SUSE SLED12 / SLES12 Security Update : expat (SUSE-SU-2017:2299-1)

This update for expat fixes the following issues : - CVE-2016-9063: Possible integer overflow to fix inside XMLParse leading to unexpected behaviour bsc1047240 - CVE-2017-9233: External Entity Vulnerability could lead to denial of service bsc1047236 Note that Tenable Network Security has extracte...

SUSE SLED12 Security Update : libraw (SUSE-SU-2017:2300-1)

This update for libraw fixes the following issues : - CVE-2015-3885: A specially crafted raw image file could have caused a Denial of Service through an integer overflow. bsc930683 - CVE-2015-8367: The function phaseonecorrect did not handle memory object initialization correctly, which may have...

SUSE SLED12 / SLES12 Security Update : libzypp (SUSE-SU-2017:2264-1)

The Software Update Stack was updated to receive fixes and enhancements. libzypp : - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. bsc1045735, bsc1038984 - Fix gpg-pubkey release creation time computation. bsc1036659 - Update...

SUSE SLED12 / SLES12 Security Update : samba / resource-agents (SUSE-SU-2017:2237-1) (Orpheus' Lyre)

This update provides Samba 4.6.7, which fixes the following issues : - CVE-2017-11103: Metadata were being taken from the unauthenticated plaintext the Ticket rather than the authenticated and encrypted KDC response. bsc1048278 - Fix cephwrapchdir. bsc1048790 - Fix ctdb logs to /var/log/log.ctdb...

SUSE SLED12 Security Update : freerdp (SUSE-SU-2017:2234-1)

This update for freerdp fixes the following issues : - CVE-2017-2834: Out-of-bounds write in licenserecv bsc1050714 - CVE-2017-2835: Out-of-bounds write in rdprecvtpktpdu bsc1050712 - CVE-2017-2836: Rdp Client Read Server Proprietary Certificate Denial of Service bsc1050699 - CVE-2017-2837: Clien...

SUSE SLED12 / SLES12 Security Update : gnome-shell (SUSE-SU-2017:2217-1)

This update for gnome-shell provides the following fixes : - Fix not intuitive login screen for root user bsc1047262 - Disable session selection button when it's hidden in user switch dialog bsc1034584, bsc1034827 - Fix app windows overlay app list in overview screen bsc1008539 - Properly handle...

SUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:2201-1)

This update for libplist fixes the following issues: Security issues fixed : - CVE-2017-6439: Heap-based buffer overflow in the parsestringnode function. bsc1029638 - CVE-2017-6438: Heap-based buffer overflow in the parseunicodenode function. bsc1029706 - CVE-2017-6437: The base64encode function ...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed : - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1)

This update for curl fixes the following issues : - CVE-2017-1000100: TFP sends more than buffer size and it could lead to a denial of service bsc1051644 - CVE-2017-1000101: URL globbing out of bounds read could lead to a denial of service bsc1051643 Note that Tenable Network Security has extract...

SUSE SLED12 / SLES12 Security Update : openjpeg2 (SUSE-SU-2017:2144-1)

This update for openjpeg2 fixes the following issues : - CVE 2016-7163: Integer Overflow could lead to remote code execution bsc997857. - CVE 2015-8871: Use-after-free in opjj2kwritemco function could lead to denial of service bsc979907. Note that Tenable Network Security has extracted the...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:2141-1)

This update for libxml2 fixes the following issues: Security issues fixed : - CVE-2017-8872: Out-of-bounds read in htmlParseTryOrFinish. bsc1038444 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLED12 / SLES12 Security Update : libsoup (SUSE-SU-2017:2129-1)

This update for libsoup fixes the following issues : - A bug in the HTTP Chunked Encoding code has been fixed that could have been exploited by attackers to cause a stack-based buffer overflow in client or server code running libsoup bsc1052916, CVE-2017-2885. Note that Tenable Network Security h...

SUSE SLED12 / SLES12 Security Update : librsvg (SUSE-SU-2017:2117-1)

This update librsvg to version 2.40.18 fixes the following issues: Security issue fixed : - CVE-2017-11464: A SIGFPE is raised in the function boxblurline of rsvg-filter.c. bsc1049607 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)

This update for puppet fixes the following issues: Security issue fixed : - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as...

SUSE SLED12 / SLES12 Security Update : ncurses (SUSE-SU-2017:2075-1)

This update for ncurses fixes the following issues: Security issues fixed : - CVE-2017-11112: Illegal address access in appendacs. bsc1047964 - CVE-2017-11113: Dereferencing NULL pointer in ncparseentry. bsc1047965 - CVE-2017-10684, CVE-2017-10685: Add modified upstream fix from ncurses 6.0 to...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:2033-1)

This wireshark update to version 2.2.8 fixes the following issues: Security issues fixed : - CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. bsc1049621 - CVE-2017-11410: The WBXML dissector could go into an infinite loop. bsc10492...

SUSE SLED12 / SLES12 Security Update : libzypp, zypper (SUSE-SU-2017:2040-1)

The Software Update Stack was updated to receive fixes and enhancements. libzypp: Security issues fixed : - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. bsc1045735, bsc1038984 Bug fixes : - Re-probe on refresh if the reposito...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2017:2035-1)

This MariaDB update to version 10.0.31 GA fixes the following issues: Security issues fixed : - CVE-2017-3308: Subcomponent: Server: DML: Easily 'exploitable' vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks o...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:2041-1)

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.74 to receive the following security update : - CVE-2017-7533: Bug in inotify code allowed privilege escalation bnc1049483. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE SLED12 / SLES12 Security Update : poppler (SUSE-SU-2017:1999-1)

This update for poppler fixes the following issues: Security issues fixed : - CVE-2017-9775: DoS stack-based buffer overflow in GfxState.cc in pdftocairo via a crafted PDF document bsc1045719 - CVE-2017-9776: DoS integer overflow leading to heap buffer overflow in JBIG2Stream.cc via a crafted PDF...