2790-1 Rating: moderate References: #1103877 Cross-References: CVE-2018-15120 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pango fixes the following issue: Security issue fixed: - CVE-2018-15120: Fixed a denial of service when parsing emoji (bsc#1103877) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1026=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpango-1_0-0-1.40.14-lp150.2.3.1 libpango-1_0-0-debuginfo-1.40.14-lp150.2.3.1 pango-debugsource-1.40.14-lp150.2.3.1 pango-devel-1.40.14-lp150.2.3.1 pango-tools-1.40.14-lp150.2.3.1 pango-tools-debuginfo-1.40.14-lp150.2.3.1 typelib-1_0-Pango-1_0-1.40.14-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libpango-1_0-0-32bit-1.40.14-lp150.2.3.1 libpango-1_0-0-32bit-debuginfo-1.40.14-lp150.2.3.1 pango-devel-32bit-1.40.14-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-15120.html https://bugzilla.suse.com/1103877

1 0

openSUSE-RU-2018:2785-1: important: Recommended update for libzypp, zypper
by maintenance＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Recommended Update: Recommended update for libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2785-1 Rating: important References: #1100095 #1104415 #1108999 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for libzypp, zypper fixes the following issues: - Allow repo commands on transactional-server (boo#1108999) - Drop type application due to poor metadata support (boo#1100095, boo#1104415) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1024=1 Package List: - openSUSE Leap 15.0 (x86_64): libzypp-17.7.0-lp150.2.6.1 libzypp-debuginfo-17.7.0-lp150.2.6.1 libzypp-debugsource-17.7.0-lp150.2.6.1 libzypp-devel-17.7.0-lp150.2.6.1 libzypp-devel-doc-17.7.0-lp150.2.6.1 zypper-1.14.11-lp150.2.6.1 zypper-debuginfo-1.14.11-lp150.2.6.1 zypper-debugsource-1.14.11-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): zypper-aptitude-1.14.11-lp150.2.6.1 zypper-log-1.14.11-lp150.2.6.1 References: https://bugzilla.suse.com/1100095 https://bugzilla.suse.com/1104415 https://bugzilla.suse.com/1108999

1 0

openSUSE-SU-2018:2781-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 21 Sep '18

21 Sep '18

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2781-1 Rating: moderate References: #1101999 #1104169 Cross-References: CVE-2018-12911 CVE-2018-4261 CVE-2018-4262 CVE-2018-4263 CVE-2018-4264 CVE-2018-4265 CVE-2018-4266 CVE-2018-4267 CVE-2018-4270 CVE-2018-4271 CVE-2018-4272 CVE-2018-4273 CVE-2018-4278 CVE-2018-4284 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.20.5 fixes the following issues: Security issue fixed: - CVE-2018-12911: Fix off-by-one in xdg_mime_get_simple_globs (bsc#1101999). - CVE-2018-4261, CVE-2018-4262, CVE-2018-4263, CVE-2018-4264, CVE-2018-4265, CVE-2018-4267, CVE-2018-4272, CVE-2018-4284: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. - CVE-2018-4266: A malicious website may be able to cause a denial of service. A race condition was addressed with additional validation. - CVE-2018-4270, CVE-2018-4271, CVE-2018-4273: Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved input validation. - CVE-2018-4278: A malicious website may exfiltrate audio data cross-origin. Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking. Other bugs fixed: - Fix rendering artifacts in some web sites due to a bug introduced in 2.20.4. - Fix a crash when leaving accelerated compositing mode. - Fix non-deterministic build failure due to missing JavaScriptCore/JSContextRef.h. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1025=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.20.5-lp150.2.6.1 libjavascriptcoregtk-4_0-18-debuginfo-2.20.5-lp150.2.6.1 libwebkit2gtk-4_0-37-2.20.5-lp150.2.6.1 libwebkit2gtk-4_0-37-debuginfo-2.20.5-lp150.2.6.1 typelib-1_0-JavaScriptCore-4_0-2.20.5-lp150.2.6.1 typelib-1_0-WebKit2-4_0-2.20.5-lp150.2.6.1 typelib-1_0-WebKit2WebExtension-4_0-2.20.5-lp150.2.6.1 webkit-jsc-4-2.20.5-lp150.2.6.1 webkit-jsc-4-debuginfo-2.20.5-lp150.2.6.1 webkit2gtk-4_0-injected-bundles-2.20.5-lp150.2.6.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.20.5-lp150.2.6.1 webkit2gtk3-debugsource-2.20.5-lp150.2.6.1 webkit2gtk3-devel-2.20.5-lp150.2.6.1 webkit2gtk3-plugin-process-gtk2-2.20.5-lp150.2.6.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.20.5-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.20.5-lp150.2.6.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.20.5-lp150.2.6.1 libwebkit2gtk-4_0-37-32bit-2.20.5-lp150.2.6.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.20.5-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.20.5-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-12911.html https://www.suse.com/security/cve/CVE-2018-4261.html https://www.suse.com/security/cve/CVE-2018-4262.html https://www.suse.com/security/cve/CVE-2018-4263.html https://www.suse.com/security/cve/CVE-2018-4264.html https://www.suse.com/security/cve/CVE-2018-4265.html https://www.suse.com/security/cve/CVE-2018-4266.html https://www.suse.com/security/cve/CVE-2018-4267.html https://www.suse.com/security/cve/CVE-2018-4270.html https://www.suse.com/security/cve/CVE-2018-4271.html https://www.suse.com/security/cve/CVE-2018-4272.html https://www.suse.com/security/cve/CVE-2018-4273.html https://www.suse.com/security/cve/CVE-2018-4278.html https://www.suse.com/security/cve/CVE-2018-4284.html https://bugzilla.suse.com/1101999 https://bugzilla.suse.com/1104169

