openSUSE Security Update : MozillaThunderbird (openSUSE-2018-1139)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are...

Security update for python (moderate)

This update for python fixes the following issue: - CVE-2018-1000802: Prevent command injection in shutil module makearchive function via passage of unfiltered user input bsc1109663 This update was imported from the SUSE:SLE-15:Update update project...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2018:2928-1)

This update for openssl fixes the following issues : These security issues were fixed : Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information bsc1104789 CVE-2018-0737: The RSA Key generation algorithm has been shown to be...

SUSE SLES12 Security Update : smt, yast2-smt (SUSE-SU-2018:2898-1)

This update for yast2-smt to 3.0.14 and smt to 3.0.37 fixes the following issues : These security issues were fixed in SMT : CVE-2018-12471: Xml External Entity processing in the RegistrationSharing modules allowed to read arbitrary file read bsc1103809. CVE-2018-12470: SQL injection in...

Security update for libzypp, zypper (important)

This update for libzypp, zypper fixes the following issues: Update libzypp to version 16.17.20: Security issues fixed: - PackageProvider: Validate delta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 - PackageProvider: Validate downloaded rpm package signatures before caching bsc109162...

SUSE SLED12 / SLES12 Security Update : shadow (SUSE-SU-2018:2835-1)

This update for shadow fixes the following security issue : Prevent useradd from creating intermediate directories with mode 0777 bsc1106914 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

openSUSE Security Update : exempi (openSUSE-2018-1022)

This update for exempi fixes the following security issue : - CVE-2017-18236: The ASFSupport::ReadHeaderObject function allowed remote attackers to cause a denial of service infinite loop via a crafted .asf file bsc1085589 - CVE-2017-18233: Prevent integer overflow in the Chunk class that allowed...

openSUSE Security Update : ffmpeg-4 (openSUSE-2018-1004)

This update for ffmpeg-4 to version 4.0.2 fixes the following issues : These security issues were fixed : - CVE-2018-15822: The flvwritepacket function did not check for an empty audio packet, leading to an assertion failure and DoS bsc1105869. - CVE-2018-13300: An improper argument passed to the...

openSUSE: Security Advisory for python3 (openSUSE-SU-2018:2712-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : qemu (openSUSE-2018-996)

This update for qemu fixes the following issues : This security issue was fixed : - CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket...

SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2688-1)

This update for libzypp, zypper fixes the following issues : libzypp security fixes : PackageProvider: Validate delta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 PackageProvider: Validate downloaded rpm package signatures before caching bsc1091624, bsc1088705, CVE-2018-7685 Be sure...

openSUSE: Security Advisory for cobbler (openSUSE-SU-2018:2590-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : ImageMagick (openSUSE-2018-954)

This update for ImageMagick fixes the following issues : Security issue fixed : - Disable PS, PS2, PS3, XPS and PDF coders in default policy.xml bsc1105592 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

Security update for cobbler (important)

This update for cobbler fixes the following issues: Security issues fixed: - Forbid exposure of private methods in the API CVE-2018-10931, CVE-2018-1000225, bsc1104287, bsc1104189, bsc1105442 - Check access token when calling 'modifysetting' API endpoint bsc1104190, bsc1105440, CVE-2018-1000226...

SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2555-1)

This update for libzypp, zypper provides the following fixes : libzypp security fixes : CVE-2018-7685: Validate RPMs before caching bsc1091624, bsc1088705 CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check...

SUSE SLES12 Security Update : qemu (SUSE-SU-2018:2565-1) (Spectre)

This update for qemu fixes the following issues : These security issues were fixed : CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket...

SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:2553-1)

This update for ImageMagick fixes the following issues: Security issue fixed : - Hide PS, XPS and PDF coders into /vulnerable bsc1105592 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

SUSE SLES11 Security Update : mutt (SUSE-SU-2018:2403-1)

This update for mutt fixes the following issues: Security issues fixed : - CVE-2018-14352: Fix imapquotestring in imap/util.c that does not leave room for quote characters bsc1101582. - CVE-2018-14353: Fix imapquotestring in imap/util.c that has an integer underflow bsc1101581. - CVE-2018-14362:...

Security update for xen (important)

This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS...

SUSE SLES11 Security Update : perl-Archive-Zip (SUSE-SU-2018:2388-1)

This update for perl-Archive-Zip fixes the following security issue : - CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or...