September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2905-1: moderate: Recommended update for mate-screensaver
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for mate-screensaver ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2905-1 Rating: moderate References: #1098985 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-screensaver fixes the following issues: - Fixes more GdkScreen related deprecations (boo#1098985) - lock-plug: Only scale lock-screen widgets on older versions of GTK+ - Update translations. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1059=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1059=1 Package List: - openSUSE Leap 15.0 (x86_64): mate-screensaver-1.20.2-lp150.2.3.1 mate-screensaver-debuginfo-1.20.2-lp150.2.3.1 mate-screensaver-debugsource-1.20.2-lp150.2.3.1 mate-screensaver-devel-1.20.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): mate-screensaver-lang-1.20.2-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mate-screensaver-1.20.2-bp150.2.3.1 mate-screensaver-debuginfo-1.20.2-bp150.2.3.1 mate-screensaver-debugsource-1.20.2-bp150.2.3.1 mate-screensaver-devel-1.20.2-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): mate-screensaver-lang-1.20.2-bp150.2.3.1 References: https://bugzilla.suse.com/1098985

1 0

openSUSE-RU-2018:2901-1: moderate: Recommended update for ovmf
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2901-1 Rating: moderate References: #1099193 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ovmf fixes the following issues: - The installer may have failed on guest with AMD Secure Encrypted Virtualization (SEV) enabled (boo#1099193) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1060=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.6.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.6.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.6.1 References: https://bugzilla.suse.com/1099193

1 0

openSUSE-RU-2018:2897-1: moderate: Recommended update for yast2-snapper
by maintenance＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Recommended Update: Recommended update for yast2-snapper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2897-1 Rating: moderate References: #956955 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-snapper fixes the following issues: - Fixes a bug where restoring of a file was not possible (bsc#956955) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1058=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-snapper-3.2.1-4.3.1 References: https://bugzilla.suse.com/956955

1 0

openSUSE-SU-2018:2895-1: moderate: Security update for ant
by opensuse-security＠opensuse.org 27 Sep '18

27 Sep '18

openSUSE Security Update: Security update for ant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2895-1 Rating: moderate References: #1100053 Cross-References: CVE-2018-10886 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1057=1 Package List: - openSUSE Leap 15.0 (noarch): ant-1.9.10-lp150.2.3.1 ant-antlr-1.9.10-lp150.2.3.1 ant-apache-bcel-1.9.10-lp150.2.3.1 ant-apache-bsf-1.9.10-lp150.2.3.1 ant-apache-log4j-1.9.10-lp150.2.3.1 ant-apache-oro-1.9.10-lp150.2.3.1 ant-apache-regexp-1.9.10-lp150.2.3.1 ant-apache-resolver-1.9.10-lp150.2.3.1 ant-apache-xalan2-1.9.10-lp150.2.3.1 ant-commons-logging-1.9.10-lp150.2.3.1 ant-commons-net-1.9.10-lp150.2.3.1 ant-javamail-1.9.10-lp150.2.3.1 ant-jdepend-1.9.10-lp150.2.3.1 ant-jmf-1.9.10-lp150.2.3.1 ant-jsch-1.9.10-lp150.2.3.1 ant-junit-1.9.10-lp150.2.3.1 ant-manual-1.9.10-lp150.2.3.1 ant-scripts-1.9.10-lp150.2.3.1 ant-swing-1.9.10-lp150.2.3.1 ant-testutil-1.9.10-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10886.html https://bugzilla.suse.com/1100053

1 0

openSUSE-SU-2018:2885-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 26 Sep '18

26 Sep '18

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2885-1 Rating: moderate References: #1106914 Cross-References: CVE-2018-16588 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadow fixes the following security issue: - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 (bsc#1106914) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1055=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): shadow-4.2.1-20.1 shadow-debuginfo-4.2.1-20.1 shadow-debugsource-4.2.1-20.1 References: https://www.suse.com/security/cve/CVE-2018-16588.html https://bugzilla.suse.com/1106914

1 0

openSUSE-SU-2018:2881-1: important: Security update for libzypp, zypper
by opensuse-security＠opensuse.org 26 Sep '18

26 Sep '18

openSUSE Security Update: Security update for libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2881-1 Rating: important References: #1036304 #1049825 #1070851 #1076192 #1088705 #1091624 #1092413 #1096803 #1099847 #1100028 #1101349 #1102429 Cross-References: CVE-2018-7685 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 11 fixes is now available. Description: This update for libzypp, zypper fixes the following issues: Update libzypp to version 16.17.20: Security issues fixed: - PackageProvider: Validate delta rpms before caching (bsc#1091624, bsc#1088705, CVE-2018-7685) - PackageProvider: Validate downloaded rpm package signatures before caching (bsc#1091624, bsc#1088705, CVE-2018-7685) Other bugs fixed: - lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304) - Handle http error 502 Bad Gateway in curl backend (bsc#1070851) - RepoManager: Explicitly request repo2solv to generate application pseudo packages. - libzypp-devel should not require cmake (bsc#1101349) - HardLocksFile: Prevent against empty commit without Target having been been loaded (bsc#1096803) - Avoid zombie tar processes (bsc#1076192) Update to zypper to version 1.13.45: Other bugs fixed: - XML <install-summary> attribute `packages-to-change` added (bsc#1102429) - man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028) - Prevent nested calls to exit() if aborted by a signal (bsc#1092413) - ansi.h: Prevent ESC sequence strings from going out of scope (bsc#1092413) - Fix: zypper bash completion expands non-existing options (bsc#1049825) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1054=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libzypp-16.17.20-27.1 libzypp-debuginfo-16.17.20-27.1 libzypp-debugsource-16.17.20-27.1 libzypp-devel-16.17.20-27.1 libzypp-devel-doc-16.17.20-27.1 zypper-1.13.45-20.1 zypper-debuginfo-1.13.45-20.1 zypper-debugsource-1.13.45-20.1 - openSUSE Leap 42.3 (noarch): zypper-aptitude-1.13.45-20.1 zypper-log-1.13.45-20.1 References: https://www.suse.com/security/cve/CVE-2018-7685.html https://bugzilla.suse.com/1036304 https://bugzilla.suse.com/1049825 https://bugzilla.suse.com/1070851 https://bugzilla.suse.com/1076192 https://bugzilla.suse.com/1088705 https://bugzilla.suse.com/1091624 https://bugzilla.suse.com/1092413 https://bugzilla.suse.com/1096803 https://bugzilla.suse.com/1099847 https://bugzilla.suse.com/1100028 https://bugzilla.suse.com/1101349 https://bugzilla.suse.com/1102429

