September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2720-1: moderate: Recommended update for gnome-shell, gnome-shell-extensions
by maintenance＠opensuse.org 14 Sep '18

14 Sep '18

openSUSE Recommended Update: Recommended update for gnome-shell, gnome-shell-extensions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2720-1 Rating: moderate References: #1017412 #1046570 #1102648 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gnome-shell and gnome-shell-extensions provides the following fix: - Fix pixbuf refcount memory leaks on async operations. (bsc#1017412) - Fix a problem that was making only half of the panel visible in some cases. (bsc#1046570) - Hide authentication dialogs while screen is locked (bsc#1102648) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1002=1 Package List: - openSUSE Leap 42.3 (noarch): gnome-shell-classic-3.20.1-10.3.1 gnome-shell-extensions-common-3.20.1-10.3.1 gnome-shell-extensions-common-lang-3.20.1-10.3.1 gnome-shell-lang-3.20.4-16.1 - openSUSE Leap 42.3 (x86_64): gnome-shell-3.20.4-16.1 gnome-shell-browser-plugin-3.20.4-16.1 gnome-shell-browser-plugin-debuginfo-3.20.4-16.1 gnome-shell-calendar-3.20.4-16.1 gnome-shell-calendar-debuginfo-3.20.4-16.1 gnome-shell-debuginfo-3.20.4-16.1 gnome-shell-debugsource-3.20.4-16.1 gnome-shell-devel-3.20.4-16.1 References: https://bugzilla.suse.com/1017412 https://bugzilla.suse.com/1046570 https://bugzilla.suse.com/1102648

1 0

openSUSE-SU-2018:2712-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 14 Sep '18

14 Sep '18

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2712-1 Rating: moderate References: #1086001 #1088004 #1088009 #1107030 Cross-References: CVE-2018-1060 CVE-2018-1061 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for python3 provides the following fixes: These security issues were fixed: - CVE-2018-1061: Prevent catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could have used this flaw to cause denial of service (bsc#1088004). - CVE-2018-1060: Prevent catastrophic backtracking in pop3lib's apop() method. An attacker could have used this flaw to cause denial of service (bsc#1088009). These non-security issues were fixed: - Sort files and directories when creating tarfile archives so that they are created in a more predictable way. (bsc#1086001) - Add -fwrapv to OPTS (bsc#1107030) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1001=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpython3_4m1_0-3.4.6-12.6.1 libpython3_4m1_0-debuginfo-3.4.6-12.6.1 python3-3.4.6-12.6.1 python3-base-3.4.6-12.6.1 python3-base-debuginfo-3.4.6-12.6.1 python3-base-debugsource-3.4.6-12.6.1 python3-curses-3.4.6-12.6.1 python3-curses-debuginfo-3.4.6-12.6.1 python3-dbm-3.4.6-12.6.1 python3-dbm-debuginfo-3.4.6-12.6.1 python3-debuginfo-3.4.6-12.6.1 python3-debugsource-3.4.6-12.6.1 python3-devel-3.4.6-12.6.1 python3-devel-debuginfo-3.4.6-12.6.1 python3-idle-3.4.6-12.6.1 python3-testsuite-3.4.6-12.6.1 python3-testsuite-debuginfo-3.4.6-12.6.1 python3-tk-3.4.6-12.6.1 python3-tk-debuginfo-3.4.6-12.6.1 python3-tools-3.4.6-12.6.1 - openSUSE Leap 42.3 (x86_64): libpython3_4m1_0-32bit-3.4.6-12.6.1 libpython3_4m1_0-debuginfo-32bit-3.4.6-12.6.1 python3-32bit-3.4.6-12.6.1 python3-base-32bit-3.4.6-12.6.1 python3-base-debuginfo-32bit-3.4.6-12.6.1 python3-debuginfo-32bit-3.4.6-12.6.1 - openSUSE Leap 42.3 (noarch): python3-doc-3.4.6-12.6.1 python3-doc-pdf-3.4.6-12.6.1 References: https://www.suse.com/security/cve/CVE-2018-1060.html https://www.suse.com/security/cve/CVE-2018-1061.html https://bugzilla.suse.com/1086001 https://bugzilla.suse.com/1088004 https://bugzilla.suse.com/1088009 https://bugzilla.suse.com/1107030

1 0

openSUSE-RU-2018:2711-1: moderate: Recommended update for firewalld and susefirewall2-to-firewalld
by maintenance＠opensuse.org 14 Sep '18

