opensuse-security@xxxxxxxxxxxx</li> <li><span class="identifier"> Date</span>: Tue, 29 May 2018 18:07:29 +0200 (CEST)</li> <li><span class="identifier"> Message-id</span>: &lt;<a href="msg00112.html">[email protected]</a>&gt;</li> </ul> <!--X-Head-of-Message-End--> <!--X-Head-Body-Sep-Begin--> </div> <div class="body"> <!--X-Head-Body-Sep-End--> <!--X-Body-of-Message--> openSUSE Security Update: Security update for pdns<br> ______________________________________________________________________________<br> <br> Announcement ID: openSUSE-SU-2018:1462-1<br> Rating: low<br> References: #1092540 <br> Cross-References: CVE-2018-1046<br> Affected Products:<br> SUSE Package Hub for SUSE Linux Enterprise 12<br> ______________________________________________________________________________<br> <br> An update that fixes one vulnerability is now available.<br> <br> Description:<br> <br> <br> pdns was updated to 4.1.2.<br> <br> Security fixes:<br> <br> * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046<br> bsc#1092540)<br> <br> Improvements:<br> <br> * API: increase serial after dnssec related updates<br> * Auth: lower ‘packet too short’ loglevel<br> * Make check-zone error on rows that have content but shouldn’t<br> * Auth: avoid an isane amount of new backend connections during an axfr<br> * Report unparseable data in stoul invalid_argument exception<br> * Backport: recheck serial when axfr is done<br> * Backport: add tcp support for alias<br> <br> Bug Fixes:<br> <br> * Auth: allocate new statements after reconnecting to postgresql<br> * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer)<br> * Rather than crash, sheepishly report no file/linenum<br> * Document undocumented config vars<br> * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate<br> <br> Misc fixes:<br> <br> * Move includes around to avoid boost L conflict<br> * Backport: update edns option code list<br> * Auth: link dnspcap2protobuf against librt when needed<br> * Fix a warning on botan &amp;gt;= 2.5.0<br> * Auth 4.1.x: unbreak build<br> <br> <br> Patch Instructions:<br> <br> To install this openSUSE Security Update use the SUSE recommended <br> installation methods<br> like YaST online_update or &quot;zypper patch&quot;.<br> <br> Alternatively you can run the command listed for your product:<br> <br> - SUSE Package Hub for SUSE Linux Enterprise 12:<br> <br> zypper in -t patch openSUSE-2018-538=1<br> <br> <br> <br> Package List:<br> <br> - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x <br> x86_64):<br> <br> pdns-4.1.2-8.1<br> pdns-backend-godbc-4.1.2-8.1<br> pdns-backend-ldap-4.1.2-8.1<br> pdns-backend-lua-4.1.2-8.1<br> pdns-backend-mydns-4.1.2-8.1<br> pdns-backend-mysql-4.1.2-8.1<br> pdns-backend-postgresql-4.1.2-8.1<br> pdns-backend-remote-4.1.2-8.1<br> pdns-backend-sqlite3-4.1.2-8.1<br> <br> <br> References:<br> <br> <a rel="nofollow" href="https://www.suse.com/security/cve/CVE-2018-1046.html">https://www.suse.com/security/cve/CVE-2018-1046.html</a><br> <a rel="nofollow" href="https://bugzilla.suse.com/1092540">https://bugzilla.suse.com/1092540</a><br> <br> -- <br> To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx<br> For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx<br> <br> <!--X-Body-of-Message-End--> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!-- SwishCommand noindex --> </div> <table class="bodynav"> <tr> <td align="left"> &lt; Previous </td> <td align="right"> Next &gt; </td> </tr> </table> </div> <div class="visualClear"></div> </div> </div> </div> <div id="column-one"> <a name="indexes"></a> <div class="portlet" id="p-topnav"> <div class="pBody"> <ul> <li><a href="threads.html">Thread Index</a></li> <li><a href="author.html">Author Index</a></li> <li><a href="date.html">Date Index</a></li> <li><a href="all.html">All Messages</a></li> </ul> </div> </div> <div class="portlet" id="p-logo"> <a style="background-image: url(/skins/opensuse/opensuse.gif);" href="../" title="Back"></a> </div> <script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script> <a name="search"></a> <div id="p-search" class="portlet" style="white-space: nowrap;"> <h5><label for="searchInput">Search this list</label> (Security update for pdns</h5> <!--X-Subject-Header-End--> <!--X-Head-of-Message--> <ul> <li><span class="identifier"> From</span>)

pdns was updated to 4.1.2. Security fixes: Dnsreplay: bail out on a too small outgoing buffer CVE-2018-1046 bsc1092540 Improvements: API: increase serial after dnssec related updates Auth: lower ‘packet too short’ loglevel Make check-zone error on rows that have content but shouldn’t Auth:...

