September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2730-1: important: Security update for spice-gtk
by opensuse-security＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Security Update: Security update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2730-1 Rating: important References: #1101295 #1101420 #1104448 Cross-References: CVE-2018-10873 CVE-2018-10893 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for spice-gtk fixes the following issues: Security issues fixed: - CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448) - CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295) Other bugs fixed: - Add setuid bit to spice-client-glib-usb-acl-helper (bsc#1101420) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1015=1 Package List: - openSUSE Leap 15.0 (x86_64): libspice-client-glib-2_0-8-0.34-lp150.2.3.1 libspice-client-glib-2_0-8-debuginfo-0.34-lp150.2.3.1 libspice-client-glib-helper-0.34-lp150.2.3.1 libspice-client-glib-helper-debuginfo-0.34-lp150.2.3.1 libspice-client-gtk-3_0-5-0.34-lp150.2.3.1 libspice-client-gtk-3_0-5-debuginfo-0.34-lp150.2.3.1 libspice-controller0-0.34-lp150.2.3.1 libspice-controller0-debuginfo-0.34-lp150.2.3.1 spice-gtk-0.34-lp150.2.3.1 spice-gtk-debuginfo-0.34-lp150.2.3.1 spice-gtk-debugsource-0.34-lp150.2.3.1 spice-gtk-devel-0.34-lp150.2.3.1 typelib-1_0-SpiceClientGlib-2_0-0.34-lp150.2.3.1 typelib-1_0-SpiceClientGtk-3_0-0.34-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): spice-gtk-lang-0.34-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10873.html https://www.suse.com/security/cve/CVE-2018-10893.html https://bugzilla.suse.com/1101295 https://bugzilla.suse.com/1101420 https://bugzilla.suse.com/1104448

1 0

openSUSE-RU-2018:2729-1: moderate: Recommended update for tor
by maintenance＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Recommended Update: Recommended update for tor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2729-1 Rating: moderate References: #1094283 #1107847 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tor fixes the following issues: - version update to 0.3.4.8, as the 0.3.2 series is reaching EOL (boo#1107847) - improvements for running in low-power and embedded environments - preliminary changes for new bandwidth measurement system - refine anti-denial-of-service code - controller support and other improvements for v3 onion services This update also contains improved protections against DoS on directory authorities, but due to the nature of the TOR network it is assumed that no directory authorities run the distributed package (boo#1094283). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1013=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): tor-0.3.4.8-17.1 tor-debuginfo-0.3.4.8-17.1 tor-debugsource-0.3.4.8-17.1 References: https://bugzilla.suse.com/1094283 https://bugzilla.suse.com/1107847

1 0

openSUSE-SU-2018:2728-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2728-1 Rating: moderate References: #1108114 #1108175 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.92 fixes the following issues: Security issues fixed ((boo#1108114): - Function signature mismatch in WebAssembly - URL Spoofing in Omnibox The following tracked packaging issues were fixed: - the chromium package incorrectly provied swiftshader resolvables (boo#1108175) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1005=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1005=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-69.0.3497.92-171.1 chromedriver-debuginfo-69.0.3497.92-171.1 chromium-69.0.3497.92-171.1 chromium-debuginfo-69.0.3497.92-171.1 chromium-debugsource-69.0.3497.92-171.1 - openSUSE Leap 15.0 (x86_64): chromedriver-69.0.3497.92-lp150.2.13.1 chromedriver-debuginfo-69.0.3497.92-lp150.2.13.1 chromium-69.0.3497.92-lp150.2.13.1 chromium-debuginfo-69.0.3497.92-lp150.2.13.1 chromium-debugsource-69.0.3497.92-lp150.2.13.1 References: https://bugzilla.suse.com/1108114 https://bugzilla.suse.com/1108175