1 0

openSUSE-RU-2018:2774-1: moderate: Recommended update for python3-susepubliccloudinfo
by maintenance＠opensuse.org 20 Sep '18

20 Sep '18

openSUSE Recommended Update: Recommended update for python3-susepubliccloudinfo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2774-1 Rating: moderate References: #1103684 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-susepubliccloudinfo fixes the following issues: - Avoid traceback on improper query options. (bsc#1103684) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1023=1 Package List: - openSUSE Leap 15.0 (noarch): python3-susepubliccloudinfo-1.0.4-lp150.2.3.1 python3-susepubliccloudinfo-amazon-1.0.4-lp150.2.3.1 References: https://bugzilla.suse.com/1103684

1 0

openSUSE-SU-2018:2764-1: Security update for exempi
by opensuse-security＠opensuse.org 20 Sep '18

20 Sep '18

openSUSE Security Update: Security update for exempi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2764-1 Rating: low References: #1085583 #1085584 #1085589 Cross-References: CVE-2017-18233 CVE-2017-18236 CVE-2017-18238 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for exempi fixes the following security issue: - CVE-2017-18236: The ASF_Support::ReadHeaderObject function allowed remote attackers to cause a denial of service (infinite loop) via a crafted .asf file (bsc#1085589) - CVE-2017-18233: Prevent integer overflow in the Chunk class that allowed remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file (bsc#1085584) - CVE-2017-18238: The TradQT_Manager::ParseCachedBoxes function allowed remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file (bsc#1085583) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1022=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): exempi-debugsource-2.2.2-6.8.1 exempi-tools-2.2.2-6.8.1 exempi-tools-debuginfo-2.2.2-6.8.1 libexempi-devel-2.2.2-6.8.1 libexempi3-2.2.2-6.8.1 libexempi3-debuginfo-2.2.2-6.8.1 - openSUSE Leap 42.3 (x86_64): libexempi3-32bit-2.2.2-6.8.1 libexempi3-debuginfo-32bit-2.2.2-6.8.1 References: https://www.suse.com/security/cve/CVE-2017-18233.html https://www.suse.com/security/cve/CVE-2017-18236.html https://www.suse.com/security/cve/CVE-2017-18238.html https://bugzilla.suse.com/1085583 https://bugzilla.suse.com/1085584 https://bugzilla.suse.com/1085589

