Security update for gdk-pixbuf (moderate)

This update for gdk-pixbuf fixes the following issues: Security issue fixed: - CVE-2015-4491: Fix integer multiplication overflow that allows for DoS or potentially RCE bsc1053417. This update was imported from the SUSE:SLE-12-SP2:Update update project...

Security update for libraw (moderate)

This update for libraw fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-5813: Fixed an error within the "parseminolta" function dcraw/dcraw.c that could be exploited to trigger an infinite loop via a specially crafted file. This could be exploited to...

Security update for webkit2gtk3 (moderate)

This update for webkit2gtk3 to version 2.20.3 fixes the following issues: These security issues were fixed: - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch bsc1097693. - CVE-2018-4199: An...

Security update for polkit (moderate)

This update for polkit fixes the following issues: Security issue fixed: - CVE-2018-1116: Fix uid comparison lacking in polkitbackendinteractiveauthoritycheckauthorization bsc1099031. This update was imported from the SUSE:SLE-15:Update update project...

Security update for ceph (important)

This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops bsc1099162 - CVE-2018-1129: cephx signature check bypass bsc1096748 - CVE-2018-1128: cephx protocol was vulnerable to replay attack...

Recommended update for enigmail (moderate)

This update for enigmail to 2.0.8 fixes the following issues: The enigmail 2.0.8 release addresses a security issue and solves a few regression bugs. A security issue has been fixed that allows an attacker to prepare a plain, unauthenticated HTML message in a way that it looks like it's signed...

Security update for clamav (moderate)

This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability bsc1101410 - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small fil...

Recommended update for enigmail (moderate)

This update for enigmail to 2.0.8 fixes the following issues: The enigmail 2.0.8 release addresses a security issue and solves a few regression bugs. A security issue has been fixed that allows an attacker to prepare a plain, unauthenticated HTML message in a way that it looks like it's signed...

Security update for java-11-openjdk (moderate)

This java-11-openjdk update to version jdk-11+24 fixes the following issues: Security issues fixed: - CVE-2018-2940: Fix unspecified vulnerability in subcomponent Libraries bsc1101645. - CVE-2018-2952: Fix unspecified vulnerability in subcomponent Concurrency bsc1101651. - CVE-2018-2972: Fix...

Security update for the Linux Kernel (important)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-5390 aka "SegmentSmack": A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP...

Security update for libcgroup (moderate)

This update for libcgroup fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14348: Fixed a permission issue with /var/log/cgred. The permissions were not restrictive enough beforehand and ignored any umask setting. boo1100365...

Security update for cups (moderate)

This update for cups fixes the following issues: The following security vulnerabilities were fixed: - CVE-2017-18248: Handle invalid characters properly in printing jobs. This fixes a problem that was causing the DBUS library to abort the calling process. bsc1061066 bsc1087018 - Fixed a local...

Security update for ovmf (moderate)

This update for ovmf provide the following fix: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth bsc1094290, bsc1094291. Bug fixes: - Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better...

Security update for kernel-firmware (moderate)

This update for kernel-firmware to version 20180525 fixes the following issues: This security issue was fixed: - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction bsc1095735 This updat...

Security update for znc (moderate)

This update for znc fixes the following issues: - Update to version 1.7.1 CVE-2018-14055: non-admin user could gain admin privileges and shell access by injecting values into znc.conf bnc1101281 CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin name. bnc1101280 - Update to...

Security update for libofx (important)

This update for libofx fixes the following issues: The following security vulnerabilities have been addressed: - CVE-2017-2920: Fixed an exploitable buffer overflow in the tag parsing functionality, which could result in an out of bounds write and could be triggered via a specially crafted OFX fi...

Security update for znc (moderate)

This update for znc fixes the following issues: - Update to version 1.7.1 CVE-2018-14055: non-admin user could gain admin privileges and shell access by injecting values into znc.conf bnc1101281 CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin name. bnc1101280 - Update to...

Security update for rpm (moderate)

This update for rpm fixes the following issues: This security vulnerability was fixed: - CVE-2017-7500: Fixed symlink attacks during RPM installation bsc943457 This update was imported from the SUSE:SLE-15:Update update project...