1 0

openSUSE-SU-2018:2727-1: moderate: Security update for okular
by opensuse-security＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Security Update: Security update for okular ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2727-1 Rating: moderate References: #1107591 Cross-References: CVE-2018-1000801 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for okular fixes the following security issue: - CVE-2018-1000801: Prevent directory traversal vulnerability in function unpackDocumentArchive could have resulted in arbitrary file creation via a specially crafted Okular archive (bsc#1107591). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1006=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): okular-17.04.2-11.1 okular-debuginfo-17.04.2-11.1 okular-debugsource-17.04.2-11.1 okular-devel-17.04.2-11.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): okular-lang-17.04.2-11.1 References: https://www.suse.com/security/cve/CVE-2018-1000801.html https://bugzilla.suse.com/1107591

1 0

openSUSE-RU-2018:2726-1: moderate: Recommended update for tor
by maintenance＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Recommended Update: Recommended update for tor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2726-1 Rating: moderate References: #1094283 #1107847 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tor fixes the following issues: - version update to 0.3.4.8, as the 0.3.2 series is reaching EOL (boo#1107847) - improvements for running in low-power and embedded environments - preliminary changes for new bandwidth measurement system - refine anti-denial-of-service code - controller support and other improvements for v3 onion services This update also contains improved protections against DoS on directory authorities, but due to the nature of the TOR network it is assumed that no directory authorities run the distributed package (boo#1094283). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1013=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1013=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): tor-0.3.4.8-18.1 tor-debuginfo-0.3.4.8-18.1 tor-debugsource-0.3.4.8-18.1 - openSUSE Leap 15.0 (x86_64): tor-0.3.4.8-lp150.2.3.1 tor-debuginfo-0.3.4.8-lp150.2.3.1 tor-debugsource-0.3.4.8-lp150.2.3.1 References: https://bugzilla.suse.com/1094283 https://bugzilla.suse.com/1107847

1 0

openSUSE-RU-2018:2725-1: moderate: Recommended update for snapper
by maintenance＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Recommended Update: Recommended update for snapper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2725-1 Rating: moderate References: #1051922 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for snapper fixes the following issues: - fixed logging during shutdown of snapperd to avoid core dumps. (bsc#1051922) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1011=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsnapper-devel-0.5.0-2.3.1 libsnapper4-0.5.0-2.3.1 libsnapper4-debuginfo-0.5.0-2.3.1 pam_snapper-0.5.0-2.3.1 pam_snapper-debuginfo-0.5.0-2.3.1 snapper-0.5.0-2.3.1 snapper-debuginfo-0.5.0-2.3.1 snapper-debugsource-0.5.0-2.3.1 - openSUSE Leap 42.3 (noarch): snapper-zypp-plugin-0.5.0-2.3.1 References: https://bugzilla.suse.com/1051922

1 0

openSUSE-SU-2018:2724-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2724-1 Rating: moderate References: #1108114 #1108175 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.92 fixes the following issues: Security issues fixed ((boo#1108114): - Function signature mismatch in WebAssembly - URL Spoofing in Omnibox The following tracked packaging issues were fixed: - the chromium package incorrectly provied swiftshader resolvables (boo#1108175) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-1005=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-69.0.3497.92-68.1 chromedriver-debuginfo-69.0.3497.92-68.1 chromium-69.0.3497.92-68.1 chromium-debuginfo-69.0.3497.92-68.1 chromium-debugsource-69.0.3497.92-68.1 References: https://bugzilla.suse.com/1108114 https://bugzilla.suse.com/1108175

