September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:2664-2: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2664-2 Rating: important References: #1106341 #1107235 Cross-References: CVE-2017-15430 CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 CVE-2018-16079 CVE-2018-16080 CVE-2018-16081 CVE-2018-16082 CVE-2018-16083 CVE-2018-16084 CVE-2018-16085 CVE-2018-16086 CVE-2018-16087 CVE-2018-16088 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for Chromium to version 69.0.3497.81 fixes multiple issues. Security issues fixed (boo#1107235): - CVE-2018-16065: Out of bounds write in V8 - CVE-2018-16066:Out of bounds read in Blink - CVE-2018-16067: Out of bounds read in WebAudio - CVE-2018-16068: Out of bounds write in Mojo - CVE-2018-16069:Out of bounds read in SwiftShader - CVE-2018-16070: Integer overflow in Skia - CVE-2018-16071: Use after free in WebRTC - CVE-2018-16073: Site Isolation bypass after tab restore - CVE-2018-16074: Site Isolation bypass using Blob URLS - Out of bounds read in Little-CMS - CVE-2018-16075: Local file access in Blink - CVE-2018-16076: Out of bounds read in PDFium - CVE-2018-16077: Content security policy bypass in Blink - CVE-2018-16078: Credit card information leak in Autofill - CVE-2018-16079: URL spoof in permission dialogs - CVE-2018-16080: URL spoof in full screen mode - CVE-2018-16081: Local file access in DevTools - CVE-2018-16082: Stack buffer overflow in SwiftShader - CVE-2018-16083: Out of bounds read in WebRTC - CVE-2018-16084: User confirmation bypass in external protocol handling - CVE-2018-16085: Use after free in Memory Instrumentation - CVE-2017-15430: Unsafe navigation in Chromecast (boo#1106341) - CVE-2018-16086: Script injection in New Tab Page - CVE-2018-16087: Multiple download restriction bypass - CVE-2018-16088: User gesture requirement bypass The re2 regular expression library was updated to the current version 2018-09-01. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-979=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libre2-0-20180901-bp150.3.3.1 libre2-0-debuginfo-20180901-bp150.3.3.1 re2-debugsource-20180901-bp150.3.3.1 re2-devel-20180901-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-69.0.3497.81-bp150.2.4.1 chromedriver-debuginfo-69.0.3497.81-bp150.2.4.1 chromium-69.0.3497.81-bp150.2.4.1 chromium-debuginfo-69.0.3497.81-bp150.2.4.1 chromium-debugsource-69.0.3497.81-bp150.2.4.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libre2-0-64bit-20180901-bp150.3.3.1 libre2-0-64bit-debuginfo-20180901-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-15430.html https://www.suse.com/security/cve/CVE-2018-16065.html https://www.suse.com/security/cve/CVE-2018-16066.html https://www.suse.com/security/cve/CVE-2018-16067.html https://www.suse.com/security/cve/CVE-2018-16068.html https://www.suse.com/security/cve/CVE-2018-16069.html https://www.suse.com/security/cve/CVE-2018-16070.html https://www.suse.com/security/cve/CVE-2018-16071.html https://www.suse.com/security/cve/CVE-2018-16073.html https://www.suse.com/security/cve/CVE-2018-16074.html https://www.suse.com/security/cve/CVE-2018-16075.html https://www.suse.com/security/cve/CVE-2018-16076.html https://www.suse.com/security/cve/CVE-2018-16077.html https://www.suse.com/security/cve/CVE-2018-16078.html https://www.suse.com/security/cve/CVE-2018-16079.html https://www.suse.com/security/cve/CVE-2018-16080.html https://www.suse.com/security/cve/CVE-2018-16081.html https://www.suse.com/security/cve/CVE-2018-16082.html https://www.suse.com/security/cve/CVE-2018-16083.html https://www.suse.com/security/cve/CVE-2018-16084.html https://www.suse.com/security/cve/CVE-2018-16085.html https://www.suse.com/security/cve/CVE-2018-16086.html https://www.suse.com/security/cve/CVE-2018-16087.html https://www.suse.com/security/cve/CVE-2018-16088.html https://bugzilla.suse.com/1106341 https://bugzilla.suse.com/1107235

1 0

openSUSE-RU-2018:2614-2: moderate: Recommended update for transactional-update
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for transactional-update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2614-2 Rating: moderate References: #1104452 #1105992 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for transactional-update fixes the following issues: The following bugs were fixed in 2.6: - /var/lib/zypp might have been reported as not being a directory, create if not available (boo#1104452) - zypper output was not parsed with sufficient robustness (boo#1105992) The following functionality was added or updated: - --interactive and --non-interactive options to change the default interactivity for zypper calls. - Add kured reboot support - trancactional-update-helper was replaced by zypper options Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-963=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): transactional-update-2.6-bp150.2.3.1 transactional-update-debuginfo-2.6-bp150.2.3.1 transactional-update-debugsource-2.6-bp150.2.3.1 References: https://bugzilla.suse.com/1104452 https://bugzilla.suse.com/1105992