1 0

openSUSE-SU-2018:2754-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 19 Sep '18

19 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2754-1 Rating: moderate References: #1108774 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.100 fixes the following issues: - Security relevant fixes from internal audits, fuzzing and other initiatives (boo#boo#1108774) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1021=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1021=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-69.0.3497.100-174.1 chromedriver-debuginfo-69.0.3497.100-174.1 chromium-69.0.3497.100-174.1 chromium-debuginfo-69.0.3497.100-174.1 chromium-debugsource-69.0.3497.100-174.1 - openSUSE Leap 15.0 (x86_64): chromedriver-69.0.3497.100-lp150.2.16.1 chromedriver-debuginfo-69.0.3497.100-lp150.2.16.1 chromium-69.0.3497.100-lp150.2.16.1 chromium-debuginfo-69.0.3497.100-lp150.2.16.1 chromium-debugsource-69.0.3497.100-lp150.2.16.1 References: https://bugzilla.suse.com/1108774

1 0

openSUSE-SU-2018:2753-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 19 Sep '18

19 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2753-1 Rating: moderate References: #1108774 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.100 fixes the following issues: - Security relevant fixes from internal audits, fuzzing and other initiatives (boo#boo#1108774) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1021=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-69.0.3497.100-71.1 chromedriver-debuginfo-69.0.3497.100-71.1 chromium-69.0.3497.100-71.1 chromium-debuginfo-69.0.3497.100-71.1 chromium-debugsource-69.0.3497.100-71.1 References: https://bugzilla.suse.com/1108774

1 0

openSUSE-SU-2018:2742-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 17 Sep '18

17 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2742-1 Rating: low References: #1107604 #1107609 Cross-References: CVE-2018-16644 CVE-2018-16645 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1020=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1020=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-105.1 GraphicsMagick-debuginfo-1.3.25-105.1 GraphicsMagick-debugsource-1.3.25-105.1 GraphicsMagick-devel-1.3.25-105.1 libGraphicsMagick++-Q16-12-1.3.25-105.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-105.1 libGraphicsMagick++-devel-1.3.25-105.1 libGraphicsMagick-Q16-3-1.3.25-105.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-105.1 libGraphicsMagick3-config-1.3.25-105.1 libGraphicsMagickWand-Q16-2-1.3.25-105.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-105.1 perl-GraphicsMagick-1.3.25-105.1 perl-GraphicsMagick-debuginfo-1.3.25-105.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.12.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.12.1 GraphicsMagick-debugsource-1.3.29-lp150.3.12.1 GraphicsMagick-devel-1.3.29-lp150.3.12.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.12.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.12.1 libGraphicsMagick++-devel-1.3.29-lp150.3.12.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.12.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.12.1 libGraphicsMagick3-config-1.3.29-lp150.3.12.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.12.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.12.1 perl-GraphicsMagick-1.3.29-lp150.3.12.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.12.1 References: https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-16645.html https://bugzilla.suse.com/1107604 https://bugzilla.suse.com/1107609

1 0

openSUSE-SU-2018:2741-1: important: Security update for zsh
by opensuse-security＠opensuse.org 17 Sep '18

17 Sep '18

openSUSE Security Update: Security update for zsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2741-1 Rating: important References: #1107294 #1107296 Cross-References: CVE-2018-0502 CVE-2018-13259 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for zsh to version 5.6 fixes the following security issues: - CVE-2018-0502: The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line (bsc#1107296). - CVE-2018-13259: Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one (bsc#1107294). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1018=1 Package List: - openSUSE Leap 15.0 (x86_64): zsh-5.6-lp150.2.6.1 zsh-debuginfo-5.6-lp150.2.6.1 zsh-debugsource-5.6-lp150.2.6.1 zsh-htmldoc-5.6-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-0502.html https://www.suse.com/security/cve/CVE-2018-13259.html https://bugzilla.suse.com/1107294 https://bugzilla.suse.com/1107296

1 0