14 Sep '18

openSUSE Recommended Update: Recommended update for firewalld and susefirewall2-to-firewalld ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2711-1 Rating: moderate References: #1096542 #1098986 #1099698 #1105157 #1105170 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for firewalld and susefirewall2-to-firewalld fixes the following issues: firewalld: - Drop global read permissions from the log file (bsc#1098986) - Add missing ipv6-icmp protocol to UI drop-down list (bsc#1099698) - Fix some untranslated strings in the creation of rich rules and firewall-config. (bsc#1096542) - fw: If failure occurs during startup set state to FAILED. - fw_direct: Avoid log for untracked passthrough queries. - Rich Rule Masquerade inverted source-destination in Forward Chain. - Don't forward interface to zone requests to NM for generated interfaces. - firewall-cmd, firewall-offline-cmd: Add --check-config option. - ipset: Check type when parsing ipset definition. - firewall-config: Add ipv6-icmp to the protocol dropdown box. - core/logger: Remove world-readable bit from logfile. - IPv6 rpfilter: Explicitly allow neighbor solicitation. susefirewall2-to-firewalld: - Do not try to handle unknown iptables chains. - Handle source whitelisting. (bsc#1105157) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-999=1 Package List: - openSUSE Leap 15.0 (noarch): firewall-applet-0.5.4-lp150.2.6.1 firewall-config-0.5.4-lp150.2.6.1 firewall-macros-0.5.4-lp150.2.6.1 firewalld-0.5.4-lp150.2.6.1 firewalld-lang-0.5.4-lp150.2.6.1 python3-firewall-0.5.4-lp150.2.6.1 susefirewall2-to-firewalld-0.0.3-lp150.2.3.1 References: https://bugzilla.suse.com/1096542 https://bugzilla.suse.com/1098986 https://bugzilla.suse.com/1099698 https://bugzilla.suse.com/1105157 https://bugzilla.suse.com/1105170

1 0

openSUSE-RU-2018:2710-1: moderate: Recommended update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply
by maintenance＠opensuse.org 14 Sep '18

14 Sep '18

openSUSE Recommended Update: Recommended update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2710-1 Rating: moderate References: #1107771 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply fixes the following issues (boo#1107771): Package: gnuhealth - Adding a dummy executable called 'gnuhealth' with some help text Package: proteus - Update to version 4.2.4 - this update provides fixes for several bugs Package: tryton - Update to version 4.2.17 - this update provides fixes for several bugs Package: trytond - Update to version 4.2.15 - this update provides fixes for several bugs Package: trytond_purchase - Update to version 4.2.6 - this update provides fixes for several bugs Package: trytond_stock_supply - Update to version 4.2.2 - this update provides fixes for several bugs Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1000=1 Package List: - openSUSE Leap 15.0 (noarch): gnuhealth-3.2.10-lp150.5.10.1 proteus-4.2.4-lp150.2.4.1 tryton-4.2.17-lp150.2.7.1 trytond-4.2.15-lp150.2.12.1 trytond_purchase-4.2.6-lp150.2.4.1 trytond_stock_supply-4.2.2-lp150.2.4.1 References: https://bugzilla.suse.com/1107771

1 0

openSUSE-SU-2018:2695-1: moderate: Security update for compat-openssl098
by opensuse-security＠opensuse.org 12 Sep '18

12 Sep '18

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2695-1 Rating: moderate References: #1087102 #1089039 #1097158 #1097624 #1098592 Cross-References: CVE-2018-0732 CVE-2018-0737 CVE-2018-0739 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for compat-openssl098 fixes the following security issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158) - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039) - CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could have resulted in DoS (bsc#1087102). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-997=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-24.1 libopenssl0_9_8-0.9.8j-24.1 libopenssl0_9_8-debuginfo-0.9.8j-24.1 - openSUSE Leap 42.3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-24.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-24.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-0737.html https://www.suse.com/security/cve/CVE-2018-0739.html https://bugzilla.suse.com/1087102 https://bugzilla.suse.com/1089039 https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097624 https://bugzilla.suse.com/1098592

1 0

openSUSE-SU-2018:2694-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 12 Sep '18

