SUSE SLES12 Security Update : shadow (SUSE-SU-2018:1997-2)

This update for shadow fixes the following issues : CVE-2016-6252: Incorrect integer handling could results in local privilege escalation bsc1099310 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLES12 Security Update : postgresql10 (SUSE-SU-2018:3074-2)

This update for brings postgresql10 version 10.5 to SUSE Linux Enterprise 12 SP3. FATE325659 bnc1108308 This release marks the change of the versioning scheme for PostgreSQL to a 'x.y' format. This means the next minor releases of PostgreSQL will be 10.1, 10.2, ... and the next major release will...

SUSE SLES12 Security Update : dovecot22 (SUSE-SU-2018:2632-2)

This update for dovecot22 fixes the following issues : Security issue fixed : CVE-2017-15130: Fixed a potential denial of service via TLS SNI config lookups, which would slow the process down and could have led to exhaustive memory allocation and/or process restarts bsc1082828 Note that Tenable...

SUSE SLES12 Security Update : curl (SUSE-SU-2018:1327-2)

This update for curl fixes several issues : Security issues fixed : CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed: If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc1086825 No...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2018:2631-2) (Spectre)

This update for libvirt fixes the following issues : This new feature was added : bsc1094325, bsc1094725: libxl: Enable virsh blockresize for XEN guests This security issue was fixed: CVE-2017-5715: Additional fixes for the Spectre patches bsc1079869 The update package also includes non-security...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:3230-1) (Meltdown)

This update for xen fixes several issues. These security issues were fixed : CVE-2018-8897: Prevent mishandling of debug exceptions on x86 XSA-260, bsc1090820 Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1173-2)

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-8781: The udlfbmmap function in drivers/gpu/drm/udl/udlfb.c had an integer-overflow vulnerability that allowed local users with access to...

SUSE SLES12 Security Update : qpdf (SUSE-SU-2018:3066-2)

This update for qpdf fixes the following issues : qpdf was updated to 7.1.1. Security issues fixed : CVE-2017-11627: A stack-consumption vulnerability which allows attackers to cause DoS bsc1050577. CVE-2017-11625: A stack-consumption vulnerability which allows attackers to cause DoS bsc1050579...

SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2018:1690-2)

This update for java-180-openjdk to version 8u171 fixes the following issues : These security issues were fixed : S8180881: Better packaging of deserialization S8182362: Update CipherOutputStream Usage S8183032: Upgrade to LittleCMS 2.9 S8189123: More consistent classloading S8189969,...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:1764-2)

IBM Java was updated to 7.1.4.25 bsc1093311, bsc1085449 : Security fixes : CVE-2018-2814 CVE-2018-2794 CVE-2018-2783 CVE-2018-2799 CVE-2018-2798 CVE-2018-2797 CVE-2018-2796 CVE-2018-2795 CVE-2018-2800 CVE-2018-2790 CVE-2018-1417 Note that Tenable Network Security has extracted the preceding...

SUSE SLES12 Security Update : Recommended update for ucode-intel (SUSE-SU-2018:1935-2) (Spectre)

The Intel CPU microcode bundle was updated to the 20180703 release. For the listed CPU chipsets this fixes CVE-2018-3640 Spectre v3a and helps mitigating CVE-2018-3639 Spectre v4 bsc1100147 bsc1087082 bsc1087083. More information on:...

SUSE SLES12 Security Update : git (SUSE-SU-2018:1566-2)

This update for git fixes several issues. These security issues were fixed : CVE-2018-11233: Path sanity-checks on NTFS allowed attackers to read arbitrary memory bsc1095218 CVE-2018-11235: Arbitrary code execution when recursively cloning a malicious repository bsc1095219 Note that Tenable Netwo...

SUSE SLES12 Security Update : openslp (SUSE-SU-2018:2779-2)

This update for openslp fixes the following issues : CVE-2017-17833: Prevent heap-related memory corruption issue which may have manifested itself as a denial-of-service or a remote code-execution vulnerability bsc1090638 Prevent out of bounds reads in message parsing Note that Tenable Network...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2344-2) (Foreshadow)

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache...

SUSE SLES12 Security Update : smt, yast2-smt (SUSE-SU-2018:2898-2)

This update for yast2-smt to 3.0.14 and smt to 3.0.37 fixes the following issues : These security issues were fixed in SMT : CVE-2018-12471: Xml External Entity processing in the RegistrationSharing modules allowed to read arbitrary file read bsc1103809. CVE-2018-12470: SQL injection in...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1855-2)

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed : CVE-2018-5848: In the function wmisetie, the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ielen'...

SUSE SLES12 Security Update : gpg2 (SUSE-SU-2018:1698-2)

This update for gpg2 fixes the following security issue : CVE-2018-12020: GnuPG mishandled the original filename during decryption and verification actions, which allowed remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2' opti...

SUSE SLES12 Security Update : bash (SUSE-SU-2018:1398-2)

This update for bash fixes the following issues : Security issues fixed : CVE-2016-7543: A code execution possibility via SHELLOPTS+PS4 variable was fixed bsc1001299 CVE-2016-0634: Arbitrary code execution via malicious hostname was fixed bsc1000396 Non-security issues fixed: Fix repeating...

SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2716-2)

This update for libzypp, zypper provides the following fixes : Update libzypp to version 16.17.20 Security issues fixed : PackageProvider: Validate delta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 PackageProvider: Validate downloaded rpm package signatures before caching bsc1091624...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:2081-2)

This update for xen fixes the following issues : Security issues fixed : CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling XSA-264 bsc1097521. CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks XSA-266 bsc1097523. CVE-2018-12893: Fix DB exception...