SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2018:1926-1) (Spectre)

This update for ucode-intel fixes the following issues: The microcode bundles was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 Spectre v3a and helps mitigating CVE-2018-3639 Spectre v4 bsc1100147 bsc1087082 bsc1087083. More information on:...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2018:3815-1)

This update for salt fixes the following issues : Security issues fixed : CVE-2018-15750: Fixed directory traversal vulnerability in salt-api bsc1113698. CVE-2018-15751: Fixed remote authentication bypass in salt-apinetapi that allows to execute arbitrary commands bsc1113699. Non-security issues...

SUSE SLED15 / SLES15 Security Update : libsndfile (SUSE-SU-2018:2074-1)

This update for libsndfile fixes the following issues: Security issues fixed : - CVE-2018-13139: Fix a stack-based buffer overflow in psfmemset in common.c that allows remote attackers to cause a denial of service bsc1100167. - CVE-2017-17456: Prevent segmentation fault in the function d2alawarra...

SUSE SLED15 / SLES15 Security Update : perl (SUSE-SU-2018:4187-1)

This update for perl fixes the following issues : Secuirty issues fixed : CVE-2018-18311: Fixed integer overflow with oversize environment bsc1114674. CVE-2018-18312: Fixed heap-buffer-overflow write / regnode overrun bsc1114675. CVE-2018-18313: Fixed heap-buffer-overflow read if regex contains \...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2223-1)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2018-5390 aka SegmentSmack: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during I...

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2018:2043-1)

This update for ImageMagick fixes the following issues: The following security vulnerabilities were fixed : - CVE-2018-11625: Fixed heap-based buffer over-read in SetGrayscaleImage in the quantize.c file, which allowed remote attackers to cause buffer over-read via a crafted file. bsc1096200 -...

SUSE SLED15 / SLES15 Security Update : libopenmpt (SUSE-SU-2018:1951-1)

This update for libopenmpt to version 0.3.9 fixes the following issues: These security issues were fixed : - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files containi...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2018:2075-1)

This update for webkit2gtk3 to version 2.20.3 fixes the following issues: These security issues were fixed : - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch bsc1097693. - CVE-2018-4199: An...

SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2018:3080-1)

This update for libxml2 fixes the following security issues : CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279 CVE-2018-14567: Prevent denial of...

SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2018:3925-1)

This update for tiff fixes the following issues : Security issues fixed : CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf bsc1099257. CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tiflzw.c bsc1113672. CVE-2018-18557: Fixed JB...

SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2018:1872-1)

This update for git to version 2.16.4 fixes several issues. These security issues were fixed : - CVE-2018-11233: Path sanity-checks on NTFS allowed attackers to read arbitrary memory bsc1095218 - CVE-2018-11235: Arbitrary code execution when recursively cloning a malicious repository bsc1095219...

SUSE SLED15 / SLES15 Security Update : libvorbis (SUSE-SU-2018:1885-1)

This update for libvorbis fixes the following issues: The following security issue was fixed : - Fixed the validation of channels in mapping0forward, which previously allowed remote attackers to cause a denial of service via specially crafted files CVE-2018-10392, bsc1091070 Note that Tenable...

SUSE SLED15 / SLES15 Security Update : libnettle (SUSE-SU-2018:4193-1)

This update for libnettle fixes the following issues : Security issues fixed : CVE-2018-16869: Fixed a leaky data conversion exposing a manager oracle bsc1118086 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE SLED15 / SLES15 Security Update : fuse (SUSE-SU-2018:3260-1)

This update for fuse fixes the following issues : CVE-2018-10906: fusermount was vulnerable to a restriction bypass when SELinux is active. This allowed non-root users to mount a FUSE file system with the 'allowother' mount option regardless of whether 'userallowother' is set in the fuse...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2018:2714-1)

This update for curl fixes the following issues : This security issue was fixed : CVE-2018-14618: Prevent integer overflow in the NTLM authentication code bsc1106019 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the...

SUSE SLES15 Security Update : squid (SUSE-SU-2018:3786-1)

This update for squid fixes the following issues : Security issues fixed : CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling bsc1113668. CVE-2018-19132: Fixed small memory leak in processing of SNMP packets bsc1113669. Non-security issues fixed: Create runtime...

SUSE SLED15 / SLES15 Security Update : gdm (SUSE-SU-2018:2771-1)

This update for gdm provides the following fixes : This security issue was fixed : CVE-2018-14424: The daemon in GDM did not properly unexport display objects from its D-Bus interface when they are destroyed, which allowed a local attacker to trigger a use-after-free via a specially crafted...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2092-1) (Spectre)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added : - NVDIMM memory error notification ACPI 6.2 The following security bugs were fixed : - CVE-2018-13406: An integer overflow in the uvesafbsetcmap function could have resu...

SUSE SLED15 / SLES15 Security Update : mgetty (SUSE-SU-2018:2894-1)

This update for mgetty fixes the following issues : CVE-2018-16741: The function doactivate did not properly sanitize shell metacharacters to prevent command injection bsc1108752. CVE-2018-16745: The mailto parameter was not sanitized, leading to a buffer overflow if long untrusted input reached ...

SUSE SLED15 / SLES15 Security Update : util-linux (SUSE-SU-2018:2066-1)

This update for util-linux fixes the following security issue : - CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name bsc1084300 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...