12 Sep '18

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2694-1 Rating: moderate References: #1096984 #1099098 #1103659 #1105466 Cross-References: CVE-2017-9118 CVE-2018-10360 CVE-2018-12882 CVE-2018-14851 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php5 fixes the following issues: The following security issues were fixed: - CVE-2018-10360: Fixed an out-of-bounds read in the do_core_note function in readelf.c in libmagic.a, which allowed remote attackers to cause a denial of service via a crafted ELF file (bsc#1096984) - CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. (bsc#1103659) - CVE-2018-12882: Fixed an use-after-free in exif_read_from_impl in ext/exif/exif.c (bsc#1099098) - CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-998=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-103.1 apache2-mod_php5-debuginfo-5.5.14-103.1 php5-5.5.14-103.1 php5-bcmath-5.5.14-103.1 php5-bcmath-debuginfo-5.5.14-103.1 php5-bz2-5.5.14-103.1 php5-bz2-debuginfo-5.5.14-103.1 php5-calendar-5.5.14-103.1 php5-calendar-debuginfo-5.5.14-103.1 php5-ctype-5.5.14-103.1 php5-ctype-debuginfo-5.5.14-103.1 php5-curl-5.5.14-103.1 php5-curl-debuginfo-5.5.14-103.1 php5-dba-5.5.14-103.1 php5-dba-debuginfo-5.5.14-103.1 php5-debuginfo-5.5.14-103.1 php5-debugsource-5.5.14-103.1 php5-devel-5.5.14-103.1 php5-dom-5.5.14-103.1 php5-dom-debuginfo-5.5.14-103.1 php5-enchant-5.5.14-103.1 php5-enchant-debuginfo-5.5.14-103.1 php5-exif-5.5.14-103.1 php5-exif-debuginfo-5.5.14-103.1 php5-fastcgi-5.5.14-103.1 php5-fastcgi-debuginfo-5.5.14-103.1 php5-fileinfo-5.5.14-103.1 php5-fileinfo-debuginfo-5.5.14-103.1 php5-firebird-5.5.14-103.1 php5-firebird-debuginfo-5.5.14-103.1 php5-fpm-5.5.14-103.1 php5-fpm-debuginfo-5.5.14-103.1 php5-ftp-5.5.14-103.1 php5-ftp-debuginfo-5.5.14-103.1 php5-gd-5.5.14-103.1 php5-gd-debuginfo-5.5.14-103.1 php5-gettext-5.5.14-103.1 php5-gettext-debuginfo-5.5.14-103.1 php5-gmp-5.5.14-103.1 php5-gmp-debuginfo-5.5.14-103.1 php5-iconv-5.5.14-103.1 php5-iconv-debuginfo-5.5.14-103.1 php5-imap-5.5.14-103.1 php5-imap-debuginfo-5.5.14-103.1 php5-intl-5.5.14-103.1 php5-intl-debuginfo-5.5.14-103.1 php5-json-5.5.14-103.1 php5-json-debuginfo-5.5.14-103.1 php5-ldap-5.5.14-103.1 php5-ldap-debuginfo-5.5.14-103.1 php5-mbstring-5.5.14-103.1 php5-mbstring-debuginfo-5.5.14-103.1 php5-mcrypt-5.5.14-103.1 php5-mcrypt-debuginfo-5.5.14-103.1 php5-mssql-5.5.14-103.1 php5-mssql-debuginfo-5.5.14-103.1 php5-mysql-5.5.14-103.1 php5-mysql-debuginfo-5.5.14-103.1 php5-odbc-5.5.14-103.1 php5-odbc-debuginfo-5.5.14-103.1 php5-opcache-5.5.14-103.1 php5-opcache-debuginfo-5.5.14-103.1 php5-openssl-5.5.14-103.1 php5-openssl-debuginfo-5.5.14-103.1 php5-pcntl-5.5.14-103.1 php5-pcntl-debuginfo-5.5.14-103.1 php5-pdo-5.5.14-103.1 php5-pdo-debuginfo-5.5.14-103.1 php5-pgsql-5.5.14-103.1 php5-pgsql-debuginfo-5.5.14-103.1 php5-phar-5.5.14-103.1 php5-phar-debuginfo-5.5.14-103.1 php5-posix-5.5.14-103.1 php5-posix-debuginfo-5.5.14-103.1 php5-pspell-5.5.14-103.1 php5-pspell-debuginfo-5.5.14-103.1 php5-readline-5.5.14-103.1 php5-readline-debuginfo-5.5.14-103.1 php5-shmop-5.5.14-103.1 php5-shmop-debuginfo-5.5.14-103.1 php5-snmp-5.5.14-103.1 php5-snmp-debuginfo-5.5.14-103.1 php5-soap-5.5.14-103.1 php5-soap-debuginfo-5.5.14-103.1 php5-sockets-5.5.14-103.1 php5-sockets-debuginfo-5.5.14-103.1 php5-sqlite-5.5.14-103.1 php5-sqlite-debuginfo-5.5.14-103.1 php5-suhosin-5.5.14-103.1 php5-suhosin-debuginfo-5.5.14-103.1 php5-sysvmsg-5.5.14-103.1 php5-sysvmsg-debuginfo-5.5.14-103.1 php5-sysvsem-5.5.14-103.1 php5-sysvsem-debuginfo-5.5.14-103.1 php5-sysvshm-5.5.14-103.1 php5-sysvshm-debuginfo-5.5.14-103.1 php5-tidy-5.5.14-103.1 php5-tidy-debuginfo-5.5.14-103.1 php5-tokenizer-5.5.14-103.1 php5-tokenizer-debuginfo-5.5.14-103.1 php5-wddx-5.5.14-103.1 php5-wddx-debuginfo-5.5.14-103.1 php5-xmlreader-5.5.14-103.1 php5-xmlreader-debuginfo-5.5.14-103.1 php5-xmlrpc-5.5.14-103.1 php5-xmlrpc-debuginfo-5.5.14-103.1 php5-xmlwriter-5.5.14-103.1 php5-xmlwriter-debuginfo-5.5.14-103.1 php5-xsl-5.5.14-103.1 php5-xsl-debuginfo-5.5.14-103.1 php5-zip-5.5.14-103.1 php5-zip-debuginfo-5.5.14-103.1 php5-zlib-5.5.14-103.1 php5-zlib-debuginfo-5.5.14-103.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-103.1 References: https://www.suse.com/security/cve/CVE-2017-9118.html https://www.suse.com/security/cve/CVE-2018-10360.html https://www.suse.com/security/cve/CVE-2018-12882.html https://www.suse.com/security/cve/CVE-2018-14851.html https://bugzilla.suse.com/1096984 https://bugzilla.suse.com/1099098 https://bugzilla.suse.com/1103659 https://bugzilla.suse.com/1105466