1 0

openSUSE-SU-2018:2880-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 26 Sep '18

26 Sep '18

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2880-1 Rating: moderate References: #1074186 #1092480 #983440 Cross-References: CVE-2016-5319 CVE-2017-17942 CVE-2018-10779 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-10779: Fixed a heap-based buffer overflow in TIFFWriteScanline() in tif_write.c (bsc#1092480) - CVE-2017-17942: Fixed a heap-based buffer overflow in the function PackBitsEncode in tif_packbits.c. (bsc#1074186) - CVE-2016-5319: Fixed a beap-based buffer overflow in bmp2tiff (bsc#983440) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1056=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtiff-devel-4.0.9-34.1 libtiff5-4.0.9-34.1 libtiff5-debuginfo-4.0.9-34.1 tiff-4.0.9-34.1 tiff-debuginfo-4.0.9-34.1 tiff-debugsource-4.0.9-34.1 - openSUSE Leap 42.3 (x86_64): libtiff-devel-32bit-4.0.9-34.1 libtiff5-32bit-4.0.9-34.1 libtiff5-debuginfo-32bit-4.0.9-34.1 References: https://www.suse.com/security/cve/CVE-2016-5319.html https://www.suse.com/security/cve/CVE-2017-17942.html https://www.suse.com/security/cve/CVE-2018-10779.html https://bugzilla.suse.com/1074186 https://bugzilla.suse.com/1092480 https://bugzilla.suse.com/983440

1 0

openSUSE-SU-2018:2859-1: moderate: Security update for php5-smarty3
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for php5-smarty3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2859-1 Rating: moderate References: #1108741 Cross-References: CVE-2018-16381 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5-smarty3 fixes the following issues: - CVE-2018-16381: Prevent traversal vulnerability due to insufficient template code sanitization that allowed attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files (bsc#1108741). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1052=1 Package List: - openSUSE Leap 42.3 (noarch): php5-smarty3-3.1.33-5.5.1 php5-smarty3-doc-3.1.33-5.5.1 References: https://www.suse.com/security/cve/CVE-2018-16381.html https://bugzilla.suse.com/1108741

1 0

openSUSE-SU-2018:2856-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2856-1 Rating: moderate References: #1016715 #1104826 Cross-References: CVE-2016-4975 CVE-2016-8743 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715) - CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the "Location" or other outbound header key or value. (bsc#1104826) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1046=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-28.1 apache2-debuginfo-2.4.23-28.1 apache2-debugsource-2.4.23-28.1 apache2-devel-2.4.23-28.1 apache2-event-2.4.23-28.1 apache2-event-debuginfo-2.4.23-28.1 apache2-example-pages-2.4.23-28.1 apache2-prefork-2.4.23-28.1 apache2-prefork-debuginfo-2.4.23-28.1 apache2-utils-2.4.23-28.1 apache2-utils-debuginfo-2.4.23-28.1 apache2-worker-2.4.23-28.1 apache2-worker-debuginfo-2.4.23-28.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-28.1 References: https://www.suse.com/security/cve/CVE-2016-4975.html https://www.suse.com/security/cve/CVE-2016-8743.html https://bugzilla.suse.com/1016715 https://bugzilla.suse.com/1104826

1 0

openSUSE-SU-2018:2855-1: moderate: Security update for nodejs8
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2855-1 Rating: moderate References: #1097158 #1097748 #1105019 Cross-References: CVE-2018-0732 CVE-2018-12115 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nodejs8 to version 8.11.4 fixes the following issues: Security issues fixed: - CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer (bsc#1105019) - Upgrade to OpenSSL 1.0.2p, which fixed: - CVE-2018-0732: Client denial-of-service due to large DH parameter (bsc#1097158) - ECDSA key extraction via local side-channel Other changes made: - Recommend same major version npm package (bsc#1097748) - Fix parallel/test-tls-passphrase.js test to continue to function with older versions of OpenSSL library. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1047=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): nodejs8-8.11.4-lp150.2.6.1 nodejs8-debuginfo-8.11.4-lp150.2.6.1 nodejs8-debugsource-8.11.4-lp150.2.6.1 nodejs8-devel-8.11.4-lp150.2.6.1 npm8-8.11.4-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): nodejs8-docs-8.11.4-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-0732.html https://www.suse.com/security/cve/CVE-2018-12115.html https://bugzilla.suse.com/1097158 https://bugzilla.suse.com/1097748 https://bugzilla.suse.com/1105019

1 0