SUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2018:3640-2)

This update for libarchive fixes the following issues : CVE-2016-10209: The archivewstringappendfrommbs function in archivestring.c allowed remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted archive file. bsc1032089 CVE-2016-10349: The...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-2)

This update for libreoffice to 6.0.5.2 fixes the following issues : Security issues fixed : CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by...

SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:3911-2)

This update for tiff fixes the following issues : Security issues fixed : CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf bsc1099257. CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tiflzw.c bsc1113672. CVE-2018-18557: Fixed JB...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:4023-1)

This update for ImageMagick fixes the following issues : Security issues fixed : CVE-2018-18544: Fixed memory leak in the function WriteMSLImage bsc1113064. Non-security issues fixed: Improve import documentation bsc1057246. Allow override system security policy bsc1117463. asanbuild: build ASAN...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:3749-2)

This update for MozillaFirefox fixes the following issues : Security issues fixed : Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 bsc1112852 CVE-2018-12392: Crash with nested event loops. CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript. CVE-2018-12395:...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2018:3590-2)

This update for wireshark fixes the following issues : Wireshark was updated to 2.4.10 bsc1111647. Following security issues were fixed : CVE-2018-18227: MS-WSP dissector crash wnpa-sec-2018-47 CVE-2018-12086: OpcUA dissector crash wnpa-sec-2018-50 Further bug fixes and updated protocol support...

SUSE SLED12 / SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2018:3989-1)

This update for openssl-100 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. Add missing timing side channel patch for...

SUSE SLED12 / SLES12 Security Update : ncurses (SUSE-SU-2018:3967-1)

This update for ncurses fixes the following issue : Security issue fixed : CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function ncparseentry bsc1115929. Note that Tenable Network Security has extracted the preceding description block directly...

SUSE SLED12 / SLES12 Security Update : openssl-1_1 (SUSE-SU-2018:3945-1)

This update for openssl-11 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-0735: Fixed timing vulnerability in ECDSA signature generation bsc1113651. Non-security issues fixed: Fixed infinite loop in D...

SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2018:3926-1)

This update for util-linux fixes the following issues : The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2018:3910-1)

This update for openssh fixes the following issues : Following security issues have been fixed : CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully...

SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:3911-1)

This update for tiff fixes the following issues : Security issues fixed : CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf bsc1099257. CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tiflzw.c bsc1113672. CVE-2018-18557: Fixed JB...

SUSE SLED12 / SLES12 Security Update : procps (SUSE-SU-2018:2451-2)

This update for procps fixes the following security issues : CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2018:2452-2)

This update for libgcrypt fixes the following issues : The following security vulnerability was addressed : CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: Extended the fipsdrv dsa-sign and dsa-verify...

SUSE SLED12 / SLES12 Security Update : rpm (SUSE-SU-2018:3884-1)

This update for rpm fixes the following issues : These security issues were fixed : CVE-2017-7500: rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being...

SUSE SLED12 / SLES12 Security Update : exiv2 (SUSE-SU-2018:3882-1)

This update for exiv2 fixes the following issues : CVE-2017-11591: A floating point exception in the Exiv2::ValueType function could lead to a remote denial of service attack via crafted input. bsc1050257 CVE-2017-14864: An invalid memory address dereference was discovered in Exiv2::getULong in...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2018:3866-1)

This update for openssl fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. Add missing timing side channel patch for DSA...

SUSE SLED12 Security Update : libwpd (SUSE-SU-2018:3812-1)

This update for libwpd fixes the following issues : Security issue fixed : CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable bsc1115713. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLED12 / SLES12 Security Update : postgresql10 (SUSE-SU-2018:3770-1)

This update for postgresql10 fixes the following issues : Security issue fixed : CVE-2018-16850: Fixed improper quoting of transition table names when pgdump emits CREATE TRIGGER could have caused privilege escalation bsc1114837. Non-security issues fixed: Update to release 10.6 : -...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:3749-1)

This update for MozillaFirefox fixes the following issues : Security issues fixed : Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 bsc1112852 CVE-2018-12392: Crash with nested event loops. CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript. CVE-2018-12395:...