1 0

openSUSE-SU-2018:2693-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 12 Sep '18

12 Sep '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2693-1 Rating: moderate References: #1094898 #1098735 #1102604 #1103628 #1105279 Cross-References: CVE-2018-12617 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for qemu fixes the following issues: This security issue was fixed: - CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735) These non-security issues were fixed: - Allow kvm group access to /dev/sev (bsc#1102604). - Fix for the value used for reduced_phys_bits. Please update the reduced_phys_bits value used on the commandline or in libvirt XML to the value 1 (explicitly set now in QEMU code). (bsc#1103628) - Fix (again) the qemu guest agent udev rule file, which got unfixed in a series of unfortunate events (bsc#1094898 and now bsc#1105279) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-996=1 Package List: - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0-lp150.7.9.1 qemu-seabios-1.11.0-lp150.7.9.1 qemu-sgabios-8-lp150.7.9.1 qemu-vgabios-1.11.0-lp150.7.9.1 - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.9.1 qemu-arm-2.11.2-lp150.7.9.1 qemu-arm-debuginfo-2.11.2-lp150.7.9.1 qemu-block-curl-2.11.2-lp150.7.9.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.9.1 qemu-block-dmg-2.11.2-lp150.7.9.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.9.1 qemu-block-gluster-2.11.2-lp150.7.9.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.9.1 qemu-block-iscsi-2.11.2-lp150.7.9.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.9.1 qemu-block-rbd-2.11.2-lp150.7.9.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.9.1 qemu-block-ssh-2.11.2-lp150.7.9.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.9.1 qemu-debuginfo-2.11.2-lp150.7.9.1 qemu-debugsource-2.11.2-lp150.7.9.1 qemu-extra-2.11.2-lp150.7.9.1 qemu-extra-debuginfo-2.11.2-lp150.7.9.1 qemu-guest-agent-2.11.2-lp150.7.9.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.9.1 qemu-ksm-2.11.2-lp150.7.9.1 qemu-kvm-2.11.2-lp150.7.9.1 qemu-lang-2.11.2-lp150.7.9.1 qemu-linux-user-2.11.2-lp150.7.9.1 qemu-linux-user-debuginfo-2.11.2-lp150.7.9.1 qemu-linux-user-debugsource-2.11.2-lp150.7.9.1 qemu-ppc-2.11.2-lp150.7.9.1 qemu-ppc-debuginfo-2.11.2-lp150.7.9.1 qemu-s390-2.11.2-lp150.7.9.1 qemu-s390-debuginfo-2.11.2-lp150.7.9.1 qemu-testsuite-2.11.2-lp150.7.9.1 qemu-tools-2.11.2-lp150.7.9.1 qemu-tools-debuginfo-2.11.2-lp150.7.9.1 qemu-x86-2.11.2-lp150.7.9.1 qemu-x86-debuginfo-2.11.2-lp150.7.9.1 References: https://www.suse.com/security/cve/CVE-2018-12617.html https://bugzilla.suse.com/1094898 https://bugzilla.suse.com/1098735 https://bugzilla.suse.com/1102604 https://bugzilla.suse.com/1103628 https://bugzilla.suse.com/1105279

