September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2598-1: important: Security update for spice
by opensuse-security＠opensuse.org 04 Sep '18

04 Sep '18

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2598-1 Rating: important References: #1101295 #1104448 Cross-References: CVE-2018-10873 CVE-2018-10893 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for spice fixes the following issues: Security issues fixed: - CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448) - CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-956=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libspice-server-devel-0.14.0-lp150.3.3.1 libspice-server1-0.14.0-lp150.3.3.1 libspice-server1-debuginfo-0.14.0-lp150.3.3.1 spice-debugsource-0.14.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10873.html https://www.suse.com/security/cve/CVE-2018-10893.html https://bugzilla.suse.com/1101295 https://bugzilla.suse.com/1104448

1 0

openSUSE-SU-2018:2597-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 03 Sep '18

03 Sep '18

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2597-1 Rating: moderate References: #1065363 #1086778 #1097779 Cross-References: CVE-2018-12434 CVE-2018-8970 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libressl to version 2.8.0 fixes the following issues: Security issues fixed: - CVE-2018-12434: Avoid a timing side-channel leak when generating DSA and ECDSA signatures. (boo#1097779) - Reject excessively large primes in DH key generation. - CVE-2018-8970: Fixed a bug in int_x509_param_set_hosts, calling strlen() if name length provided is 0 to match the OpenSSL behaviour. (boo#1086778) - Fixed an out-of-bounds read and crash in DES-fcrypt (boo#1065363) You can find a detailed list of changes [here](https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.8.0-relnotes .txt). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-953=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libcrypto43-2.8.0-11.1 libcrypto43-debuginfo-2.8.0-11.1 libressl-2.8.0-11.1 libressl-debuginfo-2.8.0-11.1 libressl-debugsource-2.8.0-11.1 libressl-devel-2.8.0-11.1 libssl45-2.8.0-11.1 libssl45-debuginfo-2.8.0-11.1 libtls17-2.8.0-11.1 libtls17-debuginfo-2.8.0-11.1 - openSUSE Leap 42.3 (x86_64): libcrypto43-32bit-2.8.0-11.1 libcrypto43-debuginfo-32bit-2.8.0-11.1 libressl-devel-32bit-2.8.0-11.1 libssl45-32bit-2.8.0-11.1 libssl45-debuginfo-32bit-2.8.0-11.1 libtls17-32bit-2.8.0-11.1 libtls17-debuginfo-32bit-2.8.0-11.1 - openSUSE Leap 42.3 (noarch): libressl-devel-doc-2.8.0-11.1 References: https://www.suse.com/security/cve/CVE-2018-12434.html https://www.suse.com/security/cve/CVE-2018-8970.html https://bugzilla.suse.com/1065363 https://bugzilla.suse.com/1086778 https://bugzilla.suse.com/1097779

1 0

openSUSE-SU-2018:2592-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 03 Sep '18

03 Sep '18

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2592-1 Rating: moderate References: #1097779 Cross-References: CVE-2018-12434 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libressl to version 2.8.0 fixes the following issues: Security issues fixed: - CVE-2018-12434: Avoid a timing side-channel leak when generating DSA and ECDSA signatures. (boo#1097779) - Reject excessively large primes in DH key generation. Other bugs fixed: - Fixed a pair of 20+ year-old bugs in X509_NAME_add_entry. - Tighten up checks for various X509_VERIFY_PARAM functions, 'poisoning' parameters so that an unverified certificate cannot be used if it fails verification. - Fixed a potential memory leak on failure in ASN1_item_digest. - Fixed a potential memory alignment crash in asn1_item_combine_free. - Removed unused SSL3_FLAGS_DELAY_CLIENT_FINISHED and SSL3_FLAGS_POP_BUFFER flags in write path, simplifying IO paths. - Removed SSL_OP_TLS_ROLLBACK_BUG buggy client workarounds. - Added const annotations to many existing APIs from OpenSSL, making interoperability easier for downstream applications. - Added a missing bounds check in c2i_ASN1_BIT_STRING. - Removed three remaining single DES cipher suites. - Fixed a potential leak/incorrect return value in DSA signature generation. - Added a blinding value when generating DSA and ECDSA signatures, in order to reduce the possibility of a side-channel attack leaking the private key. - Added ECC constant time scalar multiplication support. - Revised the implementation of RSASSA-PKCS1-v1_5 to match the specification in RFC 8017. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-950=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libcrypto43-2.8.0-lp150.2.3.1 libcrypto43-debuginfo-2.8.0-lp150.2.3.1 libressl-2.8.0-lp150.2.3.1 libressl-debuginfo-2.8.0-lp150.2.3.1 libressl-debugsource-2.8.0-lp150.2.3.1 libressl-devel-2.8.0-lp150.2.3.1 libssl45-2.8.0-lp150.2.3.1 libssl45-debuginfo-2.8.0-lp150.2.3.1 libtls17-2.8.0-lp150.2.3.1 libtls17-debuginfo-2.8.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libressl-devel-doc-2.8.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcrypto43-32bit-2.8.0-lp150.2.3.1 libcrypto43-32bit-debuginfo-2.8.0-lp150.2.3.1 libressl-devel-32bit-2.8.0-lp150.2.3.1 libssl45-32bit-2.8.0-lp150.2.3.1 libssl45-32bit-debuginfo-2.8.0-lp150.2.3.1 libtls17-32bit-2.8.0-lp150.2.3.1 libtls17-32bit-debuginfo-2.8.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12434.html https://bugzilla.suse.com/1097779