Security update for libsndfile (moderate)

This update for libsndfile fixes the following issues: Security issues fixed: - CVE-2018-13139: Fix a stack-based buffer overflow in psfmemset in common.c that allows remote attackers to cause a denial of service bsc1100167. - CVE-2017-17456: Prevent segmentation fault in the function d2alawarray...

Security update for python-dulwich (moderate)

This update for python-dulwich to version 0.18.5 fixes this security issue: - CVE-2017-16228: Dulwich, when an SSH subprocess is used, allowed remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname bsc1066430. For detailed changes please see...

Security update for mutt (important)

This update for mutt fixes the following issues: Security issues fixed: - bsc1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size bsc1101583. - CVE-2018-14353: Fix imapquotestring in imap/util.c that has an...

Security update for xen (moderate)

This update for xen fixes the following issues: Security issues fixed: - CVE-2018-3665: Fix Lazy FP Save/Restore issue XSA-267 bsc1095242. - CVE-2018-12891: Fix possible Denial of Service DoS via certain PV MMU operations that affect the entire host XSA-264 bsc1097521. - CVE-2018-12892: Fix libxl...

Security update for nautilus (low)

This update for nautilus fixes the following issues: Security issue fixed: - CVE-2017-14604: Add a metadata::trusted metadata to the file once the user acknowledges the file as trusted, and also remove the "trusted" content in the desktop file bsc1060031. This update was imported from the...

Security update for libsndfile (moderate)

This update for libsndfile fixes the following issues: Security issues fixed: - CVE-2018-13139: Fix a stack-based buffer overflow in psfmemset in common.c that allows remote attackers to cause a denial of service bsc1100167. - CVE-2017-17456: Prevent segmentation fault in the function d2alawarray...

Security update for ovmf (moderate)

This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth bsc1094289. This update was imported from the SUSE:SLE-15:Update update project...

Security update for java-10-openjdk (important)

This update for OpenJDK 10.0.2 fixes the following security issues: - CVE-2018-2940: the libraries sub-component contained an easily exploitable vulnerability that allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining unauthorized read access to data...

Security update for util-linux (moderate)

This update for util-linux fixes the following security issue: - CVE-2018-7738: Fix local vulnerability using embedded shell commands in a mountpoint name bsc1084300 This update was imported from the SUSE:SLE-15:Update update project...

Security update for util-linux (moderate)

This update for util-linux fixes the following issues: This non-security issue was fixed: - CVE-2018-7738: bash-completion/umount allowed local users to gain privileges by embedding shell commands in a mountpoint name, which was mishandled during a umount command by a different user bsc1084300...

Security update for wireshark (moderate)

This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-7325: RPKI-Router infinite loop boo1082692 - CVE-2018-14342: BGP dissector large loop wnpa-sec-2018-34, boo1101777 - CVE-2018-14344: ISMP dissector crash wnpa-sec-2018-35, boo1101788 - CVE-2018-14340: Multiple...

Security update for wireshark (moderate)

This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-14342: BGP dissector large loop wnpa-sec-2018-34, boo1101777 - CVE-2018-14344: ISMP dissector crash wnpa-sec-2018-35, boo1101788 - CVE-2018-14340: Multiple dissectors could crash wnpa-sec-2018-36, boo1101804 -...

Security update for bouncycastle (moderate)

This update for bouncycastle fixes the following issues: Security issue fixed: - CVE-2018-1000613: Fix use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' boo1100694...

Security update for libgcrypt (moderate)

This update for libgcrypt fixes the following issues: The following security vulnerability was addressed: - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: - Extended the fipsdrv dsa-sign and dsa-veri...

Security update for rsyslog (moderate)

This update for rsyslog fixes the following issues: The following security vulnerability was addressed: CVE-2015-3243: Make sure that log files are not created world-readable bsc935393 This update was imported from the SUSE:SLE-12-SP3:Update update project...

Security update for glibc (moderate)

This update for glibc fixes the following security issues: - CVE-2017-18269: An SSE2-optimized memmove implementation for i386 did not correctly perform the overlapping memory check if the source memory range spaned the middle of the address space, resulting in corrupt data being produced by the...