Security update for knot (moderate)

This update for knot fixes the following issues: - CVE-2017-11104: Knot DNS contained a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSI...

Security update for hdf5 (important)

This update for hdf5 fixes the following issues: - fix security issues arbitary code execution: CVE-2016-4330: H5TARRAY Code Execution boo1011201 CVE-2016-4331: H5ZNBIT Code Execution boo1011204 CVE-2016-4332: Shareable Message Type Code Execution boo1011205 CVE-2016-4333: Array index bounds issu...

Security update for glibc (important)

This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - A bug in glibc that could result in deadlocks between...

Security update for mysql-community-server (important)

mysql-community-server was updated to version 5.6.35 to fix bugs and security issues: Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html Fixed CVEs: CVE-2016-8318 boo1020872, CVE-2017-3312 boo1020873, CVE-2017-3258 boo1020875, CVE-2017-3273 boo1020876, CVE-2017-3244 boo102087...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.1 kernel was updated to 4.1.36 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-8655: A race condition in the afpacket packetsetring function could be used by local attackers to crash the kernel or gain privileges bsc1012754. -...

Security update for openssl (important)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 Constant time flag not...

Security update for the Linux Kernel (important)

The Linux kernel for openSUSE Leap 42.1 was updated to the 4.1.15 stable release, and also includes security and bugfixes. Following security bugs were fixed: - CVE-2016-0728: A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc96207...

Security update for java-1_7_0-openjdk (important)

java-170-openjdk was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown...

Security update for php5 (important)

The PHP5 script interpreter was updated to fix various security issues: CVE-2015-6831: A use after free vulnerability in unserialize has been fixed which could be used to crash php or potentially execute code. bnc942291 bnc942294 bnc942295 CVE-2015-6832: A dangling pointer in the unserialization ...

Security update for the Linux Kernel (important)

The Linux kernel was updated to fix various bugs and security issues. Following security issues were fixed: - CVE-2014-8173: A NULL pointer dereference flaw was found in the way the Linux kernels madvise MADVWILLNEED functionality handled page table locking. A local, unprivileged user could have...

kernel: security and bugfix release (important)

The Linux kernel was updated to fix security issues and bugs: Security issues fixed: CVE-2014-3153: The futexrequeue function in kernel/futex.c in the Linux kernel did not ensure that calls have two different futex addresses, which allowed local users to gain privileges via a crafted FUTEXREQUEUE...

update for samba (critical)

Add the ldapsmb sources as else patches against them have no chance to apply. - Samba pre-3.6.4 are affected by a vulnerability that allows remote code exe- cution as the "root" user; PIDL based autogenerated code allows overwriting beyond of allocated array; CVE-2012-1182; bso8815; bnc752797. -...

Security update for python-numpy (important)

openSUSE Security Update: Security update for python-numpy Announcement ID: openSUSE-SU-2022:0134-1 Rating: important References: 1190345 1193907 1193913 Cross-References: CVE-2021-21897 CVE-2021-33430 CVE-2021-41496 CVSS scores: CVE-2021-21897 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A...

Security update for frr (important)

openSUSE Security Update: Security update for frr Announcement ID: openSUSE-SU-2022:0901-1 Rating: important References: 1180217 1196503 1196504 1196505 1196506 1196507 Cross-References: CVE-2022-26125 CVE-2022-26126 CVE-2022-26127 CVE-2022-26128 CVE-2022-26129 CVSS scores: CVE-2022-26125 NVD : 7...

Security update for php7 (moderate)

openSUSE Security Update: Security update for php7 Announcement ID: openSUSE-SU-2022:0699-1 Rating: moderate References: 1038980 Cross-References: CVE-2017-8923 CVSS scores: CVE-2017-8923 NVD : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 SUSE: 5.3...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:1501-1 Rating: important References: 1094840 1133021 1152489 1169263 1170269 1188601 1190523 1190795 1191790 1191851 1191958 1191961 1191980 1192045 1192229 1192267 1192273 1192328 1192718 1192740...