1 0

openSUSE-SU-2018:2674-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2674-1 Rating: important References: #1066489 #1107343 Cross-References: CVE-2017-16541 CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update to Mozilla Firefox 60.2.0esr fixes the following issues: Security issues fixed (MFSA 2018-21, boo#1107343): - CVE-2018-12377: Use-after-free in refresh driver timers - CVE-2018-12378: Use-after-free in IndexedDB - CVE-2017-16541: Proxy bypass using automount and autofs (boo#1066489) - CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-995=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-995=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.2.0-109.1 MozillaFirefox-branding-upstream-60.2.0-109.1 MozillaFirefox-buildsymbols-60.2.0-109.1 MozillaFirefox-debuginfo-60.2.0-109.1 MozillaFirefox-debugsource-60.2.0-109.1 MozillaFirefox-devel-60.2.0-109.1 MozillaFirefox-translations-common-60.2.0-109.1 MozillaFirefox-translations-other-60.2.0-109.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.2.0-lp150.3.14.1 MozillaFirefox-branding-upstream-60.2.0-lp150.3.14.1 MozillaFirefox-buildsymbols-60.2.0-lp150.3.14.1 MozillaFirefox-debuginfo-60.2.0-lp150.3.14.1 MozillaFirefox-debugsource-60.2.0-lp150.3.14.1 MozillaFirefox-devel-60.2.0-lp150.3.14.1 MozillaFirefox-translations-common-60.2.0-lp150.3.14.1 MozillaFirefox-translations-other-60.2.0-lp150.3.14.1 References: https://www.suse.com/security/cve/CVE-2017-16541.html https://www.suse.com/security/cve/CVE-2018-12376.html https://www.suse.com/security/cve/CVE-2018-12377.html https://www.suse.com/security/cve/CVE-2018-12378.html https://bugzilla.suse.com/1066489 https://bugzilla.suse.com/1107343

1 0

openSUSE-RU-2018:2673-1: moderate: Recommended update for wireless-regdb
by maintenance＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Recommended Update: Recommended update for wireless-regdb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2673-1 Rating: moderate References: #1106528 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wireless-regdb fixes the following issues: - fix power limit in 5725-5785 GHz rule for France (boo#1106528) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-992=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-992=1 Package List: - openSUSE Leap 42.3 (noarch): wireless-regdb-2018.05.31-5.9.1 - openSUSE Leap 15.0 (noarch): wireless-regdb-2018.05.31-lp150.2.6.1 References: https://bugzilla.suse.com/1106528

1 0

openSUSE-SU-2018:2672-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 08 Sep '18

08 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2672-1 Rating: low References: #1106855 Cross-References: CVE-2018-16323 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following security issue: - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM file that has a negative pixel value. If the affected code was used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data (bsc#1106855). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-993=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-102.1 GraphicsMagick-debuginfo-1.3.25-102.1 GraphicsMagick-debugsource-1.3.25-102.1 GraphicsMagick-devel-1.3.25-102.1 libGraphicsMagick++-Q16-12-1.3.25-102.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-102.1 libGraphicsMagick++-devel-1.3.25-102.1 libGraphicsMagick-Q16-3-1.3.25-102.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-102.1 libGraphicsMagick3-config-1.3.25-102.1 libGraphicsMagickWand-Q16-2-1.3.25-102.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-102.1 perl-GraphicsMagick-1.3.25-102.1 perl-GraphicsMagick-debuginfo-1.3.25-102.1 References: https://www.suse.com/security/cve/CVE-2018-16323.html https://bugzilla.suse.com/1106855

1 0