1 0

openSUSE-SU-2018:2516-2: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2516-2 Rating: important References: #1105592 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - Disable PS, PS2, PS3 and PDF coders by default, remove gs calls from delegates.mgk (boo#1105592) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-937=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.3.1 GraphicsMagick-debuginfo-1.3.29-bp150.2.3.1 GraphicsMagick-debugsource-1.3.29-bp150.2.3.1 GraphicsMagick-devel-1.3.29-bp150.2.3.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.3.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-bp150.2.3.1 libGraphicsMagick++-devel-1.3.29-bp150.2.3.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-bp150.2.3.1 libGraphicsMagick3-config-1.3.29-bp150.2.3.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-bp150.2.3.1 perl-GraphicsMagick-1.3.29-bp150.2.3.1 perl-GraphicsMagick-debuginfo-1.3.29-bp150.2.3.1 References: https://bugzilla.suse.com/1105592

1 0

openSUSE-SU-2018:2742-2: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2742-2 Rating: low References: #1107604 #1107609 Cross-References: CVE-2018-16644 CVE-2018-16645 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1020=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.6.1 GraphicsMagick-debuginfo-1.3.29-bp150.2.6.1 GraphicsMagick-debugsource-1.3.29-bp150.2.6.1 GraphicsMagick-devel-1.3.29-bp150.2.6.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.6.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-bp150.2.6.1 libGraphicsMagick++-devel-1.3.29-bp150.2.6.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.6.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-bp150.2.6.1 libGraphicsMagick3-config-1.3.29-bp150.2.6.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.6.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-bp150.2.6.1 perl-GraphicsMagick-1.3.29-bp150.2.6.1 perl-GraphicsMagick-debuginfo-1.3.29-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-16645.html https://bugzilla.suse.com/1107604 https://bugzilla.suse.com/1107609

1 0

openSUSE-SU-2018:2728-2: moderate: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2728-2 Rating: moderate References: #1108114 #1108175 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Chromium to version 69.0.3497.92 fixes the following issues: Security issues fixed ((boo#1108114): - Function signature mismatch in WebAssembly - URL Spoofing in Omnibox The following tracked packaging issues were fixed: - the chromium package incorrectly provied swiftshader resolvables (boo#1108175) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1005=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-69.0.3497.92-bp150.2.7.1 chromedriver-debuginfo-69.0.3497.92-bp150.2.7.1 chromium-69.0.3497.92-bp150.2.7.1 chromium-debuginfo-69.0.3497.92-bp150.2.7.1 chromium-debugsource-69.0.3497.92-bp150.2.7.1 References: https://bugzilla.suse.com/1108114 https://bugzilla.suse.com/1108175

1 0

openSUSE-RU-2018:2435-2: Recommended update for powerline
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for powerline ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2435-2 Rating: low References: #1101303 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for powerline fixes the following issues: - powerline intitializaton was not working correctly in vim (boo#10101303) - add correct systemd service for powerline Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-913=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): powerline-2.6-bp150.3.3.1 powerline-debuginfo-2.6-bp150.3.3.1 powerline-debugsource-2.6-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): powerline-docs-2.6-bp150.3.3.1 powerline-fonts-2.6-bp150.3.3.1 tmux-powerline-2.6-bp150.3.3.1 vim-plugin-powerline-2.6-bp150.3.3.1 References: https://bugzilla.suse.com/1101303

1 0

openSUSE-RU-2018:2616-2: moderate: Recommended update for guake
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for guake ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2616-2 Rating: moderate References: #1102963 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for guake fixes the following issues: - guake package did not specify the python3-gobject-Gdk dependency and would fail on start (boo#1102963) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-961=1 Package List: - openSUSE Backports SLE-15 (noarch): guake-3.2.1-bp150.3.4.1 References: https://bugzilla.suse.com/1102963

1 0

openSUSE-RU-2018:2611-2: moderate: Recommended update for terminator
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for terminator ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2611-2 Rating: moderate References: #1105830 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for terminator fixes the following issues: - terminator did not correctly specify run-time dependency on python-cairo (boo#1105830) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-962=1 Package List: - openSUSE Backports SLE-15 (noarch): terminator-1.91-bp150.3.3.1 terminator-lang-1.91-bp150.3.3.1 References: https://bugzilla.suse.com/1105830

1 0

openSUSE-SU-2018:2733-2: moderate: Security update for okular
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for okular ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2733-2 Rating: moderate References: #1107591 Cross-References: CVE-2018-1000801 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for okular fixes the following security issue: - CVE-2018-1000801: Prevent directory traversal vulnerability in function unpackDocumentArchive could have resulted in arbitrary file creation via a specially crafted Okular archive (bsc#1107591). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1006=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): okular-17.12.3-bp150.3.3.1 okular-debuginfo-17.12.3-bp150.3.3.1 okular-debugsource-17.12.3-bp150.3.3.1 okular-devel-17.12.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): okular-lang-17.12.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000801.html https://bugzilla.suse.com/1107591

1 0

openSUSE-RU-2018:2802-2: moderate: Recommended update for youtube-dl
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for youtube-dl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2802-2 Rating: moderate References: #1108712 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for youtube-dl fixes the following issues: - fixes for a number of video sites, including: ARD Mediathek Beta, chrunchyroll, YouTube, IMDB and others (boo#1108712) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1028=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-youtube-dl-2018.09.08-bp150.3.3.1 python3-youtube-dl-2018.09.08-bp150.3.3.1 youtube-dl-2018.09.08-bp150.3.3.1 References: https://bugzilla.suse.com/1108712

1 0