September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2854-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2854-1 Rating: moderate References: #1047002 #1105437 #1105459 #1105460 Cross-References: CVE-2017-10790 CVE-2018-10844 CVE-2018-10845 CVE-2018-10846 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - CVE-2018-10846: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery (bsc#1105460) - CVE-2018-10845: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant (bsc#1105459) - CVE-2018-10844: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls (bsc#1105437) - CVE-2017-10790: The _asn1_check_identifier function in Libtasn1 caused a NULL pointer dereference and crash (bsc#1047002) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1049=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnutls-3.3.27-2.3.1 gnutls-debuginfo-3.3.27-2.3.1 gnutls-debugsource-3.3.27-2.3.1 libgnutls-devel-3.3.27-2.3.1 libgnutls-openssl-devel-3.3.27-2.3.1 libgnutls-openssl27-3.3.27-2.3.1 libgnutls-openssl27-debuginfo-3.3.27-2.3.1 libgnutls28-3.3.27-2.3.1 libgnutls28-debuginfo-3.3.27-2.3.1 libgnutlsxx-devel-3.3.27-2.3.1 libgnutlsxx28-3.3.27-2.3.1 libgnutlsxx28-debuginfo-3.3.27-2.3.1 - openSUSE Leap 42.3 (x86_64): libgnutls-devel-32bit-3.3.27-2.3.1 libgnutls28-32bit-3.3.27-2.3.1 libgnutls28-debuginfo-32bit-3.3.27-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-10790.html https://www.suse.com/security/cve/CVE-2018-10844.html https://www.suse.com/security/cve/CVE-2018-10845.html https://www.suse.com/security/cve/CVE-2018-10846.html https://bugzilla.suse.com/1047002 https://bugzilla.suse.com/1105437 https://bugzilla.suse.com/1105459 https://bugzilla.suse.com/1105460

1 0

openSUSE-SU-2018:2852-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2852-1 Rating: moderate References: #1106914 Cross-References: CVE-2018-16588 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadow fixes the following security issue: - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 (bsc#1106914) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1051=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): shadow-4.5-lp150.6.3.1 shadow-debuginfo-4.5-lp150.6.3.1 shadow-debugsource-4.5-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-16588.html https://bugzilla.suse.com/1106914

1 0

openSUSE-SU-2018:2851-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2851-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1048=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-27.1 gd-debuginfo-2.1.0-27.1 gd-debugsource-2.1.0-27.1 gd-devel-2.1.0-27.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-27.1 gd-debuginfo-32bit-2.1.0-27.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434

1 0

openSUSE-SU-2018:2849-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 25 Sep '18