1 0

openSUSE-SU-2018:2591-1: moderate: Security update for zutils
by opensuse-security＠opensuse.org 03 Sep '18

03 Sep '18

openSUSE Security Update: Security update for zutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2591-1 Rating: moderate References: #1103878 Cross-References: CVE-2018-1000637 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zutils to version 1.7 fixes one security issue: - CVE-2018-1000637: buffer overrun in zcat utility (boo#1103878) Please note that the zutils zcat utility is distinct from the default gzip zcat utility. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-951=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-951=1 Package List: - openSUSE Leap 42.3 (x86_64): zutils-1.7-4.3.1 zutils-debuginfo-1.7-4.3.1 zutils-debugsource-1.7-4.3.1 - openSUSE Leap 15.0 (x86_64): zutils-1.7-lp150.2.3.1 zutils-debuginfo-1.7-lp150.2.3.1 zutils-debugsource-1.7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000637.html https://bugzilla.suse.com/1103878

1 0

openSUSE-SU-2018:2590-1: important: Security update for cobbler
by opensuse-security＠opensuse.org 03 Sep '18

03 Sep '18

openSUSE Security Update: Security update for cobbler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2590-1 Rating: important References: #1097733 #1101670 #1104189 #1104190 #1104287 #1105440 #1105442 Cross-References: CVE-2018-1000225 CVE-2018-1000226 CVE-2018-10931 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This update for cobbler fixes the following issues: Security issues fixed: - Forbid exposure of private methods in the API (CVE-2018-10931, CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442) - Check access token when calling 'modify_setting' API endpoint (bsc#1104190, bsc#1105440, CVE-2018-1000226) Other bugs fixed: - Do not try to hardlink to a symlink. The result will be a dangling symlink in the general case. (bsc#1097733) - fix kernel options when generating bootiso (bsc#1101670) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-952=1 Package List: - openSUSE Leap 42.3 (noarch): cobbler-2.6.6-17.1 cobbler-tests-2.6.6-17.1 cobbler-web-2.6.6-17.1 koan-2.6.6-17.1 References: https://www.suse.com/security/cve/CVE-2018-1000225.html https://www.suse.com/security/cve/CVE-2018-1000226.html https://www.suse.com/security/cve/CVE-2018-10931.html https://bugzilla.suse.com/1097733 https://bugzilla.suse.com/1101670 https://bugzilla.suse.com/1104189 https://bugzilla.suse.com/1104190 https://bugzilla.suse.com/1104287 https://bugzilla.suse.com/1105440 https://bugzilla.suse.com/1105442

1 0

openSUSE-RU-2018:2589-1: moderate: Recommended update for yast2-bootloader
by maintenance＠opensuse.org 01 Sep '18

