openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3818-1 Rating: important References: #1082318 #1112066 #1112695 #1113668 #1113669 Cross-References: CVE-2018-19131 CVE-2018-19132 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for squid fixes the following issues: Security issues fixed: - CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668). - CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669). Non-security issues fixed: - Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066). - Install license correctly (bsc#1082318). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1429=1 Package List: - openSUSE Leap 15.0 (x86_64): squid-4.4-lp150.4.3.2 squid-debuginfo-4.4-lp150.4.3.2 squid-debugsource-4.4-lp150.4.3.2 References: https://www.suse.com/security/cve/CVE-2018-19131.html https://www.suse.com/security/cve/CVE-2018-19132.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1112066 https://bugzilla.suse.com/1112695 https://bugzilla.suse.com/1113668 https://bugzilla.suse.com/1113669