25 Sep '18

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2849-1 Rating: moderate References: #1105434 Cross-References: CVE-2018-1000222 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1050=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.12.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.12.1 php7-7.2.5-lp150.2.12.1 php7-bcmath-7.2.5-lp150.2.12.1 php7-bcmath-debuginfo-7.2.5-lp150.2.12.1 php7-bz2-7.2.5-lp150.2.12.1 php7-bz2-debuginfo-7.2.5-lp150.2.12.1 php7-calendar-7.2.5-lp150.2.12.1 php7-calendar-debuginfo-7.2.5-lp150.2.12.1 php7-ctype-7.2.5-lp150.2.12.1 php7-ctype-debuginfo-7.2.5-lp150.2.12.1 php7-curl-7.2.5-lp150.2.12.1 php7-curl-debuginfo-7.2.5-lp150.2.12.1 php7-dba-7.2.5-lp150.2.12.1 php7-dba-debuginfo-7.2.5-lp150.2.12.1 php7-debuginfo-7.2.5-lp150.2.12.1 php7-debugsource-7.2.5-lp150.2.12.1 php7-devel-7.2.5-lp150.2.12.1 php7-dom-7.2.5-lp150.2.12.1 php7-dom-debuginfo-7.2.5-lp150.2.12.1 php7-embed-7.2.5-lp150.2.12.1 php7-embed-debuginfo-7.2.5-lp150.2.12.1 php7-enchant-7.2.5-lp150.2.12.1 php7-enchant-debuginfo-7.2.5-lp150.2.12.1 php7-exif-7.2.5-lp150.2.12.1 php7-exif-debuginfo-7.2.5-lp150.2.12.1 php7-fastcgi-7.2.5-lp150.2.12.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.12.1 php7-fileinfo-7.2.5-lp150.2.12.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.12.1 php7-firebird-7.2.5-lp150.2.12.1 php7-firebird-debuginfo-7.2.5-lp150.2.12.1 php7-fpm-7.2.5-lp150.2.12.1 php7-fpm-debuginfo-7.2.5-lp150.2.12.1 php7-ftp-7.2.5-lp150.2.12.1 php7-ftp-debuginfo-7.2.5-lp150.2.12.1 php7-gd-7.2.5-lp150.2.12.1 php7-gd-debuginfo-7.2.5-lp150.2.12.1 php7-gettext-7.2.5-lp150.2.12.1 php7-gettext-debuginfo-7.2.5-lp150.2.12.1 php7-gmp-7.2.5-lp150.2.12.1 php7-gmp-debuginfo-7.2.5-lp150.2.12.1 php7-iconv-7.2.5-lp150.2.12.1 php7-iconv-debuginfo-7.2.5-lp150.2.12.1 php7-intl-7.2.5-lp150.2.12.1 php7-intl-debuginfo-7.2.5-lp150.2.12.1 php7-json-7.2.5-lp150.2.12.1 php7-json-debuginfo-7.2.5-lp150.2.12.1 php7-ldap-7.2.5-lp150.2.12.1 php7-ldap-debuginfo-7.2.5-lp150.2.12.1 php7-mbstring-7.2.5-lp150.2.12.1 php7-mbstring-debuginfo-7.2.5-lp150.2.12.1 php7-mysql-7.2.5-lp150.2.12.1 php7-mysql-debuginfo-7.2.5-lp150.2.12.1 php7-odbc-7.2.5-lp150.2.12.1 php7-odbc-debuginfo-7.2.5-lp150.2.12.1 php7-opcache-7.2.5-lp150.2.12.1 php7-opcache-debuginfo-7.2.5-lp150.2.12.1 php7-openssl-7.2.5-lp150.2.12.1 php7-openssl-debuginfo-7.2.5-lp150.2.12.1 php7-pcntl-7.2.5-lp150.2.12.1 php7-pcntl-debuginfo-7.2.5-lp150.2.12.1 php7-pdo-7.2.5-lp150.2.12.1 php7-pdo-debuginfo-7.2.5-lp150.2.12.1 php7-pgsql-7.2.5-lp150.2.12.1 php7-pgsql-debuginfo-7.2.5-lp150.2.12.1 php7-phar-7.2.5-lp150.2.12.1 php7-phar-debuginfo-7.2.5-lp150.2.12.1 php7-posix-7.2.5-lp150.2.12.1 php7-posix-debuginfo-7.2.5-lp150.2.12.1 php7-readline-7.2.5-lp150.2.12.1 php7-readline-debuginfo-7.2.5-lp150.2.12.1 php7-shmop-7.2.5-lp150.2.12.1 php7-shmop-debuginfo-7.2.5-lp150.2.12.1 php7-snmp-7.2.5-lp150.2.12.1 php7-snmp-debuginfo-7.2.5-lp150.2.12.1 php7-soap-7.2.5-lp150.2.12.1 php7-soap-debuginfo-7.2.5-lp150.2.12.1 php7-sockets-7.2.5-lp150.2.12.1 php7-sockets-debuginfo-7.2.5-lp150.2.12.1 php7-sodium-7.2.5-lp150.2.12.1 php7-sodium-debuginfo-7.2.5-lp150.2.12.1 php7-sqlite-7.2.5-lp150.2.12.1 php7-sqlite-debuginfo-7.2.5-lp150.2.12.1 php7-sysvmsg-7.2.5-lp150.2.12.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.12.1 php7-sysvsem-7.2.5-lp150.2.12.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.12.1 php7-sysvshm-7.2.5-lp150.2.12.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.12.1 php7-tidy-7.2.5-lp150.2.12.1 php7-tidy-debuginfo-7.2.5-lp150.2.12.1 php7-tokenizer-7.2.5-lp150.2.12.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.12.1 php7-wddx-7.2.5-lp150.2.12.1 php7-wddx-debuginfo-7.2.5-lp150.2.12.1 php7-xmlreader-7.2.5-lp150.2.12.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.12.1 php7-xmlrpc-7.2.5-lp150.2.12.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.12.1 php7-xmlwriter-7.2.5-lp150.2.12.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.12.1 php7-xsl-7.2.5-lp150.2.12.1 php7-xsl-debuginfo-7.2.5-lp150.2.12.1 php7-zip-7.2.5-lp150.2.12.1 php7-zip-debuginfo-7.2.5-lp150.2.12.1 php7-zlib-7.2.5-lp150.2.12.1 php7-zlib-debuginfo-7.2.5-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.12.1 php7-pear-Archive_Tar-7.2.5-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-1000222.html https://bugzilla.suse.com/1105434