1 0

openSUSE-SU-2018:2723-1: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2723-1 Rating: low References: #1092241 #1100348 #1105869 Cross-References: CVE-2018-13300 CVE-2018-15822 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ffmpeg-4 to version 4.0.2 fixes the following issues: These security issues were fixed: - CVE-2018-15822: The flv_write_packet function did not check for an empty audio packet, leading to an assertion failure and DoS (bsc#1105869). - CVE-2018-13300: An improper argument passed to the avpriv_request_sample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure (bsc#1100348). These non-security issues were fixed: - Enable webvtt encoders and decoders (boo#1092241). - Build codec2 encoder and decoder, add libcodec2 to enable_decoders and enable_encoders. - Enable mpeg 1 and 2 encoders. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1004=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1004=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ffmpeg-4-debugsource-4.0.2-13.1 ffmpeg-4-libavcodec-devel-4.0.2-13.1 ffmpeg-4-libavdevice-devel-4.0.2-13.1 ffmpeg-4-libavfilter-devel-4.0.2-13.1 ffmpeg-4-libavformat-devel-4.0.2-13.1 ffmpeg-4-libavresample-devel-4.0.2-13.1 ffmpeg-4-libavutil-devel-4.0.2-13.1 ffmpeg-4-libpostproc-devel-4.0.2-13.1 ffmpeg-4-libswresample-devel-4.0.2-13.1 ffmpeg-4-libswscale-devel-4.0.2-13.1 ffmpeg-4-private-devel-4.0.2-13.1 libavcodec58-4.0.2-13.1 libavcodec58-debuginfo-4.0.2-13.1 libavdevice58-4.0.2-13.1 libavdevice58-debuginfo-4.0.2-13.1 libavfilter7-4.0.2-13.1 libavfilter7-debuginfo-4.0.2-13.1 libavformat58-4.0.2-13.1 libavformat58-debuginfo-4.0.2-13.1 libavresample4-4.0.2-13.1 libavresample4-debuginfo-4.0.2-13.1 libavutil56-4.0.2-13.1 libavutil56-debuginfo-4.0.2-13.1 libpostproc55-4.0.2-13.1 libpostproc55-debuginfo-4.0.2-13.1 libswresample3-4.0.2-13.1 libswresample3-debuginfo-4.0.2-13.1 libswscale5-4.0.2-13.1 libswscale5-debuginfo-4.0.2-13.1 - openSUSE Leap 42.3 (x86_64): libavcodec58-32bit-4.0.2-13.1 libavcodec58-debuginfo-32bit-4.0.2-13.1 libavdevice58-32bit-4.0.2-13.1 libavdevice58-debuginfo-32bit-4.0.2-13.1 libavfilter7-32bit-4.0.2-13.1 libavfilter7-debuginfo-32bit-4.0.2-13.1 libavformat58-32bit-4.0.2-13.1 libavformat58-debuginfo-32bit-4.0.2-13.1 libavresample4-32bit-4.0.2-13.1 libavresample4-debuginfo-32bit-4.0.2-13.1 libavutil56-32bit-4.0.2-13.1 libavutil56-debuginfo-32bit-4.0.2-13.1 libpostproc55-32bit-4.0.2-13.1 libpostproc55-debuginfo-32bit-4.0.2-13.1 libswresample3-32bit-4.0.2-13.1 libswresample3-debuginfo-32bit-4.0.2-13.1 libswscale5-32bit-4.0.2-13.1 libswscale5-debuginfo-32bit-4.0.2-13.1 - openSUSE Leap 15.0 (x86_64): ffmpeg-4-debugsource-4.0.2-lp150.13.1 ffmpeg-4-libavcodec-devel-4.0.2-lp150.13.1 ffmpeg-4-libavdevice-devel-4.0.2-lp150.13.1 ffmpeg-4-libavfilter-devel-4.0.2-lp150.13.1 ffmpeg-4-libavformat-devel-4.0.2-lp150.13.1 ffmpeg-4-libavresample-devel-4.0.2-lp150.13.1 ffmpeg-4-libavutil-devel-4.0.2-lp150.13.1 ffmpeg-4-libpostproc-devel-4.0.2-lp150.13.1 ffmpeg-4-libswresample-devel-4.0.2-lp150.13.1 ffmpeg-4-libswscale-devel-4.0.2-lp150.13.1 ffmpeg-4-private-devel-4.0.2-lp150.13.1 libavcodec58-4.0.2-lp150.13.1 libavcodec58-debuginfo-4.0.2-lp150.13.1 libavdevice58-4.0.2-lp150.13.1 libavdevice58-debuginfo-4.0.2-lp150.13.1 libavfilter7-4.0.2-lp150.13.1 libavfilter7-debuginfo-4.0.2-lp150.13.1 libavformat58-4.0.2-lp150.13.1 libavformat58-debuginfo-4.0.2-lp150.13.1 libavresample4-4.0.2-lp150.13.1 libavresample4-debuginfo-4.0.2-lp150.13.1 libavutil56-4.0.2-lp150.13.1 libavutil56-debuginfo-4.0.2-lp150.13.1 libpostproc55-4.0.2-lp150.13.1 libpostproc55-debuginfo-4.0.2-lp150.13.1 libswresample3-4.0.2-lp150.13.1 libswresample3-debuginfo-4.0.2-lp150.13.1 libswscale5-4.0.2-lp150.13.1 libswscale5-debuginfo-4.0.2-lp150.13.1 References: https://www.suse.com/security/cve/CVE-2018-13300.html https://www.suse.com/security/cve/CVE-2018-15822.html https://bugzilla.suse.com/1092241 https://bugzilla.suse.com/1100348 https://bugzilla.suse.com/1105869

