Security update for various KMPs (important)

The Spectre Variant 2 in the Linux Kernel is mitigated using "retpolines". This update rebuilds all openSUSE Leap 42.3 KMPs to use "retpolines" and so be able to mitigate the Spectre v2 attack. bsc1068032 CVE-2017-5715...

openSUSE Security Update : various KMPs (openSUSE-2018-284) (Spectre)

The Spectre Variant 2 in the Linux Kernel is mitigated using 'retpolines'. This update rebuilds all openSUSE Leap 42.3 KMPs to use 'retpolines' and so be able to mitigate the Spectre v2 attack. bsc1068032 CVE-2017-5715 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Security update for MozillaFirefox (important)

This update for Mozilla Firefox to version 52.7.0esr fixes multiple issues. Security issues fixed bsc1085130, MFSA 2018-07: - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5130: Mismatched RTP payloa...

SUSE SLES11 Security Update : xen (SUSE-SU-2018:0678-1) (Meltdown) (Spectre)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2018-5683: The vgadrawtext function...

openSUSE Security Update : MozillaFirefox (openSUSE-2018-255)

This update for Mozilla Firefox to version 52.7.0esr fixes multiple issues. Security issues fixed bsc1085130, MFSA 2018-07 : - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5130: Mismatched RTP paylo...

SUSE SLED12 / SLES12 Security Update : augeas (SUSE-SU-2018:0650-1)

This update for augeas fixes the following issues: Security issue fixed : - CVE-2017-7555: Fix a memory corruption bug could have lead to arbitrary code execution by passing crafted strings that would be mis-handled by parsename bsc1054171. Note that Tenable Network Security has extracted the...

D-Link DIR Series Cross-Site Scripting Vulnerability

D-Link DIR-868L and others are wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/js/bscsmsinbox.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a specially crafted 'Treturn...

PT-2018-17615 · D Link · D-Link Dir-865L +2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L versions DIR868LA1 FW112b04 and earlier D-Link DIR-865L versions DIR-865L REVA FIRMWARE PATCH 1.08.B01 and earlier D-Link DIR-860L versions DIR860LA1 FW110b04 and earlier Description: The issue allows remote attackers to read ...

SUSE SLES11 Security Update : puppet (SUSE-SU-2018:0600-1)

This update for puppet fixes the following issues : - CVE-2017-2295: Fixed a security vulnerability where an attacker could force YAML deserialization in an unsafe manner, which would lead to remote code execution. In default, this update would break a backwards compatibility with Puppet agents...

SUSE SLES11 Security Update : glibc (SUSE-SU-2018:0565-1)

This update for glibc fixes the following issues: Security issues : - CVE-2017-8804: Fix memory leak after deserialization failure in xdrbytes, xdrstring bsc1037930 - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes bsc1051791 - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in internal...

openSUSE Security Update : dhcp (openSUSE-2018-207)

This update for dhcp fixes several issues. This security issue was fixed : - CVE-2017-3144: OMAPI code didn't free socket descriptors when empty message is received allowing DoS bsc1076119. These non-security issues were fixed : - Optimized if and when DNS client context and ports are initted...

SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2018:0506-1)

This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.16, full release notes: https://www.postgresql.org/docs/9.4/static/release-9-4-16.html Security issues fixed : - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable...

SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:0507-1)

This update for postgresql96 to version 9.6.7 fixes the following issues : - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983 A full changelog is available here: https://www.postgresql.org/docs/9.6/static/release-9 -6-7.html Note that Tenable...

openSUSE Security Update : xen (openSUSE-2018-169) (Meltdown) (Spectre)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2017-15595: x86 PV guest OS users were...

Security update for chromium (important)

This update for chromium to version 64.0.3282.167 fixes the following issue: CVE-2018-6056: Incorrect derived class instantiation in V8 bsc1080920...

openSUSE Security Update : freetype2 (openSUSE-2018-156)

This update for freetype2 fixes the following security issues : - CVE-2016-10244: Make sure that the parsecharstrings function in type1/t1load.c does ensure that a font contains a glyph name to prevent a DoS through a heap-based buffer over-read or possibly have unspecified other impact via a...

Security update for docker, docker-runc, containerd, golang-github-docker-libnetwork (important)

This update for docker, docker-runc, containerd, golang-github-docker-libnetwork fixes several issues. These security issues were fixed: - CVE-2017-16539: The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi pathnames, which allowed attackers to trigger data loss when...

openSUSE Security Update : docker / docker-runc / containerd / etc (openSUSE-2018-152)

This update for docker, docker-runc, containerd, golang-github-docker-libnetwork fixes several issues. These security issues were fixed : - CVE-2017-16539: The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi pathnames, which allowed attackers to trigger data loss when...

openSUSE Security Update : libXfont (openSUSE-2018-124)

This update for libXfont fixes several issues. These security issues were fixed : - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads bsc1054285 - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information bsc1049692 - Prevent the X server from...

openSUSE Security Update : libvirt (openSUSE-2018-115)

This update for libvirt provides several fixes. This security issue was fixed : - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed : - Add a qemu hook script providing functionality similar to Xen's...