1 0

openSUSE-SU-2018:2833-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2833-1 Rating: low References: #1108282 #1108283 Cross-References: CVE-2018-16749 CVE-2018-16750 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following security issue: - CVE-2018-16750: Prevent memory leak in the formatIPTCfromBuffer function (bsc#1108283). An earlier update added a change that also fixed this issues that was unknown at the time of release: - CVE-2018-16749: Added missing NULL check in ReadOneJNGImage that allowed an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file (bsc#1108282). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1045=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-108.1 GraphicsMagick-debuginfo-1.3.25-108.1 GraphicsMagick-debugsource-1.3.25-108.1 GraphicsMagick-devel-1.3.25-108.1 libGraphicsMagick++-Q16-12-1.3.25-108.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-108.1 libGraphicsMagick++-devel-1.3.25-108.1 libGraphicsMagick-Q16-3-1.3.25-108.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-108.1 libGraphicsMagick3-config-1.3.25-108.1 libGraphicsMagickWand-Q16-2-1.3.25-108.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-108.1 perl-GraphicsMagick-1.3.25-108.1 perl-GraphicsMagick-debuginfo-1.3.25-108.1 References: https://www.suse.com/security/cve/CVE-2018-16749.html https://www.suse.com/security/cve/CVE-2018-16750.html https://bugzilla.suse.com/1108282 https://bugzilla.suse.com/1108283

1 0

openSUSE-SU-2018:2827-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2827-1 Rating: moderate References: #1108480 Cross-References: CVE-2016-3822 CVE-2018-16554 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jhead fixes the following security issues: - CVE-2016-3822: jhead remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data (bsc#1108480). - CVE-2018-16554: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling (bsc#1108480). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1044=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1044=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1044=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): jhead-3.00-11.1 jhead-debuginfo-3.00-11.1 jhead-debugsource-3.00-11.1 - openSUSE Leap 15.0 (x86_64): jhead-3.00-lp150.3.3.1 jhead-debuginfo-3.00-lp150.3.3.1 jhead-debugsource-3.00-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): jhead-3.00-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2016-3822.html https://www.suse.com/security/cve/CVE-2018-16554.html https://bugzilla.suse.com/1108480

1 0

openSUSE-SU-2018:2820-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2820-1 Rating: moderate References: #1096291 Cross-References: CVE-2018-1000180 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following security issue: - CVE-2018-1000180: Fixed flaw in the Low-level interface to RSA key pair generator. RSA Key Pairs generated in low-level API with added certainty may had less M-R tests than expected (bsc#1096291). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1043=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.60-23.10.1 bouncycastle-javadoc-1.60-23.10.1 References: https://www.suse.com/security/cve/CVE-2018-1000180.html https://bugzilla.suse.com/1096291