01 Sep '18

openSUSE Recommended Update: Recommended update for yast2-bootloader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2589-1 Rating: moderate References: #1059603 #1061850 #1067131 #1073633 #1073827 #1081967 #1099394 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update fixes issues for yast2-bootloader, yast2-storage, and libstorage: yast2-bootloader: - Fix translating multipath udev names when activating partition (bsc#1073827) - Does no longer repropose configuration in autoyast confirm mode (bsc#1081967) - Fix setting pmbr flag in autoyast (bsc#1081967) - Prevent crash when doing backup of boot sector (bsc#1067131) - Fix detection of upgrade of grub2 (bsc#1059603) - Prevent crash when upgrading via DVD (bsc#1059603) yast2-storage: - Mask systemd mount and swap units while expert partitioner is running to prevent some race conditions from happening. (bsc#1073633) libstorage: - Improve handling of udev ids starting with dm-uuid for partitions on multipath (bsc#1099394) - Don't discard the stored volume label before it is applied (bsc#1061850) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-947=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libstorage-debugsource-2.26.12.2-2.3.1 libstorage-devel-2.26.12.2-2.3.1 libstorage-python-2.26.12.2-2.3.1 libstorage-python-debuginfo-2.26.12.2-2.3.1 libstorage-ruby-2.26.12.2-2.3.1 libstorage-ruby-debuginfo-2.26.12.2-2.3.1 libstorage-testsuite-2.26.12.2-2.3.1 libstorage-testsuite-debuginfo-2.26.12.2-2.3.1 libstorage7-2.26.12.2-2.3.1 libstorage7-debuginfo-2.26.12.2-2.3.1 yast2-bootloader-3.2.27.1-6.1 yast2-storage-3.2.16.3-9.1 yast2-storage-debuginfo-3.2.16.3-9.1 yast2-storage-debugsource-3.2.16.3-9.1 yast2-storage-devel-3.2.16.3-9.1 References: https://bugzilla.suse.com/1059603 https://bugzilla.suse.com/1061850 https://bugzilla.suse.com/1067131 https://bugzilla.suse.com/1073633 https://bugzilla.suse.com/1073827 https://bugzilla.suse.com/1081967 https://bugzilla.suse.com/1099394

1 0

openSUSE-RU-2018:2588-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 01 Sep '18

01 Sep '18

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2588-1 Rating: moderate References: #1050427 #1066156 #1069802 #1070344 #1074127 #1084730 #1087248 #1093433 #1096783 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update for crmsh provides version 3.0.3 and fixes the following issues: - bootstrap: Suppress the error message. (bsc#1087248) - bootstrap: Expected votes wouldn't update in unicast mode. (bsc#1087248) - bootstrap: Run "csync2_update" for all files after new joining node call csync2_remote. (bsc#1087248) - utils: Avoid crash on missing process id. (bsc#1084730) - bootstrap: Fix UnboundLocalError: local variable 'nodename' referenced before assignment. - ui_cluster: When use help option, do not exit, just print help messages and return. - ui_cluster: when have an error for optparse, just return and stay at shell. - Fix SBD configuration when using SBD device. - bootstrap: Improve message when sbd is not installed. (bsc#1050427) - bootstrap: Missing dmidecode on ppc64le. (bsc#1069802) - ra: Don't require deprecated parameters. - Fix is_program(dmidecode) error. (bsc#1070344) - ui_resource: Using crm_failcount instead of crm_attribute. (bsc#1074127) - ui_node: normal is deprecated in favor of member. - ui_cluster: Stop corosync when stopping pacemaker. (bsc#1066156) - Parse /32 route entries. - Fix TypeError in logparser.py. (bsc#1093433) - config: Locate pacemaker daemons more intelligently. (bsc#1096783) - ra: Support Pacemaker 2.0 daemon names. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-948=1 Package List: - openSUSE Leap 42.3 (noarch): crmsh-3.0.3-10.3.1 crmsh-scripts-3.0.3-10.3.1 crmsh-test-3.0.3-10.3.1 References: https://bugzilla.suse.com/1050427 https://bugzilla.suse.com/1066156 https://bugzilla.suse.com/1069802 https://bugzilla.suse.com/1070344 https://bugzilla.suse.com/1074127 https://bugzilla.suse.com/1084730 https://bugzilla.suse.com/1087248 https://bugzilla.suse.com/1093433 https://bugzilla.suse.com/1096783

1 0

openSUSE-SU-2018:2587-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 01 Sep '18

01 Sep '18

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2587-1 Rating: moderate References: #1106514 Cross-References: CVE-2018-16056 CVE-2018-16057 CVE-2018-16058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark to version 2.2.17 fixes the following issues: Security issues fixed (boo#1106514): - CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44) - CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45) - CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.17.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-949=1 Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.17-47.1 wireshark-debuginfo-2.2.17-47.1 wireshark-debugsource-2.2.17-47.1 wireshark-devel-2.2.17-47.1 wireshark-ui-gtk-2.2.17-47.1 wireshark-ui-gtk-debuginfo-2.2.17-47.1 wireshark-ui-qt-2.2.17-47.1 wireshark-ui-qt-debuginfo-2.2.17-47.1 References: https://www.suse.com/security/cve/CVE-2018-16056.html https://www.suse.com/security/cve/CVE-2018-16057.html https://www.suse.com/security/cve/CVE-2018-16058.html https://bugzilla.suse.com/1106514

1 0