SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2018:2679-1)

This update for qemu fixes the following issues : This security issue was fixed : CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket causi...

SUSE SLED15 / SLES15 Security Update : containerd, docker / go (SUSE-SU-2018:4297-1)

This update for containerd, docker and go fixes the following issues : containerd and docker : Add backport for building containerd bsc1102522, bsc1113313 Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. bsc1102522 Enable seccomp support on SLE12 fate325877 Update to...

SUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2018:1888-1)

This update for openvpn fixes the following issues : - CVE-2018-9336: Fix potential double-free in Interactive Service could lead to denial of service bsc1090839. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE SLED15 / SLES15 Security Update : udisks2 (SUSE-SU-2018:3278-1)

This update for udisks2 fixes the following issues : Following security issues was fixed : CVE-2018-17336: A format string vulnerability in udiskslog bsc1109406 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the...

SUSE SLED15 / SLES15 Security Update : Initial update for kernel-azure (SUSE-SU-2018:1952-1)

This update is the initial delivery of the Azure flavor of the Linux Kernel, which contains enhancements and optimizations for running the SUSE Linux Enterprise kernel in the Azure cloud. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2018:1872-1)

This update for git to version 2.16.4 fixes several issues. These security issues were fixed : - CVE-2018-11233: Path sanity-checks on NTFS allowed attackers to read arbitrary memory bsc1095218 - CVE-2018-11235: Arbitrary code execution when recursively cloning a malicious repository bsc1095219...

SUSE SLED15 / SLES15 Security Update : libvorbis (SUSE-SU-2018:1885-1)

This update for libvorbis fixes the following issues: The following security issue was fixed : - Fixed the validation of channels in mapping0forward, which previously allowed remote attackers to cause a denial of service via specially crafted files CVE-2018-10392, bsc1091070 Note that Tenable...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:2298-1)

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues: These security issues were fixed : - Firefox ESR 52.9 : - CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 bsc1098998. - CVE-2018-12368 No warning when opening executable...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2223-1)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2018-5390 aka SegmentSmack: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during I...

SUSE SLED15 / SLES15 Security Update : rsyslog (SUSE-SU-2018:1937-2)

This update for rsyslog fixes the following security issue : - CVE-2015-3243: Prevent weak permissions for generated log files, which allowed local users to obtain sensitive information bsc935393. Note that Tenable Network Security has extracted the preceding description block directly from the...

SUSE SLED15 / SLES15 Security Update : xorg-x11-server (SUSE-SU-2018:3680-1)

This update for xorg-x11-server fixes the following issues : CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges bsc1112020, Note that SUSE by default does not run with elevated privileges, so the default installation is not affected by this problem. Note that...

SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2018:3080-1)

This update for libxml2 fixes the following security issues : CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279 CVE-2018-14567: Prevent denial of...

SUSE SLED15 / SLES15 Security Update : gdm (SUSE-SU-2018:2771-1)

This update for gdm provides the following fixes : This security issue was fixed : CVE-2018-14424: The daemon in GDM did not properly unexport display objects from its D-Bus interface when they are destroyed, which allowed a local attacker to trigger a use-after-free via a specially crafted...

SUSE SLES15 Security Update : squid (SUSE-SU-2018:3786-1)

This update for squid fixes the following issues : Security issues fixed : CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling bsc1113668. CVE-2018-19132: Fixed small memory leak in processing of SNMP packets bsc1113669. Non-security issues fixed: Create runtime...

SUSE SLED15 / SLES15 Security Update : audiofile (SUSE-SU-2018:3506-1)

This update for audiofile fixes the following issues : CVE-2018-17095: A heap-based buffer overflow in Expand3To4Module::run could occurred when running sfconvert leading to crashes or code execution when handling untrusted soundfiles bsc1111586. Note that Tenable Network Security has extracted t...

SUSE SLED15 / SLES15 Security Update : pam_pkcs11 (SUSE-SU-2018:3290-1)

This update for pampkcs11 fixes the following security issues : It was possible to replay an authentication by using a specially prepared smartcard or token bsc1105012 Prevent buffer overflow if a user has a home directory with a length of more than 512 bytes bsc1105012 Memory not cleaned properl...

SUSE SLED15 / SLES15 Security Update : util-linux (SUSE-SU-2018:2066-1)

This update for util-linux fixes the following security issue : - CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name bsc1084300 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

SUSE SLED15 / SLES15 Security Update : lcms2 (SUSE-SU-2018:3498-1)

This update for lcms2 fixes the following issues : CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. bsc1108813 Note...

SUSE SLED15 / SLES15 Security Update : fuse (SUSE-SU-2018:3260-1)

This update for fuse fixes the following issues : CVE-2018-10906: fusermount was vulnerable to a restriction bypass when SELinux is active. This allowed non-root users to mount a FUSE file system with the 'allowother' mount option regardless of whether 'userallowother' is set in the fuse...

SUSE SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2018:1938-1)

This update for java-180-openjdk to version 8u171 fixes the following issues: These security issues were fixed : - S8180881: Better packaging of deserialization - S8182362: Update CipherOutputStream Usage - S8183032: Upgrade to LittleCMS 2.9 - S8189123: More consistent classloading - S8189969,...