1 0

openSUSE-RU-2018:2722-1: moderate: Recommended update for patterns-base
by maintenance＠opensuse.org 15 Sep '18

15 Sep '18

openSUSE Recommended Update: Recommended update for patterns-base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2722-1 Rating: moderate References: #1095916 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for patterns-base fixes the following issues: - Moved xfsprogs from the enhanced base pattern to the minimal base pattern and recommends instead of suggests it. (bsc#1095916) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1012=1 Package List: - openSUSE Leap 15.0 (x86_64): patterns-base-32bit-20171206-lp150.15.9.1 patterns-base-apparmor-20171206-lp150.15.9.1 patterns-base-apparmor-32bit-20171206-lp150.15.9.1 patterns-base-apparmor_opt-20171206-lp150.15.9.1 patterns-base-base-20171206-lp150.15.9.1 patterns-base-base-32bit-20171206-lp150.15.9.1 patterns-base-basesystem-20171206-lp150.15.9.1 patterns-base-console-20171206-lp150.15.9.1 patterns-base-documentation-20171206-lp150.15.9.1 patterns-base-enhanced_base-20171206-lp150.15.9.1 patterns-base-enhanced_base-32bit-20171206-lp150.15.9.1 patterns-base-enhanced_base_opt-20171206-lp150.15.9.1 patterns-base-minimal_base-20171206-lp150.15.9.1 patterns-base-minimal_base-32bit-20171206-lp150.15.9.1 patterns-base-sw_management-20171206-lp150.15.9.1 patterns-base-sw_management-32bit-20171206-lp150.15.9.1 patterns-base-transactional_base-20171206-lp150.15.9.1 patterns-base-update_test-20171206-lp150.15.9.1 patterns-base-x11-20171206-lp150.15.9.1 patterns-base-x11-32bit-20171206-lp150.15.9.1 patterns-base-x11_enhanced-20171206-lp150.15.9.1 patterns-base-x11_enhanced-32bit-20171206-lp150.15.9.1 patterns-base-x11_opt-20171206-lp150.15.9.1 References: https://bugzilla.suse.com/1095916

1 0

openSUSE-RU-2018:2721-1: moderate: Recommended update for cluster-glue
by maintenance＠opensuse.org 14 Sep '18

14 Sep '18

openSUSE Recommended Update: Recommended update for cluster-glue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2721-1 Rating: moderate References: #1088656 #1098758 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for cluster-glue fixes the following issues: - Fix: stonith:ibmhmc: Add "managedsyspat" and "password" as supported parameters (bsc#1098758) - external/ec2: Avoid unicode errors and improve performance (bsc#1088656) - external/ec2: Mitigate fence race (bsc#1088656) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1003=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cluster-glue-1.0.12+v1.git.1485976882.03d61cd-2.6.1 cluster-glue-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.6.1 cluster-glue-debugsource-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue-devel-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue-devel-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue2-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue2-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.6.1 stonith-bladehpi-1.0.12+v1.git.1485976882.03d61cd-2.6.1 stonith-bladehpi-debuginfo-1.0.12+v1.git.1485976882.03d61cd-2.6.1 - openSUSE Leap 42.3 (x86_64): libglue-devel-32bit-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue-devel-debuginfo-32bit-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue2-32bit-1.0.12+v1.git.1485976882.03d61cd-2.6.1 libglue2-debuginfo-32bit-1.0.12+v1.git.1485976882.03d61cd-2.6.1 References: https://bugzilla.suse.com/1088656 https://bugzilla.suse.com/1098758

1 0