SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2989-1)

This update for java-180-openjdk fixes the following issues : - Update to version jdk8u151 icedtea 3.6.0 Security issues fixed : - CVE-2017-10274: Handle smartcard clean up better bsc1064071 - CVE-2017-10281: Better queuing priorities bsc1064072 - CVE-2017-10285: Unreferenced references bsc106407...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2017:2949-1)

This update for ImageMagick fixes the following issues: Security issues fixed : - CVE-2017-15033: A denial of service attack memory leak was fixed in ReadYUVImage in coders/yuv.c bsc1061873 - CVE-2017-11446: An infinite loop in ReadPESImage was fixed. bsc1049379 - CVE-2017-12433: A memory leak in...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2017:2948-1)

This update for krb5 fixes the following issues: Security issues fixed : - CVE-2017-15088: A buffer overflow in getmatchingdata was fixed that could under specific circumstances be used to execute code bsc1065274 Note that Tenable Network Security has extracted the preceding description block...

SUSE SLED12 / SLES12 Security Update : poppler (SUSE-SU-2017:2952-1)

This update for poppler fixes the following issues: This security issue was fixed : - CVE-2017-14517: Prevent NULL pointer dereference in the XRef::parseEntry function via a crafted PDF document bsc1059066. - CVE-2017-14518: Remedy a floating point exception in isImageInterpolationRequired that...

SUSE SLED12 / SLES12 Security Update : shadow (SUSE-SU-2017:2947-1)

This update for shadow fixes several issues. This security issue was fixed : - CVE-2017-12424: The newusers tool could have been forced to manipulate internal data structures in ways unintended by the authors. Malformed input may have lead to crashes with a buffer overflow or other memory...

SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2017:2937-1)

This update for sssd provides the following fixes: Security issues fixed : - CVE-2017-12173: Fixed unsanitized input when searching in local cache database bsc1061832. Non security issues fixed : - Fixed a segfault issue in ldaprfc2307fallbacktolocalusers. bsc1055123 - Install /var/lib/sss/mc...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:2936-1)

This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-15268: Qemu allowed remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c bsc1062942. - CVE-2017-9524: The qemu-nbd server when built with th...

SUSE SLED12 Security Update : libwpd (SUSE-SU-2017:2931-1)

This update for libwpd fixes the following issues: Security issue fixed : - CVE-2017-14226: WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service heap-based buffer over-read in the...

SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2017:2933-1)

This update for webkit2gtk3 to version 2.18.0 fixes the following issues: These security issues were fixed : - CVE-2017-7039: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted website...

SUSE SLED12 / SLES12 Security Update : tcpdump (SUSE-SU-2017:2854-1)

This update for tcpdump to version 4.9.2 fixes several issues. These security issues were fixed : - CVE-2017-11108: Prevent remote attackers to cause DoS heap-based buffer over-read and application crash via crafted packet data. The crash occured in the EXTRACT16BITS function, called from the...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:2860-1)

This update for wireshark fixes the following issues: Wireshark was updated to 2.2.10, fixing security issues and bugs : - CVE-2017-15191: DMP dissector crash wnpa-sec-2017-44 - CVE-2017-15192: BT ATT dissector crash wnpa-sec-2017-42 - CVE-2017-15193: MBIM dissector crash wnpa-sec-2017-43 Note th...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2850-1)

This update for libvirt fixes the following issues: Security issue fixed : - CVE-2017-1000256: Ensure TLS clients always verify the server certificate in the serial/TLS support. bsc1062563 Non security issue fixed : - libvirt-daemon-qemu requires libvirt-daemon-driver-storage bsc1062620 Note that...

SUSE SLED12 / SLES12 Security Update : openvpn (SUSE-SU-2017:2839-1)

This update for openvpn fixes the following issues : - CVE-2017-12166: Lack of bound check in readkey in old legacy key handling before using values could be used for a remote buffer overflow bsc1060877. Note that Tenable Network Security has extracted the preceding description block directly fro...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2831-1)

This update for curl fixes the following issues: Security issues fixed : - CVE-2017-1000254: FTP PWD response parser out of bounds read bsc1061876 - CVE-2017-1000257: IMAP FETCH response out of bounds read bsc1063824 Bugs fixed : - Fixed error 'error:1408F10B:SSL routines' when connecting to ftps...

SUSE SLED12 / SLES12 Security Update : wpa_supplicant (SUSE-SU-2017:2745-1) (KRACK)

This update for wpasupplicant fixes the security issues : - Several vulnerabilities in standard conforming implementations of the WPA2 protocol have been discovered and published under the code name KRACK. This update remedies those issues in a backwards compatible manner, i.e. the updated...

SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:2751-1)

This update for xen fixes several issues: These security issues were fixed : - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2695-1)

This update for samba fixes several issues. These security issues were fixed : - CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file, leaking information from the server to the client bsc1058624 - CVE-2017-12150: Always enforce smb signing when it is configured...

SUSE SLED12 / SLES12 Security Update : openjpeg2 (SUSE-SU-2017:2649-1)

This update for openjpeg2 fixes several issues. These security issues were fixed : - CVE-2016-10507: Integer overflow vulnerability in the bmp24toimage function allowed remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted bmp file bsc105642...

SUSE SLED12 / SLES12 Security Update : dnsmasq (SUSE-SU-2017:2618-1)

This update for dnsmasq fixes the following security issues : - CVE-2017-14491: 2 byte heap based overflow. bsc1060354 - CVE-2017-14492: heap based overflow. bsc1060355 - CVE-2017-14493: stack based overflow. bsc1060360 - CVE-2017-14494: DHCP - info leak. bsc1060361 - CVE-2017-14495: DNS - OOM Do...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2598-1)

This update for libvirt fixes several issues. This security issue was fixed : - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution The update package also includes non-security fixes. See advisory for details. Note that Tenab...