Security update for containerd, docker, runc (important)

openSUSE Security Update: Security update for containerd, docker, runc Announcement ID: openSUSE-SU-2021:1404-1 Rating: important References: 1102408 1185405 1187704 1188282 1190826 1191015 1191121 1191334 1191355 1191434 Cross-References: CVE-2021-30465 CVE-2021-32760 CVE-2021-41089 CVE-2021-410...

Security update for spectre-meltdown-checker (moderate)

openSUSE Security Update: Security update for spectre-meltdown-checker Announcement ID: openSUSE-SU-2021:2861-1 Rating: moderate References: 1189477 Cross-References: CVE-2017-5753 CVSS scores: CVE-2017-5753 NVD : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2017-5753 SUSE: 7.1...

Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3 (moderate)

openSUSE Security Update: Security update for aws-cli, python-boto3, python-botocore, python-serviceidentity, python-trustme, python-urllib3 Announcement ID: openSUSE-SU-2021:1206-1 Rating: moderate References: 1102408 1138715 1138746 1176389 1177120 1182421 1182422 ECO-3352 PM-2485...

Security update for qemu (moderate)

openSUSE Security Update: Security update for qemu Announcement ID: openSUSE-SU-2021:2789-1 Rating: moderate References: 1180432 1180433 1180434 1180435 1182651 1186012 1189145 Cross-References: CVE-2020-35503 CVE-2020-35504 CVE-2020-35505 CVE-2020-35506 CVE-2021-20255 CVE-2021-3527 CVE-2021-3682...

Security update for containerd, docker, runc (important)

openSUSE Security Update: Security update for containerd, docker, runc Announcement ID: openSUSE-SU-2021:1954-1 Rating: important References: 1168481 1175081 1175821 1181594 1181641 1181677 1181730 1181732 1181749 1182451 1182476 1182947 1183024 1183855 1184768 1184962 1185405 Cross-References:...

Security update for squid (important)

openSUSE Security Update: Security update for squid Announcement ID: openSUSE-SU-2021:0879-1 Rating: important References: 1171164 1171569 1183436 1185916 1185918 1185919 1185921 1185923 Cross-References: CVE-2020-25097 CVE-2021-28651 CVE-2021-28652 CVE-2021-28662 CVE-2021-31806 CVSS scores:...

Security update for xstream (important)

openSUSE Security Update: Security update for xstream Announcement ID: openSUSE-SU-2021:0832-1 Rating: important References: 1184372 1184373 1184374 1184375 1184376 1184377 1184378 1184379 1184380 1184796 1184797 Cross-References: CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21344...

Security update for openssl-1_1 (important)

openSUSE Security Update: Security update for openssl-11 Announcement ID: openSUSE-SU-2021:0476-1 Rating: important References: 1183852 Cross-References: CVE-2021-3449 CVSS scores: CVE-2021-3449 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 An update...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2021:0300-1 Rating: moderate References: 1180068 1182123 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

Security update for apache-commons-httpclient (important)

openSUSE Security Update: Security update for apache-commons-httpclient Announcement ID: openSUSE-SU-2020:1875-1 Rating: important References: 1178171 945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.2 An update that fixes two vulnerabilities is now...

Security update for singularity (important)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2020:1769-1 Rating: important References: 1177901 Cross-References: CVE-2020-15229 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2020:1179-1 Rating: important References: 1174538 Cross-References: CVE-2020-15652 CVE-2020-15659 CVE-2020-6463 CVE-2020-6514 Affected Products: openSUSE Leap 15.1 An update that fixes four vulnerabiliti...

Security update for nodejs8 (critical)

openSUSE Security Update: Security update for nodejs8 Announcement ID: openSUSE-SU-2020:0802-1 Rating: critical References: 1166916 1172442 1172443 Cross-References: CVE-2020-11080 CVE-2020-7598 CVE-2020-8174 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilities is now...

Security update for bouncycastle (moderate)

openSUSE Security Update: Security update for bouncycastle Announcement ID: openSUSE-SU-2020:0607-1 Rating: moderate References: 1072697 1100694 Cross-References: CVE-2017-13098 CVE-2018-1000613 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available...