Security update for Chromium (important)

This update for Chromium to version 68.0.3440.75 fixes multiple issues. Security issues fixed boo1102530: - CVE-2018-6153: Stack buffer overflow in Skia - CVE-2018-6154: Heap buffer overflow in WebGL - CVE-2018-6155: Use after free in WebRTC - CVE-2018-6156: Heap buffer overflow in WebRTC -...

Security update for Chromium (important)

This update for Chromium to version 68.0.3440.75 fixes multiple issues. Security issues fixed boo1102530: - CVE-2018-6153: Stack buffer overflow in Skia - CVE-2018-6154: Heap buffer overflow in WebGL - CVE-2018-6155: Use after free in WebRTC - CVE-2018-6156: Heap buffer overflow in WebRTC -...

Security update for e2fsprogs (moderate)

This update for e2fsprogs fixes the following issues: Security issues fixed: - CVE-2015-0247: Fixed couple of heap overflows in e2fsprogs fsck, dumpe2fs, e2image... bsc915402. - CVE-2015-1572: Fixed potential buffer overflow in closefs bsc918346. Bug fixes: - bsc1038194: generic/405 test fails wi...

Security update for mercurial (moderate)

This update for mercurial fixes the following issues: Security issues fixed: - CVE-2018-13346: Fix mpatchapply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data bsc1100354. - CVE-2018-13347: Fix mpatch.c that mishandles integer...

Security update for bouncycastle (moderate)

This update for bouncycastle fixes the following issues: Security issues fixed: - CVE-2018-1000613: Fix use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' boo1100694. - CVE-2017-13098: Fix against Bleichenbacher oracle when not using the lightweight APIs boo1072697...

Security update for qutebrowser (moderate)

This update for qutebrowser fixes the following issues: Security issue fixed: - CVE-2018-1000559: Fix an XSS issue on qute://history boo1101507...

Security update for openssl-1_0_0 (moderate)

This update for openssl-100 fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating ...

Security update for openssh (moderate)

This update for openssh fixes the following issues: Security issue fixed: - CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message bsc1076957. This update was imported from the SUSE:SLE-12-SP2:Update update project...

Security update for shadow (important)

This update for shadow fixes the following issues: - CVE-2016-6252: Incorrect integer handling could results in local privilege escalation bsc1099310 This update was imported from the SUSE:SLE-12-SP2:Update update project...

Security update for python (moderate)

This update for python fixes the following issues: The following security vulnerabilities were addressed: - Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. bsc1083507,...

Security update for cinnamon (moderate)

This update for cinnamon fixes the following issues: Security issue fixed: - CVE-2018-13054: Fix symlink attack vulnerability boo1083067. Bug fixes: - Update to version 3.4.6 changes since 3.4.4: osdWindow.js: Always check the theme node on first showing - an actor's width isn't necessarily fille...

Security update for rubygem-sprockets (moderate)

This update for rubygem-sprockets fixes the following issues: The following security vulnerability was addressed: - CVE-2018-3760: Fixed a path traversal issue in sprockets/server.rb:forbiddenrequest?, which allowed remote attackers to read arbitrary files bsc1098369 This update was imported from...

Security update for ImageMagick (moderate)

This update for ImageMagick fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-11625: Fixed heap-based buffer over-read in SetGrayscaleImage in the quantize.c file, which allowed remote attackers to cause buffer over-read via a crafted file. bsc1096200 -...

Security update for libgcrypt (moderate)

This update for libgcrypt fixes the following issue: The following security issue was fixed: - CVE-2018-0495: Fixed a novel side-channel attack, by enabling blinding for ECDSA signatures bsc1097410 This update was imported from the SUSE:SLE-15:Update update project...

Security update for cinnamon (moderate)

This update for cinnamon fixes the following issues: Security issue fixed: - CVE-2018-13054: Fix symlink attack vulnerability boo1083067...

Security update for qutebrowser (moderate)

This update for qutebrowser fixes the following issues: Security issue fixed: - CVE-2018-1000559: Fix an XSS issue on qute://history boo1101507. - CVE-2018-10895: Fix CSRF issue on the qute://settings page boo1100968...