1 0

openSUSE-SU-2018:2819-1: moderate: Security update for liblouis
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for liblouis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2819-1 Rating: moderate References: #1095189 #1095825 #1095826 #1095827 #1095945 #1097103 Cross-References: CVE-2018-11440 CVE-2018-11577 CVE-2018-11683 CVE-2018-11684 CVE-2018-11685 CVE-2018-12085 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for liblouis fixes the following issues: Security issues fixed: - CVE-2018-11440: Fixed a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (bsc#1095189) - CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c (bsc#1095945) - CVE-2018-11683: Fixed a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (different vulnerability than CVE-2018-11440) (bsc#1095827) - CVE-2018-11684: Fixed stack-based buffer overflow in the function includeFile() in compileTranslationTable.c (bsc#1095826) - CVE-2018-11685: Fixed a stack-based buffer overflow in the function compileHyphenation() in compileTranslationTable.c (bsc#1095825) - CVE-2018-12085: Fixed a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (different vulnerability than CVE-2018-11440) (bsc#1097103) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1039=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): liblouis-data-2.6.4-9.1 liblouis-debugsource-2.6.4-9.1 liblouis-devel-2.6.4-9.1 liblouis-doc-2.6.4-9.1 liblouis-tools-2.6.4-9.1 liblouis-tools-debuginfo-2.6.4-9.1 liblouis9-2.6.4-9.1 liblouis9-debuginfo-2.6.4-9.1 python-louis-2.6.4-9.1 References: https://www.suse.com/security/cve/CVE-2018-11440.html https://www.suse.com/security/cve/CVE-2018-11577.html https://www.suse.com/security/cve/CVE-2018-11683.html https://www.suse.com/security/cve/CVE-2018-11684.html https://www.suse.com/security/cve/CVE-2018-11685.html https://www.suse.com/security/cve/CVE-2018-12085.html https://bugzilla.suse.com/1095189 https://bugzilla.suse.com/1095825 https://bugzilla.suse.com/1095826 https://bugzilla.suse.com/1095827 https://bugzilla.suse.com/1095945 https://bugzilla.suse.com/1097103

1 0

openSUSE-SU-2018:2818-1: moderate: Security update for gdm
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2818-1 Rating: moderate References: #1081947 #1103093 #1103737 Cross-References: CVE-2018-14424 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gdm provides the following fixes: This security issue was fixed: - CVE-2018-14424: The daemon in GDM did not properly unexport display objects from its D-Bus interface when they are destroyed, which allowed a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution (bsc#1103737) These non-security issues were fixed: - Enable pam_keyinit module (bsc#1081947) - Fix a build race in SLE (bsc#1103093) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1037=1 Package List: - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.3.1 gdm-debuginfo-3.26.2.1-lp150.11.3.1 gdm-debugsource-3.26.2.1-lp150.11.3.1 gdm-devel-3.26.2.1-lp150.11.3.1 libgdm1-3.26.2.1-lp150.11.3.1 libgdm1-debuginfo-3.26.2.1-lp150.11.3.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.3.1 - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.3.1 gdm-lang-3.26.2.1-lp150.11.3.1 gdmflexiserver-3.26.2.1-lp150.11.3.1 References: https://www.suse.com/security/cve/CVE-2018-14424.html https://bugzilla.suse.com/1081947 https://bugzilla.suse.com/1103093 https://bugzilla.suse.com/1103737

1 0

openSUSE-SU-2018:2817-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Sep '18

24 Sep '18

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2817-1 Rating: moderate References: #1107343 #1109363 Cross-References: CVE-2018-12383 CVE-2018-12385 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Mozilla Firefox to version 60.2.1esr fixes the following issues: Security issues fixed (MFSA 2018-23): - CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (boo#1109363) - CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (boo#1107343) Bugx fixed: - Fixed a startup crash affecting users migrating from older ESR releases Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1042=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1042=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.2.1-112.1 MozillaFirefox-branding-upstream-60.2.1-112.1 MozillaFirefox-buildsymbols-60.2.1-112.1 MozillaFirefox-debuginfo-60.2.1-112.1 MozillaFirefox-debugsource-60.2.1-112.1 MozillaFirefox-devel-60.2.1-112.1 MozillaFirefox-translations-common-60.2.1-112.1 MozillaFirefox-translations-other-60.2.1-112.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.2.1-lp150.3.17.1 MozillaFirefox-branding-upstream-60.2.1-lp150.3.17.1 MozillaFirefox-buildsymbols-60.2.1-lp150.3.17.1 MozillaFirefox-debuginfo-60.2.1-lp150.3.17.1 MozillaFirefox-debugsource-60.2.1-lp150.3.17.1 MozillaFirefox-devel-60.2.1-lp150.3.17.1 MozillaFirefox-translations-common-60.2.1-lp150.3.17.1 MozillaFirefox-translations-other-60.2.1-lp150.3.17.1 References: https://www.suse.com/security/cve/CVE-2018-12383.html https://www.suse.com/security/cve/CVE-2018-12385.html https://bugzilla.suse.com/1107343 https://bugzilla.suse.com/1109363

1 0