Security update for git (important)

openSUSE Security Update: Security update for git Announcement ID: openSUSE-SU-2020:0524-1 Rating: important References: 1168930 Cross-References: CVE-2020-5260 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for git fixes th...

Security update for tigervnc (important)

openSUSE Security Update: Security update for tigervnc Announcement ID: openSUSE-SU-2020:0087-1 Rating: important References: 1159856 1159858 1159860 1160250 1160251 Cross-References: CVE-2019-15691 CVE-2019-15692 CVE-2019-15693 CVE-2019-15694 CVE-2019-15695 Affected Products: openSUSE Leap 15.1 ...

Security update for postgresql (moderate)

openSUSE Security Update: Security update for postgresql Announcement ID: openSUSE-SU-2019:2685-1 Rating: moderate References: 1100397 1123886 Affected Products: openSUSE Leap 15.1 An update that contains security fixes can now be installed. Description: This update for postgresql fixes the...

Security update for ghostscript (important)

openSUSE Security Update: Security update for ghostscript Announcement ID: openSUSE-SU-2019:2534-1 Rating: important References: 1156275 Cross-References: CVE-2019-14869 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...

Security update for nfs-utils (moderate)

openSUSE Security Update: Security update for nfs-utils Announcement ID: openSUSE-SU-2019:2408-1 Rating: moderate References: 1150733 Cross-References: CVE-2019-3689 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for nfs-uti...

Security update for subversion (important)

openSUSE Security Update: Security update for subversion Announcement ID: openSUSE-SU-2019:1910-1 Rating: important References: 1142721 1142743 Cross-References: CVE-2018-11782 CVE-2019-0203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 An update that fixes two vulnerabilities is now...

Security update for messagelib (low)

This update for messagelib fixes the following issues: The following security vulnerability was addressed: - CVE-2018-19516: Fix a potential issue with opening messages in a new browser window when displaying mails as HTML boo1117958...

Security update for moinmoin-wiki (moderate)

This update for moinmoin-wiki to version 1.9.10 fixes the following security issue: - CVE-2017-5934: Cross-site scripting vulnerability in the GUI editor boo1111104...

Security update for postgresql10 (moderate)

This update for brings postgresql10 version 10.5 to openSUSE Leap 42.3. FATE325659 bnc1108308 This release marks the change of the versioning scheme for PostgreSQL to a "x.y" format. This means the next minor releases of PostgreSQL will be 10.1, 10.2, ... and the next major release will be 11...

Security update for libzypp, zypper (important)

This update for libzypp, zypper fixes the following issues: Update libzypp to version 16.17.20: Security issues fixed: - PackageProvider: Validate delta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 - PackageProvider: Validate downloaded rpm package signatures before caching bsc109162...

Security update for tiff (moderate)

This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-10779: Fixed a heap-based buffer overflow in TIFFWriteScanline in tifwrite.c bsc1092480 - CVE-2017-17942: Fixed a heap-based buffer overflow in the function PackBitsEncode in tifpackbits.c. bsc1074186 -...

Security update for php5-smarty3 (moderate)

This update for php5-smarty3 fixes the following issues: - CVE-2018-16381: Prevent traversal vulnerability due to insufficient template code sanitization that allowed attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files...

Security update for seamonkey (important)

This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr boo1098998. Security issues fixed with MFSA 2018-16 boo1098998: CVE-2018-12359: Buffer overflow using computed size of canvas element CVE-2018-12360: Use-after-free when using...

Security update for python-Django (moderate)

This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the...

Security update for blueman (moderate)

This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authenticatio...

Security update for libcgroup (moderate)

This update for libcgroup fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14348: Fixed a permission issue with /var/log/cgred. The permissions were not restrictive enough beforehand and ignored any umask setting. boo1100365...

Security update for singularity (moderate)

This update for singularity fixes the following issues: - CVE-2018-12021: A race condition might have allowed malicious users to bypass directory image restrictions, like mounting the host root filesystem as a container image boo1100333...

Security update for openjpeg2 (moderate)

This update for openjpeg2 fixes the following security issues: - CVE-2015-1239: A double free vulnerability in the j2kreadppmv3 function allowed remote attackers to cause a denial of service crash bsc1066713 - CVE-2017-17479: A stack-based buffer overflow in the pgxtoimage function in...

Security update for git (important)

This update for git fixes the following issues: This security issue was fixed: - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name bsc1061041. This update was...